Hawktalk

“Data: a new direction” - Amberhawk's response to the DCMS Consultation

This blog comprises the response of Amberhawk Training Limited to the DCMS Consultation document “Data: a new direction”  (the “Consultation”).  Amberhawk is a training company established in 2000; its Directors have over 40 years’ experience in training those who are responsible for data protection in an organisation.

The response is over 15,000 words and takes the form of 7 blogs, each of which are about 2,300 words long.  They were published during the consultation period which ends tonight and have been updated as our understanding of the proposed reforms have improved.  The links to these blogs at the end of this document.

In summary, the blogs cover the following topics.

1. How the data subjects’ privacy protection is much diminished by proposals to change UK_GDPR. This text explains how the DCMS proposals significantly impact on the protection of data subjects to such an extent that the level of privacy protection for data subjects is about that found in the DPA1984.  The Ministerial promise of “maintaining the UK’s world-leading data protection standards” for data subjects is therefore dishonest and lacks credibility.
2. Government propose to reduce DP accountability requirements to OECD standards. The Consultation makes several mistakes and omissions when explaining its DPO proposals.   It follows that its arguments are misleading and its conclusions at this part of the Consultation are suspect. The proposals for a privacy management program do not comprise a recipe for improved data protection management; it is a recipe for inconsistent compliance (as in the DPA1984 and DPA1998) as many controllers will go off on a frolic of their own when deciding how their own programme is implemented and resourced.  It appears that the objective is to align UK DP law with OECD standards; DCMS should be more honest with respect to that objective.
3. Ministers want to pull the strings and rein-in the ICO’s independence. The blog explains why the DCMS proposals ensure that the ICO role is no longer independent of Government and explains how the Secretary of State is in control of key aspects that would identify the ICO as being independent.  If DCMS’s objective is to lose the adequacy agreement with the European Union, implementing these provisions would serve as a good way to achieve this objective.
4. Data Protection accountability suffers as a result of an unconvincing attempt to reduce red-tape. This blog discusses the proposal: to remove the obligation to maintain a register of processing activities (ROPA; A.30); to remove the requirement to undertake DPIAs (A.35 and A.36); and to reduce the circumstances when a data breach is reported to the ICO (A.33).   These will be replaced by far looser requirements that form part of a controller’s privacy management programme. Additionally, I suspect the DCMS author of this part of the Consultation does not understand the role of the ROPA nor the obvious solution to the over reporting of data breaches.  Mention of the processor’s ROPA is missing? Was this deliberate? Is it being retained? Or abolished?  This is an example of the problems associated with the Consultation document.
5. Government propose to tip the scales in the controller’s legitimate interests. As far as I can see, this proposal is based on a false data protection analysis and illustrated by examples that show that no change is needed. Additionally, if the controller’s legitimate interests always prevails, it follows that the data subject’s right to object to the processing and other related rights are also negated.  The impact of these negated rights is missing from the DCMS’s incomplete analysis. In short, if enacted, this proposal will take away rights of those data subjects who could face substantial distress by the processing of their personal data.
6. UK plans for incompatible processing undermines data protection for individuals. The proposals misses out any analysis of A.23(1) and in particular A.23(1)(e);  this undermines the proposals as the text becomes ambiguous as to what is intended.  As far as I can guess the objective is to break the link in A.6(4) between “public interest” and the exemptions in A.23(1) so that Ministers can declare what is in the public interest and negate the compatibility assessment.  Because of the lack of clarity, the outcome of this part of the consultation is suspect.  The analysis shows that proposal to change the law around incompatibility has a knock on effect that negates most of the Principles in A.5, provides a lawful basis for the “incompatible” processing, can involve the processing of special category of personal data and diminish the rights of data subjects.
7. Government’s UK_GDPR proposals for research are unethical and unsafe. The blog shows the proposals for the processing of personal data for research purposes; they are unreliable, untrustworthy and unethical.  For instance, the proposals are so “flexible” they can allow for secret research, using of special category of personal data or criminal offence personal data, similar to the “research” that gave rise to the Cambridge Analytica scandal.

Concluding comments

In summary, the DCMS proposals for changing the UK_GDPR do not impress; there are too many mistakes and errors and the conclusions do not withstand intellectual rigour.  There is no evidence for the changes that the Government want to make and the invocation for responders to provide the evidence does not fill one with confidence.

