Hawktalk

Government propose to reduce DP accountability requirements to OECD standards

The Government intend to change the accountability arrangements in the UK_GDPR in such a way that it will become harder to hold controllers to account.  In summary, Chapter 2 of the DCMS Consultation document (“Data: a new direction”) makes two main proposals in relation to accountability:

• to reduce or remove the requirement to undertake DPIAs (A.35 and A.36); to reduce or remove the requirement to have a Data Protection Officer (A.37-A.39); to remove the need to create a register of processing activities (ROPA; A.30); and to reduce the need to report a data breach to the ICO (A.33).
• for each controller to develop its own privacy management programme which includes many of the accountability elements similar to those identified in the previous bullet point above.

This is a huge topic so I am splitting my commentary into two blogs; this blog deals with the privacy management programme and the proposal to remove or reduce the DPO role.  The next blog will deal with the rest (e.g. ROPA, data breach reporting).

As with previous blogs, there is a lack of evidence in the Consultation that shows the need for change.

So what is accountability?

If accountability is being changed, what is it being changed from?  I think it best to let the ICO spell it out. In a speech (17 Jan 2017), Ms Denham said:

“But arguably the biggest change [in the UK’s DP regime] is around accountability.

The new legislation creates an onus on companies to understand the risks that they create for others, and to mitigate those risks. It’s about moving away from seeing the law as a box ticking exercise, and instead to work on a framework that can be used to build a culture of privacy that pervades an entire organisation…..

… The GDPR mandates organisations to put into place comprehensive but proportionate governance measures. Good practice tools that the ICO has championed for a long time - such as privacy impact assessments and privacy by design - are now legally required in certain circumstances.

It means a change to the culture of an organisation. That isn’t an easy thing to do, and it’s certainly true that accountability cannot be bolted on: it needs to be a part of the company’s overall systems approach to how it manages and processes personal data.

But this shift in approach is what is needed. It is what consumers expect. The benefit for organisations is not just compliance but also providing an opportunity to develop the trust of its consumers in a sustained way.”

So, according to the ICO, compared with previous DPA1998 and DPA1984 regimes,  the GDPR mandates; “proportionate governance measures”, “good practice tools that the ICO has championed for a long time” and “moves away from seeing the law [a reference to the DPA1998 and DPA1984} as a box ticking exercise”.  Above all “accountability cannot be bolted on” at the end of a project; it’s integrated into project development.

Yet the Consultation claims that better data protection outcomes are achievable, not by having statutory accountability objectives, but instead, by adopting non-statutory objectives similar to those found in the previous DPA1998 and DPA1984 regimes.

It is noteworthy that the Consultation claims (para 139) that the statutory requirements of the UK_GDPR “tends towards a ‘box-ticking’ compliance regime”.  Yet the ICO says a non-statutory approach towards compliance under the previous DPA1998 and DPA1984 regimes created a  “box ticking” mentality.

So who do you trust on box-ticking and improved accountability?  A Government which as a matter of policy has always wanted to diverge UK data protection from European standards, or the UK’s data protection regulator reflecting on the experience of 35 years of data protection law?

What is a privacy management programme?

Central to the new accountability regime is a privacy management programme.  Such a programme is a set of data protection policies and procedures which, according to the Consultation, could be subject to enforcement if it were unfit for purpose.

Such a programme is claimed by the Consultation to provide “a more flexible and risk-based accountability framework” as it is produced by each controller.  Advice as to what a privacy management programme “must” include (note the must!) is given in the Consultation document (para 156).  Note providing this must do list is not the responsibility of the ICO.

The use of the word must in relation to the proposed privacy management programme raises the question: “has anything really changed?”. For instance (see para 156):

• instead of a mandatory DPO, there will be designated responsible “individual(s) for the privacy management programme and overseeing data protection compliance” (e.g. this could be a devolved data protection role with a specified individual in each part of the controller as was commonplace under the DPA1998 and DPA1984).
• Instead of a mandatory ROPA, there will be a “personal data inventory which will describe and explain what data is held, where it is held, why it has been collected and how sensitive it is” (i.e. replace one inventory with another).
• Instead of a DPIA, there will be a requirement to use “risk assessment tools for the identification, assessment and mitigation or privacy risks” (i.e. replacing a risk methodology associated with a DPIA with another risk assessment methodology, yet to be invented).