One also gets the impression that the proposals for change will be pushed through Parliament using Ministerial Powers with little regard to the consequences.

What really irritates is the repeated statements by the DCMS that the proposals comprise “world class data protection” when they palpable do not. A little more honesty from Government would be better (e.g. we want to lower data protection standards to those of our new trading parties).

Links to the blogs

How the data subjects’ privacy protection is much diminished by proposals to change UK_GDPR; https://amberhawk.typepad.com/amberhawk/2021/11/how-privacy-protection-is-much-diminished-by-proposals-to-change-the-uk_gdpr.html

Government propose to reduce DP accountability requirements to OECD standards; https://amberhawk.typepad.com/amberhawk/2021/10/government-propose-to-reduce-dp-accountability-requirements-to-oecd-standards.html

Ministers want to pull the strings and rein-in the ICO’s independence; https://amberhawk.typepad.com/amberhawk/2021/11/ministers-want-to-pull-the-strings-and-rein-in-the-icos-independence.html

Data Protection accountability suffers as a result of an unconvincing attempt to reduce red-tape.; https://amberhawk.typepad.com/amberhawk/2021/11/data-protection-accountability-suffers-as-a-result-of-an-unconvincing-attempt-to-reduce-red-tape.html

Government propose to tip the scales in the controller’s legitimate interests; https://amberhawk.typepad.com/amberhawk/2021/10/government-propose-to-tip-the-scales-in-the-controllers-legitimate-interests.html

UK plans for incompatible processing undermines data protection for individuals; https://amberhawk.typepad.com/amberhawk/2021/10/proposals-for-incompatible-processing-undermine-protection-for-data-subjects.html

Government’s UK_GDPR proposals for research are unethical and unsafe; https://amberhawk.typepad.com/amberhawk/2021/09/governments-uk_gdpr-proposals-for-research-are-unethical-and-unsafe.html

Data Protection Courses (New Year: 2022)

Because of continued COVID double jab / booster uncertainty, the fuel crisis, or the results at Barnsley FC the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection Foundation Course is in London, and starts Tuesday, February 1^st to 3^rd (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]
• The next Data Protection Practitioner Course is in London, and starts Tuesday, January 25 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]

How privacy protection is much diminished by proposals to change the UK_GDPR

The DCMS Consultation document “Data: a new direction”  (the “Consultation”) proposes to tip the balance between the interests of controllers and the interests of data subject in favour of the controller.  This blog looks at the proposals, not in the context of how beneficial they are for controllers, but rather in the context of how they weaken the privacy protection afforded to data subjects.

The weakening provisions being mooted include:

• Introducing a fee arrangement for subject access which has a chilling effect on the subject access right. A £10 fee as per the DPA1998, for instance, is likely to disenfranchise the poor from the right of access;  having lost £20 in universal credit, post COVID, would impoverished data subjects pay £10 for subject access?  It is difficult to fathom how such a proposed fee arrangement forms part of the Government’s “levelling up” agenda.
• A fee arrangement based on FOI Appropriate Limit is likely to apply to complex requests (e.g. where there is personal data relating to more than one individual as is common in education, health and social work). Many of these complex requests risk being refused on the grounds that they are over the equivalent of the FOI Appropriate Limit.
• Effectively removing the A.22 right not to be profiled. As some profiling is to be deemed to be in the legitimate interests of controllers and some profiling deemed to be necessary for public tasks, the original right not to be profiled in A.22 thus only remains for “vital interests” processing.
• Increasing the prospect of unwanted marketing telephone calls unnecessarily. The proposal is for the “soft opt-in” (an “opt-out” in practice) to be extended to all forms of electronic marketing when the unsolicited marketing rules by telephone already allow for the use of an “opt-out” – oops I mean “soft opt-in”.
• Controllers do not work to a unified privacy standard as set out in the UK_GDPR; instead they work to their own data protection standards as set out in their own “privacy management program” (if controllers ever get round to establishing such a program). Unlike the Consultation,  I cannot see how letting controllers “do their own thing” (as per DPA1984 and DPA1998) allows for any consistency in the level of data subject protection.
• The ICO can no longer rely on the controller and processor maintaining records that demonstrates compliance with A.24-A.39 (e.g. appointment of DPO, DPIA, Data Breach, Security, Contracts) much to the detriment of data subjects. Even the ICO’s response to the Consultation states that “Keeping good records is a key element of good privacy management and high standards of privacy”.
• Reducing the ability of the ICO to enforce issues which are very important to a specific data subject but which are not common to many data subjects. The ICO is expected to focus on the important issues that impact on a large number of data subjects and not on issues that may seriously impact a single data subject.
• The change of focus mentioned in the previous paragraph (i.e. consideration of issues relevant to a large set of data subjects) leads to the circumstances when there is fettering of the ICO’s independent course of action. This arises by requiring the ICO to consider matters that have nothing to do with data protection (e.g. the ICO’s duty to consider economic or innovation issues or the public interest).
• The ICO can decide how, to what extent, or whether to investigate a complaint; the ICO cannot be challenged on, for example, a decision to close a case because it is too difficult for the ICO for whatever reason. This prospect could leave a data subject who has a complex case out in the cold.
• Requiring the data subject to attempt to resolve issues with the controller before complaining to the ICO. This can be uncontroversial in many circumstances.  However, the Consultation’s proposals wholly ignore the circumstances when such contact with the controller could cause detriment to the data subject (e.g. in cases of zero hours contracts, how many such contracts will a controller give a complaining data subject?).
• Extending the exemptions in A.49 so that transfers of personal data can be repetitive (and not occasional as of present). This means that personal data can be transferred to any other country on a bulk basis without reference to the data subjects’ wishes or interests or consideration whether the bulk personal data are safe (e.g. from the authorities) in any destination country.
• Allowing the Secretary of State to assign adequacy to groups of countries (e.g. all countries that implement Convention No. 108 are adequate). This means that there is no individual assessment of the level of protection on a case-by-case basis (e.g. there are 55 countries signed up to this Convention).  The Consultation’s pledge to keep each country’s DP law under continual review is simply not credible given that there are more than 100 countries with DP laws.
• The ICO in her response effectively equates the Consultation’s transfer proposals to the data protection equivalent of “Pie in the Sky when you Die”. She states that there are so many unanswered questions (which means the case of change has not been made):

“While we recognise that these proposals are still in development more detail is needed for respondents to fully understand how a risk-based  approach would work in practice. It would also be helpful to understand more detail about the proposals for future adequacy decisions to “take into account the different legal and cultural traditions which inform how other countries achieve high standards of data protection”. We look forward to seeing more detail about how these changes would work in practice” (para 120).

• Extending the processing of a data subject’s special category of personal data by specifying certain processing to be in the public interest or legitimate interests of the controller. Such processing could well occur without reference to the data subject’s wishes or interests (who is left bereft of options to protect their interests).
• Allowing for wider data sharing across the public sector and to include data sharing with private sector bodies without reference to the data subject’s wishes or interests (who is also left bereft of options to protect their interests).

Commentary

The Consultation provides no evidence for most of the legislative changes it claims that are needed.  That is why the Consultation frequently ask its consultees to provide the necessary evidence to substantiate the Government’s proposed change.   This is governance at its very worst;  a classic example of making detailed legislative changes before the existence of evidence for the need for such changes.

Given the sometimes basic errors and omissions in the Consultation’s data protection analysis (see references for some examples), one also wonders about the quality such received evidence.

That is why the Consultation asks respondents to answer the same question many times.  Roughly speaking, this question goes: “We know that controllers find the following data protection elements a right pain in the arse; please explain your answer, and provide supporting evidence where possible”.

The Consultation is largely drafted from a position where the controller becomes entitled to process the data subject’s personal data (i.e. entitled to use, disclose, retain or transfer the personal data) without consideration of how the data subject’s wishes or interests are protected (usually they will not be protected by the proposals in the Consultation).

If data subjects were to complain to the ICO,  they would find that the ICO is fettered by consideration of matters not related to data protection (e.g. a duty to consider the economy, innovation or the public interest).  There is simply no commensurate increase in the ways data subjects could protect their own interests.

In addition, there is very little the data subject can do if the ICO makes a mistaken decision.  Whereas controllers can appeal against the enforcement actions of the ICO, there is no comparable proposal that allows for an appeal for data subjects to obtain a review of the ICO’s decision.  Given the weakening of the ICO’s powers (as described above), the risk is that such mistaken decisions are set to increase.