This, the Consultation claims, allows it “to remove some of the unnecessarily prescriptive or burdensome requirements” (i.e. the ones in A.30, A.33, A.35-A.39).

Yet at the same time the Consultation admits that “the introduction of privacy management programmes may create additional burdens for organisations arising from increased discretion as to how to deliver compliance within the new accountability framework” (my emphasis in para 182).

Barrier to protect or barrier to progress

So either way, one concludes that any data protection regime creates burdens, but this has always has been the case (something which the Consultation overlooks).

The prime objective of data protection is to protect the data subject’s personal data by creating barriers that a controller has to overcome (e.g. if a controller wants to process personal data for something else).  Barriers are designed to protect and get in the way; a flood barrier in a zone that may be flooded might block a road, but no one says remove the flood barrier.

Data protection barriers protect data subjects, and overcoming barriers create burdens, and overcoming burdens is burdensome.  Remove the barriers, reduce the burdens risks reducing the protection for data subjects.

That explains why any removal of barriers has to be justified and evidence based.  There is nothing in the proposal for a privacy management programme which gives me reason to believe that such evidence exists.

Instead the Consultation wants to readers to believe in Cakeism: that is the religion that emerged during the Brexit debates.  In this case, without providing any evidence, the belief that data subjects can have a higher level of protection with reduced burdens for controllers.

No role for the ICO

It is surprising that the Consultation does not specify a role for the ICO in identifying the content of a privacy management programme or the new accountability arrangements in general; the provisions in Canada, Singapore, New Zealand and Australia evidently take precedence (see para 154).

This is reinforced by the Consultation which reduces the ICO’s input into the content of a privacy management programme to be available “to organisations lacking the capacity or expertise to design their own accountability practices” (para 150).  This carries the obvious inference that many controllers can develop their own privacy management programme and can more or less ignore the ICO’s guidance on this subject.

Finally, I note that advice on how to “create a comprehensive privacy management programme” forms part of the ICO’s Accountability Framework (which is mentioned by the Consultation in passing and only in the context of a data breach; para 183). Somehow, this advice does not get a look in.

Why is the ICO deemed to be so unimportant here?  I would have thought the ICO would be hopping mad about being effectively excluded from the design of the very important accountability regime.  Her response to the Consultation is very acquiescent in this regard (see references).

What is the impact of the changes?

In effect, all that is happening is that a set of statutory requirements of the UK_GDPR (e.g. in A.30, A.33, A.35-A.39) are being incorporated as components of a mandatory, but non-statutory, privacy management programme.

In addition, every controller is ploughing its own furrow with regard its own privacy management programme where the ICO’s views can be excluded from the programme’s content.  To my mind, this is not a recipe for improved data protection management; it is a recipe for inconsistent compliance as many controllers go off on a frolic of their own when deciding how their own programme is implemented.

Similarly, if the DPO function can be devolved to several individual(s), that is a recipe for inconsistent delivery of advice, procedures and accountability.  I suspect many readers who experienced the DPA1998 or DPA1984 would be able to vouch for how fragmenting data protection responsibilities does not work.

The proposed changes protect a controller from enforcement.  The UK_GDPR allows a breach of the requirements in each of A.30, A.33, A.35-A.39 to be enforced separately; the Consultation proposals require that the privacy management programme to be so deficient it can be enforced as a whole (the latter being a more difficult).

In summary, I don’t think the DCMS has any evidence to substantiate any change to the current accountability arrangements – that is why the Consultation calls for “evidence” with every question about the proposed changes.

In addition, the ICO has not enforced any accountability obligation since 2018 so there is no case-law that provides a clue that something is obviously wrong with the current accountability arrangements (e.g. unlike say with Durant in the DPA1998 where the definition of “personal data” was narrowed too far).