Indeed, the Consultation makes Judicial Review of the ICO (itself a cumbersome and expensive procedure for data subjects) less likely.

In some circumstances, the proposal is for the substantial public interest or the legitimate interest of the controller to always prevail irrespective of the data subject’s wishes or interests.

Finally,  transparency of processing to the data subject is deemed to be sufficient protection; however if the data subject cannot do much with that transparency, then transparency is, of itself, of little value.

The result is rather similar to when someone is blackmailed; those blackmailed are fully informed as to what the blackmailer knows but can do very little about it.

Liz the Departed

All the proposed changes are occurring at the end of the watch of the departing Elizabeth Denham as ICO;   one wonders how much the changes to the UK’s data protection regime will become her legacy.  Apart from a mere handful of cases over her tenure, she has limited her enforcement action to unsolicited electronic marketing.  Picking on spammers is easy; picking on controllers who have disregarded other GDPR marketing norms (e.g. Adtech) is far more difficult.

One gets the impression that instead of taking the lead in tackling difficult data protection issues of concern, the ICO has preferred to jump on the coat-tails of privacy activists who crowdfund Judicial Review (e.g. facial recognition CCTV and Big Brother watch; Immigration exemption and the Open Rights Group).

Indeed, she has strenuously opposed the Information Rights Tribunal looking at specific issues of ICO inaction (e.g. her failure to address Adtech and the Open Rights Group).

In addition, her response to the Consultation contains too many statements of the kind: “We would also welcome more detail from Government about how these proposals would before we can comment ….”.

This approach is far too laid back.  Sadly the next ICO will only see the requested “more detail” when it is etched on the face of fresh legislation, likely to enacted by Ministerial edict, and not subject to any meaningful Parliamentary debate.

In conclusion, the Ministerial promise of “maintaining the UK’s world-leading data protection standards” is both dishonest and lacks credibility.   I expect the UK’s data protection regime to emerge at a reduced standard somewhere between the DPA1984 and DPA1998.

Data Protection Courses (New Year: 2022)

Because of continued COVID double jab / booster uncertainty, the fuel crisis, or the results at Barnsley FC the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection Foundation Course is in London, and starts Tuesday, February 1^st to 3^rd (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]
• The next Data Protection Practitioner Course is in London, and starts Tuesday, January 25 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]

References

Please feel free to use of previous blogs when responding to the Consultation.

Government propose to reduce DP accountability requirements to OECD standards; https://amberhawk.typepad.com/amberhawk/2021/10/government-propose-to-reduce-dp-accountability-requirements-to-oecd-standards.html

Ministers want to pull the strings and rein-in the ICO’s independence; https://amberhawk.typepad.com/amberhawk/2021/11/ministers-want-to-pull-the-strings-and-rein-in-the-icos-independence.html

Data Protection accountability suffers as a result of an unconvincing attempt to reduce red-tape.; https://amberhawk.typepad.com/amberhawk/2021/11/data-protection-accountability-suffers-as-a-result-of-an-unconvincing-attempt-to-reduce-red-tape.html

Government propose to tip the scales in the controller’s legitimate interests; https://amberhawk.typepad.com/amberhawk/2021/10/government-propose-to-tip-the-scales-in-the-controllers-legitimate-interests.html

UK plans for incompatible processing undermines data protection for individuals; https://amberhawk.typepad.com/amberhawk/2021/10/proposals-for-incompatible-processing-undermine-protection-for-data-subjects.html

Government’s UK_GDPR proposals for research are unethical and unsafe; https://amberhawk.typepad.com/amberhawk/2021/09/governments-uk_gdpr-proposals-for-research-are-unethical-and-unsafe.html

Ministers want to pull the strings and rein-in the ICO’s independence

Summary introduction

The DCMS propose to change the duties of the Information Commissioner (ICO) in such a way that they decrease the prospect of enforcement on data protection grounds; in this way the changes reduce the protection afforded to data subjects.

This prospect arises as the Commissioner will have a duty to consider factors relating to the economy, public safety or the Government’s international agenda prior, for example, to exercising the ICO’s powers of enforcement against a controller.

The Secretary of State is also seeking powers to determine the Commissioner’s priorities.  These include vetting the ICO’s Guidance to ensure it is appropriate for a business friendly, data protection era in the UK.

Apart from minor adjustments to compel witnesses to appear and longer timescales for an ICO investigation,  there is no corresponding strengthening of the Commissioner’s powers.

So, if the Commissioner were to make a misjudgement (e.g. decide that the economic objectives take precedence over the data subject’s privacy) and failed to enforce the DPA2018, there would be no appeal to the Tribunal available to affected data subjects.

However, there would be an appeal to the Tribunal in the reverse situation (e.g. if a controller thinks that the ICO has placed too much emphasis on individual privacy rather than economic objectives when enforcing the DPA2018).

Make no bones about it: the proposals for “Reform of the Information Commissioner’s Office” comprise a power grab to influence (or determine) what the Commissioner’s duties and priorities should be.

Finally, the independence of the UK’s data protection regulator is wholly undermined by these proposals (as shown below).  This has the potential to have a knock on effect with respect to the Adequacy Agreement signed with the European Commission.

The proposals can be found at Chapter 5 of the DCMS Consultation document “Data: a new direction”  (the “Consultation”).

Wider role for ICO

The ICO’s mission statement on its website reads: the ICO is “The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals”.  Notice the wider factors mentioned in the Summary Introduction (e.g. economic considerations) are not mentioned as part of the current mission statement.

So, I was a bit shocked when I read in the ICO’s response to the Consultation, that she already considers her role to be a “whole economy and public sector regulator with extensive domestic and international responsibilities”.  First impression: this was a very grandiose and self-inflated job description especially when all the ICO’s powers (if they were actually used) relate to the data protection regime in the UK.

I have subsequently discovered the Government designated the ICO as having a duty to consider the desirability to promote economic growth four years ago, using powers under Section 108 of the Deregulation Act 2015.  The detail can be found in “The Economic Growth (Regulatory Functions) Order 2017”;  the ICO was one of over a hundred regulators identified in the Order.

Only the data protection functions of the Commissioner are subject to the new economic consideration (i.e. the FOI functions of the ICO are not so constrained); the Equality and Human Rights Commissioner is not constrained at all.

The latter is curious given that data protection is linked to A.8 of the European Convention on Human Rights; so I suspect there may be legal arguments based on the degradation of that A.8 right, that the ICO should not have been included in the list of Regulators subject to S.108.

Neither debate nor discussion

As is usual when Ministers use such powers, Parliament does not debate the main issues; the debate approving the change to a hundred regulators’ duties lasted half an hour and did not specifically mention the ICO.

However, it did cover the important issue of what happens if a Regulator is challenged by an individual if the Regulator considers the duty to consider economic factors prevail over the objective of protecting an individual.  Which one takes precedence? Economy or protection?

I have put in [square brackets] the data protection context to show what the Minister said:

“We want to see regulators balance their regulatory purpose with their duty to promote growth. …. While, in principle, it is possible for a legal challenge to be brought [e.g. by an individual using Judicial Review (JR) to claim that the ICO has the balance between economy and privacy wrong], the statute and the regulations require that regulators have regard to the desirability of promoting economic growth”.

“Providing a regulator does so, a legal challenge [i.e. the JR action taken by the data subject] would fail, so there is no real prospect of a court being asked to consider the particular balance being struck by a regulator.”

“That balance is up to the regulator [e.g. the ICO]  and if they have good reason for their decision—if they have considered their duty to promote economic growth but concluded that, on that occasion, it is trumped by another of their other duties [e.g. to protect the data subject] they will merely have to demonstrate that reasoning” (column 10 of the debate; see references).

So even before we look at the Consultation’s provisions, it can be seen that in data protection terms the protection of the data subject has to trump the duty with respect of the economy.

The convoluted wording (“A person exercising a regulatory function [e.g. the ICO] to which this section applies must, in the exercise of the function, have regard to the desirability of promoting economic growth”) is not an accident.  It is also employed in the Consultation and deliberately designed to reduce the prospect of the ICO being subject to a successful Judicial Review challenge.

Additionally,  there is no Appeal to the Tribunal by a data subject against the ICO’s actions; this is thanks to S.166 of the DPA2018 which the ICO relies on if challenged.  The data subject is thus effectively limited to Court action in relation to data subject’s rights (i.e. a Compliance Order) or maladministration on the part of the ICO via the Parliamentary Ombudsman.