I was under the mistaken belief that when Government proposed legislative changes, it already had the supporting evidence.  Not in this case evidently.

No private sector DPOs

As shown below, the Consultation makes several mistakes and omissions when explaining its DPO proposals.  It follows that if its arguments are misleading then its conclusions are suspect, then DPO removal or reduction cannot be justified in terms of the official reasons provided by the Consultation.

The Consultation states that the private sector needs a DPO when “certain types of processing” occur (para 161).  A precise (and less sinister) description of these “certain types of processing” would refer to “core activities” that involve the processing of “large scale” special category of personal data or “large scale” criminal offence personal data, or involve systematic or regular surveillance of data subjects on a “large scale”.

The omission of “large scale” and “core activities” plus the use of “certain types of processing” suggest to the reader that more DPOs are needed when, in practice, the current statutory requirement for a DPO is relatively limited.  The Consultation does not provide one example of a DPO being appointed when there was no statutory requirement to appoint one. Important evidence to support the proposed changes is therefore missing.

The Consultation then goes on to state that “Some organisations may struggle to appoint an individual with the requisite skills and who is sufficiently independent from other duties, especially in the case of smaller organisations” and as a result “The government therefore proposes to remove the existing requirements to designate a data protection officer” (para 162-163).

There are at least two things wrong with these two statements.  “Smaller private organisations” would need a DPO only if they were engaged, for example, in large scale and systematic surveillance or the processing of large scale criminal records or health data and these were “core activities”.

Such small organisations, I contend, do not exist in large numbers; the Consultation gives the impression they do.  It is noteworthy that the Consultation does not provide a single example of any such small organisation.

Secondly, when there is a shortage of DPO skills, the Consultation proposes to do away the requirement to have a DPO.

This argument is wholly specious.   For example, does the Government solve the shortage of HGV drivers (or brain surgeons or whatever) by removing the obligation to have the “requisite skills” to become a HGV driver (or brain surgeon or whatever)?

In general, I suspect the need for the appointment of a DPO in the private sector has been worded in order to provide the answer the Government wants:  that many controllers will strongly agree that DPOs are not needed (even though the respondents themselves don’t have to appoint a DPO).

Finally, the idea to abolish DPOs on the basis of a skills shortage shows that how low the Government values the skills of the data protection profession.

No public sector DPOs

With respect to the public sector, the Consultation fails to explain that the mandatory DPO requirement arises from the fact that many public authorities have the powers to demand vast quantities of personal data, or that thousands of data subjects have little choice but provide personal data if they want services from a public authority.

Additionally, the Consultation omits that certain small public bodies (e.g. Parish Councils) have been defined not to be public authorities (see S.7(3) of the DPA2018) with the result that such public bodies do not need a DPO.   Indeed, S.7(4) of the DPA2018 provide powers that can be used to add to the list of public bodies defined not to be public authorities (i.e. no DPO needed).

It is surprising that the fact that these powers exist is wholly omitted by Consultation; expanding the current list of small public authorities from the need to have a DPO is the obvious way of resolving any problem.

Finally, the Consultation does not provide a single example of a small public authority that does not need a DPO.  The evidential base is again deficient.

Motive for change

The Consultation, with all its emphasis on the data protection regimes of Singapore, Canada and Australia reveals a possible motive for change: it is to reduce UK_GDPR standards closer to those set out in the “OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data”.  Removal of A.30, A.33, A.35-A.39 is consistent with that motive.

Such a move would support the UK’s application to become a member of Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP) whose members include (guess who?) Australia, Canada and Singapore.  Part of the negotiation could be the promised use of powers of the Secretary of State under S.17 of the DPA2018 to determine that CPTPP countries are adequate.

If my suspicions are correct, all the talk in the Ministerial Forward about “maintaining the UK’s world-leading data protection standards” is complete twaddle.  Instead “it’s the economy, stupid": the UK desperately wants trading partners not hitched to the European standards of data protection.

It’s not quite “if you buy our Yorkshire Puddings, the UK will chuck in a adequacy determination” but it is a step in that direction.

With that in mind, I propose the UK_GDPR should be renamed the UK_OECD.

Data Protection Practitioner Course (late Autumn)

Because of continued COVID uncertainty, fuel crisis, or the results at Barnsley FC the course can be attended in person, or via Zoom, or as a mixture if you something untoward happens: it's up to you.

• The Data Protection Foundation Course is in London, and starts Tuesday, November 16 (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]
• The Data Protection Practitioner Course is in London, and starts Monday, December 6 (5 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]

References

• ICO on Accountability: https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2017/01/gdpr-and-accountability/
• ICO privacy management programme is part of her Accountability Framework: https://ico.org.uk/for-organisations/accountability-framework/
• ICO response to the DCMS Consultation: https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2021/10/response-to-dcms-consultation-foreword/

Government propose to tip the scales in the controller’s legitimate interests

The Government proposes that the “Legitimate Interests” balancing test between controller and data subject in A.6(1)(f) is changed so that the controller’s legitimate interests always prevails in a limited number of pre-defined circumstances.

As far as I can see, this proposal is based on a false data protection analysis and illustrated by examples that show that no change is needed.

If the controller’s legitimate interests always prevails, it follows that the data subject’s right to object to the processing and other related rights are also negated.  The impact of these negated rights is missing from the DCMS analysis.

In short, if enacted, this proposal will take away rights of those data subjects who could face substantial distress by the processing of their personal data.  The proposals are found in section 1.4  of the DCMS Consultation document (“Data: a new direction”).

How the “balance of interests” works

The balance of interests test found in Article 6(1)(f) of the UK_GDPR states that personal data can be lawfully processed when the ...

“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject….” (my emphasis).

There are four important observations about Article 6(1)(f):

• the legitimate interest lawful basis is a “safety net” lawful basis for the controller/third party if the processing cannot be justified in terms of any other lawful basis (e.g. necessary for a contract with the data subject, legal obligation, public interest task).
• the legitimate interest of the controller/third party cannot be an interest that causes significant detriment to the data subject’s interests (as the data subject’s interests will override those of the controller). The controller/third party interest thus has to be an uncontroversial interest which any data subject can see as being legitimate and reasonable (e.g. profitability, efficiency of the controller).
• the legitimate interest of the controller/third party does not negate the interests of the data subject in preserving his/her privacy, data protection rights and does not cause, for example, unwarranted distress to the data subject.
• the processing of personal data has to be necessary to pursue that legitimate interest (i.e. the processing cannot be excessive in achieving that legitimate objective; any processing has to be proportionate).

Note that the controller’s legitimate interests have to be overridden by the interests of the data subject if the data subject’s interests are to prevail.  So one can see that the balance of interests is initially tipped in favour of the controller.

It follows that if the controller’s interests are not overridden then the processing is lawful. More importantly, if there is no impact on, or significant detriment to, the data subject, the processing by the controller can also occur lawfully.

Secondly, use of this lawful basis expects that the “fundamental rights and freedoms of the data subject” to be protected.  This is achieved by complying with the UK_GDPR.  For example, the controller/third party:

• establishes procedures that deal with data subject’s rights;
• complies with the Principles (data minimisation, accuracy, purpose limitation, retention and security); and
• is transparent, accountable and meets other obligations (e.g. DPIA if required).

The real problem when using this lawful basis arises as the controller is not in a position to recognise all the relevant “interests” of the data subject.  The controller can have a good guess at what these interests are, but in general, the controller cannot identify the specific circumstances, unique to the data subject, that are likely to cause unwarranted distress to the data subject etc as only the data subject knows what these are.

This explains why the right to object in A.21 is so important.

Adding the right to object

The right to object in A.21 allows each data subject to inform the controller of grounds relating to his/her specific circumstances (which the controller is not in the position to identify).  The objective is for the controller to repeat the balancing test for this specific data subject when given this new information. If the revised balance is in favour of the data subject, then the processing ceases for that specific data subject.