In other words, the data subject is almost bereft of options under the data protection regime if the ICO gets it totally wrong.

New duties and powers

When reading the following list of duties and powers, remember the Minister has already told Parliament that the ICO’s new duties trump the data protection ones.

First, “the government proposes to introduce a new, statutory framework that sets out the strategic objectives and duties that the ICO must fulfil when exercising its functions” (para 321; my emphasis on must).  Evidently the UK’s supposedly “independent” ICO must fulfil the objectives and duties set by Ministers.

The Consultation explains how Ministers will set the ICO’s agenda: “As the ICO's role becomes increasingly important for competition, innovation and economic growth, this strategic framework should empower the ICO to take greater account of impacts in these other domains as it supervises and enforces the UK's data protection regime” (para 321; my emphasis).

The use of the word “empower” is classic doublespeak: it means the ICO is required by law to consider issues unrelated to data protection (e.g. “competition”).   For example, suppose the ICO finds another industry (e.g. like Adtech) that is flagrantly breaking the data protection law (which Adtech has), the “empowerment” to consider “competition, innovation and economic growth” could well prevent the ICO from taking enforcement action to protect data subjects on these grounds.

Secondly, “the government proposes to introduce a power for the Secretary of State for DCMS to prepare a statement of strategic priorities to inform how the ICO sets its own  regulatory priorities.” (para 322).   This spells out how the ICO has to follow the Government’s strategic priorities rather than the ICO’s own regulatory practices.

This is reinforced in para 345 which is unequivocable: “The government proposes to introduce a new power for the Secretary of State for DCMS to periodically prepare a statement of strategic priorities to which the ICO must have regard when discharging its functions”.  These powers exist to ensure the ICO “toes the line”.

Thirdly, “the government proposes to strengthen the ICO’s existing obligations by placing a new duty on it to have regard for economic growth and innovation when discharging its functions.”.  As the Minister explained to Parliament (see above), these duties to consider “economic growth and innovation” can determine that powers to protect privacy are not exercised.

Fourthly, “the government proposes to introduce a duty for the ICO to have regard to competition when discharging its functions”.  For example, suppose a controller would be put at a significant competitive disadvantage by having received an Enforcement Notice that requires the deletion of personal data.  Such a controller would be able to Appeal to the Tribunal that the Notice did not properly take into account the economic, innovation or competition grounds (none of which relate to data protection).

As a reminder, even if the ICO makes a catastrophic error in performing the balancing act between competition and privacy, the data subject cannot appeal to the Tribunal concerning the ICO’s outcome of that balancing act (thanks to S.166 of the DPA2018).

Fifthly, “the government proposes to include, as part of the new framework of objectives and duties, a new statutory objective for the ICO to consider the government's wider international priorities when prioritising and conducting its own international activities” (para 349).  Rough translation:  as the UK is seeking trade deals with certain countries,  the ICO should not rock the enforcement boat if there were to be some dodgy transfers to such countries.

Sixthly, “the government is proposing …the need for the ICO to have due regard to public safety when carrying out its functions”.  So suppose an UK controller (e.g. police; local authority) is processing of CCTV images in breach of data protection obligations.  The duty to consider public safety factors might mean that the breach of the data protection law caused by CCTV surveillance system might not be enforced on public safety grounds.

Degrading the ICO’s mission statement

The degradation of the ICO’s enforcement role is illustrated by the government proposals “to introduce a new overarching objective for the ICO, in addition to its other functions, tasks and duties”.  These “overarching objectives” omit important data protection considerations from the data subjects’ perspective.

The two elements of this “overarching objective“ read like a new mission statement for the ICO; they comprise an attempt to wallpaper over the cracks caused by weakening the ICO.  The Consultation says that the ICO’s objectives are:

• Upholding data rights: this ensures “the ICO can monitor the application of data protection legislation, uphold the data rights of individuals, and safeguard personal data from misuse”.
• Encouraging trustworthy and responsible data use: this ensures “the ICO will uphold the public's trust and confidence in use of personal data”.

The best thing I can do, is edit the above to remove the obvious omissions so you can appreciate the gaps.