For example, suppose a controller is placing details of employees on the intranet to facilitate efficient contact at work (the controller’s legitimate interest).  Suppose further a particular employee has a security problem that emerges following the intranet posting (e.g. a woman has escaped from a violent relationship).

That woman could exercise the right to object to the processing and get her details (and only her details) removed from the employers intranet site (e.g. as she does not want friends of her abuser who work for the employer to tip off the abuser).

Other rights (A.18 and A.19) augment the right to object (A.21). All these rights do not feature in the Consultation’s analysis yet as explained above they are central to the legitimate interests test.

Other issues with the DCMS analysis

The Consultation states that many controllers have found the balancing test difficult to perform; it reports that:

“When relying on legitimate interests as a lawful ground, the UK_GDPR requires organisations to show that the processing is necessary and to document how their interests outweigh the rights of data subjects. Assessing whether the organisation’s interests outweigh the rights of individuals appears to cause the most uncertainty for data controllers” (para 58; my emphasis)

Note that the above quote assumes the controller’s interests have to outweigh the data subject’s whereas the lawful basis itself is founded on the reverse assumption (i.e. the data subject’s interests have to outweigh the controller’s).

Additionally, the Consultation also does not mention that the same balancing test was incorporated into the First Data Protection Principle of the DPA1998; hence the Consultation is reporting difficulties that, presumably,  have encountered by these controllers for at least two decades.

What do you think would happen if a driver was stopped by the police for going through a red traffic light, and explained the error as follows: “Do you know what?  I have had difficulty with this part of the Highway Code for 23 years now; the Code must be wrong”.

Yet the Government is basing its proposals on comments like this from controllers. This just adds to my view that the DCMS analysis in this area is incomplete and the product of this analysis suspect.

Examples of the new approach

The Consultation suggests several examples where the legitimate interests of the controller will always prevail (paragraph 61).

Several of these examples do not have any measurable impact on the data subject so it follows that the legitimate interests of the controller would prevail without any change in the law (e.g. when correcting bias in AI systems, enhancing security perhaps by using pseudonymised personal data,  making personal data anonymous, improving services or safety of a product, business innovation, efficiency).

Other examples listed are better justified using lawful basis other than Article 6(1)(f) (e.g. disclosures of personal data to third party authorities; statutory public consultation, delivery of statutory notices, public health messages).

Even if Article 6(1)(f) did apply in disclosure to an authority, the third-party’s legitimate interest would inevitably prevail.  For instance, what do you think if the data subject said: “the police should not have received the personal data because my interests in not being apprehended for a crime, outweigh the police’s interests in pursuing an investigation?”.

One example is a requirement of the Accuracy Principle (e.g. maintaining accuracy of a database) – so I am ignoring it.

However, a few examples listed (e.g. “business innovation”, “improving” service delivery) could be interpreted as straying into a marketing or market research purpose.  If such straying occurred, then the right to object to marketing, whether data subject consent for the marketing purpose is required, and transparency obligations would become data subject “rights and freedoms” that would have to be addressed prior to relying on A.6(1)(f).

However, I am concerned that some respondents will read these elements of the Government’s list as including marketing-type initiatives and will respond enthusiastically in favour of them, especially as the data subject's right to object is negated.

This uncertainty adds to the unreliability of the evidence collected in support of the proposals in Section 1.4 of the Consultation.

Singaporean Model (debt recovery)

It appears the Government might emulate Singaporean DP law to say that debt recovery is always in the legitimate interest of the controller.  This allows me to show why this could cause severe problems for a few data subjects.

Suppose someone “does a runner” and fails to pay for a service and the controller starts debt recovery processing.  Do you think the data subject’s interests will be able to prevail with the following argument: “the controller should not process my personal data because my interests in not paying outweigh the controller’s interests in being paid for services I have used?”.  Can we agree that the right to object will not prevail?

However, suppose the controller has mixed up personal data so there are two data subjects with the same name and very similar addresses whose personal data are confused, so much so, that one data subject is being pursued remorselessly (i.e. harassed) for the debts of the other data subject.

Suppose further the controller fails to take any notice of the data subject who has been pursued for the debt (who will probably make repeated representations about not being responsible for the debt).  I should add this kind of problem has happened in the UK..

In these kinds of circumstances, the UK_GDPR permits a data subject to exercise three rights in A.21, A.17 and A.18.  The essence of the letter to the controller is as follows:

“Your failure to identify the correct data subject with a debt is causing me so much grief that I am exercising my right:

• • to object to the processing of the debt information; (A.21)
  • to restrict your processing until you have completed the necessary rebalancing test in accordance with A.18(1)(d); and
  • to obtain a list of recipients to whom your rubbish personal data have been disclosed” (A.17).

If the Government’s proposals are enacted, this protection for data subjects who experience these kinds of extreme circumstances is gone.

Concluding comment

At the beginning of the blog I said that the DCMS proposals “if enacted will take away rights of those data subjects who could face substantial distress by the processing of personal data”.  The debt example above makes this statement understandable.

In most circumstances the DCMS has identified, the legitimate interests of the controller will prevail and no change in the law is needed.  However, there may be a specific and rare combination of circumstances where the data subject’s interests should prevail. 

After all, there are 60 million data subjects in the UK and it is reasonable to expect that all sorts of mysterious combinations of circumstances will interact with any controller’s processing of personal data.

The proposals that a controller’s legitimate interests should automatically prevail do not simplify the law.  They expose a few data subjects to suffer unwarranted substantial distress and who are left to swing in the wind.

So the answers to Q1.4.1 and Q1.4.2 are strongly disagree for the reasons above; Q1.4.3 is that no change is needed to safeguard the data subject’s interests.

Data Protection Practitioner Course (Autumn)

Because of Indian variant, fuel crisis and the continuing COVID pingdemic uncertainty, the course can be attended in person, or via Zoom, or as a mixture if you get pinged (it's up to you).

• The Data Protection Foundation Course is in London, and starts Tuesday, November 16 (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]
• The Data Protection Practitioner Course is in London, and starts Monday, December 6 (5 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]

UK plans for incompatible processing undermines data protection for individuals

This blog is limited to commentary on the Government’s proposals for the Further Processing of personal data found in section 1.3 of the DCMS Consultation document (“Data: a new direction”).

In summary, the Consultation proposes to exempt the application of the Purpose Limitation (or Finality) Principle whenever there is an important public interest in the further processing; this further processing could be undertaken by a controller different to the one that collected the personal data. 

As this blog shows, the meaning of “important public interest” is left deliberately opaque and many important data subject safeguards are negated.

As much scientific research (e.g. a national cancer registry) will be judged to be in the important public interest,  these provisions in section 1.3 are very relevant to most researchers.

In my view, if anything causes the European Commission to pull the plug on its UK adequacy determination, the implementation of these section 1.3 proposals will carry a significant part of the blame.

Purpose Limitation – what is it?

If one considers the Purpose Limitation Principle (“Personal data shall be collected for a specified, explicit and legitimate purpose and not further processed in a manner incompatible with those purposes”), it can be seen that the Principle protects the data subject from a controller saying one thing about the processing of personal data at the time of collection and, in future, doing something else completely different with the personal data.

Notice the key word used in the Purpose Limitation Principle is “incompatible” and not “different”.  For a processing purpose to be “incompatible” with the purpose of collection it has to be “very very different” from that purpose specified at the time of collection (e.g. in a transparency or privacy Notice), explicit (e.g. the Notice is clearly explained) and “legitimate” (e.g. the purpose of collection has an A.6 lawful basis).

The proposals in the Consultation document are the complete opposite (e.g. “further processing for an incompatible purpose may be permitted when it safeguards an important public interest”).   This change protects the controller from the data subject so long as the further “incompatible” processing purpose is in the “important public interest”.