These editorial changes are mainly to do with the words “objectives” (it is not clear whether “objectives” trump a “duty”?), the limitations associated with the word “misuse” (this should refer to the word “processing” which is far broader in scope) and the absence of any mention of an objective to explicitly protect data subjects.

My reworded overarching objectives (with added words underlined or [deleted]) reads as follows:

• Upholding data rights: this ensures “the ICO has a duty to monitor and enforce the application of data protection legislation, uphold the data rights of individuals, and to  safeguard the privacy interests of data subjects [personal data from misuse] ”.
• Encouraging trustworthy and responsible data processing [use]: this ensures “the ICO has a duty to [will] uphold the public's trust and confidence in [use] the processing of personal data”.

Anything less than the above change to the text of the overarching objectives is not worth considering.

Further fettering the ICO’s role

The government “proposes to give the Secretary of State for DCMS a …power to give the Secretary of State a 40-day period to approve a code of practice or complex or novel  guidance. If the Secretary of State does not approve it, the ICO must not issue it and another version must be prepared” (my emphasis).

Put bluntly, if ICO guidance contains, for example, too much data protection and not enough economy and innovation it can be refused approval; and has to be re-written.  This equates ICO guidance on data protection with school homework which has not been done properly; the Minister marks it for acceptability.  In short, the ICO is not even in control of its own Guidance.

Additionally, to ensure the ICO comes to the “correct” conclusions (e.g. about the economy and innovation),  the government “proposes to establish an independent board and a chief executive officer at the ICO”;  these are intended “to create greater clarity and certainty” in the ICO’s decision making process (which includes the new duties).

The Board and CEO is not appointed by the ICO but by Ministers “via the Public Appointment process”.  The detail in the Governance Code on Public Appointments (Dec. 2016; section 3) explains how Ministers make all the key decisions.  For example:

• Ministers must agree the composition of Advisory Assessment Panels (i.e. Ministers chose the members of the Panel that choses the CEO or Board Members).
• Ministers must be consulted before a competition opens to agree the job description for the role, the length of tenure and remuneration (Ministers set the job spec) and agree how the post will be advertised and the selection process to be used.
• Ministers may choose to appoint someone who is not deemed “appointable” by the Advisory Assessment Panel or decide to appoint a candidate without a competition.

In other words, these new powerful positions (e.g. CEO) could easily be filled by Party apparatchiks, chosen by Ministers for their loyalty to the cause.

Adequacy undermined?

With respect to the ICO’s independence, the Adequacy Agreement with the European Commission states:

The independence of the Commissioner is explicitly established in Article 52 of the UK GDPR which does not make any substantive changes to Article 52(1)-(3) GDPR.  The Commissioner must act with complete independence in performing her tasks and exercising her powers in accordance with the UK GDPR, remain free from external  influence, whether direct or indirect, in relation to those tasks and powers, and neither seek nor take instructions from anyone. (Para 87: Adequacy Agreement).

So three YES/NO questions to conclude with:

1. Is there a “substantive change” to the ICO’s role?
2. Is the ICO “free of external influence” from the Secretary of State?
3. Can the ICO act with “complete independence”?

My answers are: YES to 1; NO to 2 and 3 – and that is why Adequacy could be an issue.

Is this discussed in the Consultation? Of course not.

 

Practitioner Data Protection Courses

Because of continued COVID uncertainty, fuel crisis, or the results at Barnsley FC the course can be attended in person, or via Zoom, or as a mixture if you something untoward happens: it's up to you.

• The Data Protection Foundation Course is in London, and starts Tuesday, November 16 (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]
• The Data Protection Practitioner Course is in London, and starts Monday, December 6 (5 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]

References

Details of the ICO’s wider “economic” role were spotted via the Information Rights blog of Jon Baines:  https://informationrightsandwrongs.com/2021/02/06/ico-statutory-duty-to-promote-economic-growth/

Parliamentary Report from the Delegated Legislation Committee on the Draft Economic Growth (Regulatory Functions) Order 2017 (28 Feb 2017): https://hansard.parliament.uk/Commons/2017-02-28/debates/720823d2-233c-4ece-921a-0069ca0e2c9e/details

A bonus: the DCMS did not telling the CCTV Surveillance Commissioner about the Consultation: amusing but angry response on https://www.gov.uk/government/publications/data-a-new-direction-commissioners-response/dcms-consultation-data-a-new-direction-response-by-the-biometrics-and-surveillance-camera-commissioner-accessible-version

Data Protection accountability suffers as a result of an unconvincing attempt to reduce red-tape.