So is processing for the “important public interest”  the same thing as the processing for “other important objectives of general public interest” as specified in Article 23(1) of the UK_GDPR especially at A.23(1)(e)?  The answer appears to be NO.

So what’s in Article 23(1)(e)?

The provision in A.23(1)(e) allows for an exemption from all incompatibility considerations if the processing is to meet “other important objectives of general public interest”.  However, the implementation of any exemption has to be “necessary and proportionate measure in a democratic society”  and particular safeguards for data subjects have to be in place; these are set out in A.23(2).

The Consultation’s proposals relating to further processing that is in the “important public interest”, by contrast, do not mention the words “necessary”, “proportionate” nor make any reference to the A.23(2) safeguards.

So is the difference between “other important objectives of general public interest” (as used in A.23(1)(e))  and “important public interest”  (as used by the Consultation) explained?   Answer: No.    Are there examples of “important public interest” provided by the Consultation? Answer: “No”.

It follows that the meaning of “important public interest” in the Consultation has nothing to do with defence, national security, law enforcement, prisons, probation,  court procedures, regulatory action, financial matters, budgets, public health, social security, tax and free speech etc as all these important public interest considerations are already implemented in the UK as exemptions described in Schedules 2 to 4 of the DPA2018.

My best guess is that the term “important public interest” as used in the Consultation is defined as follows: “an important public interest is an interest that a Minister considers may be important to the public”.

I suspect many respondents to the Consultation will not spot the difference between the two “public interest” cases discussed above.  They will think of their own examples of important public interest (e.g. disclosure for tax or money laundering purposes) when responding to the Consultation.  If this suspicion is correct, respondents views on questions Q1.3.1 to Q1.3.4 are wholly unreliable.

Consequences for the UK_GDPR

Setting the navel gazing on the meaning of important public interest etc to one side, it is important to understand the consequences if the proposition (e.g. “further processing for an incompatible purpose may be permitted when it safeguards an important public interest”) ever comes into data protection law.

The lawful basis for such further processing will be A.6(1)(e) – “task carried out in the public interest”.  As there is a lawful basis, the lawfulness test of the first Principle in A.5 is met  (A.5(1)(a)).

In the previous blog, I showed that the processing might not be transparent to the data subject, especially in the context of a further research purpose.  These provisions (described last time)  could be used negate the fairness and transparency limb of this Principle as well; especially if research can be tagged as being of important public interest.

There also appears to be no barrier to including the use of special category of personal data (see Schedule 1 of the DPA2018) or indeed criminal offence personal data in any important public interest processing.  This is because many of the conditions in Schedule 1 are subject to a substantial public interest test which looks very similar to the important public interest test suggested by section 1.3.

The right to object is effectively negated (the processing is in the important public interest remember), as is the right to erasure for the same reason.

If legislation specifies the processing of specific items of personal data to be in the important public interest, this will negate the Principles in A.5(1)(c) and A.5(1)(e).  This is because the legislation specifies that the personal data will be relevant to an important public interest purpose and can be retained for as long as that important public interest purpose exists.

Any residual fairness issue (A.5(1)(a)) will be resolved as part of the new law (i.e. the “challenges to ensure re-use remains fair and within reasonable expectations” will be “taken care of”, and of course the Purpose Limitation Principle will be set aside for reasons of “important public interest”.

Concluding comment

It can be seen that a proposal to change the law around incompatibility has a knock on effect that negates most of the Principles in A.5, provides a lawful basis for the “incompatible” processing, can involve the processing of special category of personal data and diminish the rights of data subjects.

Welcome to another example of the “UK’s world leading data protection standards”, as specified in the Ministerial Forward to the Consultation Document.

Data Protection Practitioner Course (Autumn)

Because of Indian variant, fuel crisis and the continuing COVID pingdemic uncertainty, the course can be attended in person, or via Zoom, or as a mixture if you get pinged (it's up to you).

• The Data Protection Foundation Course is in London, and starts Tuesday, November 16 (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]
• The Data Protection Practitioner Course is in London, and starts Monday, December 6 (5 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]