Introduction

This blog discusses the DCMS proposal: to remove the obligation to maintain a register of processing activities (ROPA; A.30); to remove the requirement to undertake DPIAs (A.35 and A.36); and to reduce the circumstances when a data breach is reported to the ICO (A.33).   These will be replaced by far looser requirements that form part of a controller’s privacy management programme (see last blog).

As before, the Consultation’s arguments for change are wholly unconvincing and there are significant errors in its analysis.  Additionally, European Commission awarded the UK an adequacy agreement on the assumption that GDPR accountability standards would be maintained; they are not.

This is the second blog dealing with the UK’s proposals to change the accountability requirements in the UK_GDPR towards the levels found in OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data.   The proposals can be found at Chapter 2 of the DCMS Consultation document (“Data: a new direction”) paragraphs 165 to 184.

Reducing accountability – no Controller ROPA

The Consultation’s argument to remove the Register of Processing Activities (ROPA) is incomplete,  omits the ROPA associated with processors, and contains a major fundamental error which undermines its argument for removal of the ROPA.

A ROPA under A.30(1) requires the controller to compile an inventory of all the controller’s processing which is couched in data protection terms (e.g. an inventory of the controller’s processing purposes, recipients, transfers, retention times, security arrangements, and a description of the personal data processed).

Such a ROPA should not be conflated or confused with an Asset Register which contains a description of the controller’s assets, its location, details of asset owner, software licences etc.  Such conflation exists in specification of an inventory for a privacy management programme (para 156(a)(III)(i) of the Consultation).

All processing purposes have to be described in the controller’s ROPA.  If the processing is not described in a ROPA it is tantamount to the admission that the controller is not wholly in control of all the processing of personal data.  That is why ROPA forms part of the accountability arrangements; accountable processing is that described in a ROPA.

One of the Government’s main argument for removing the ROPA is that its content “largely duplicates … the requirement to provide information to data subjects in Articles 13 and 14 of the UK_GDPR”. This statement is wholly incorrect for a number of reasons:

• There are many exemptions from the right to be informed (A.13, A.14) and the related transparency Principle (A.5(1)(a)) when the data subject is not provided details of the processing; there are no exemptions from the A.30 ROPA so details of the exempt processing are captured in the ROPA.
• The A.30(1) ROPA contains a complete description of ALL personal data processed for ALL processing purposes; the A.13 and A.14 obligation is limited to personal data processed for a specific purpose (i.e. the Privacy Notice for one service does not describe all the data items used for all services).
• The retention criteria is an obligatory part of the A.30 register; this retention criteria is not an obligatory requirement to be disclosed by a controller to the data subject (see A.13(2); A.14(2)).
• The A.30(1) ROPA contains a complete list of ALL actual purposes of the processing; the A.13 and A.14 obligations only relate to the intended purposes (i.e. the purpose might not happen) that is associated with the collection of personal data about the data subject.
• In the case of processing of sensitive personal data justified in terms of Schedule 1 of the DPA2018, the A.30(1) ROPA contains details of the policies that apply towards such data; this detail is not provided in relation to A.13 and A.14. (As an aside, this provision is mentioned approvingly in the Adequacy Agreement at para 38).

As explained above, the Consultation is not getting rid of the need for an inventory, as inventories forms part of the proposed privacy management programme.  However, as each controller can decide what to put into its own inventory, there is a significant risk is that inventories become inconsistent across all controllers (e.g. one bank’s inventory might be different to that of another bank).

In summary, there is no substance to the Consultation’s argument, based on the fact that such information is provided to the data subject, that the controller’s A.30 ROPAs should be removed.

Reducing accountability – no Processor ROPA

Wholly omitted by the Consultation is mention of the ROPA compiled by processors(A.30(2)); so one assumes this requirement will also be removed from the UK_GDPR without justification or evidence for its removal.

A ROPA for a processor (A.30(2)) is an inventory of the clients of the processor, and for each client:  what processing is being undertaken; where personal data are transferred outside the UK; and a general description of the security measures employed to protect the personal data.  A controller using a processor therefore should know where its processors are transferring its personal data, as each processor has compiled a list of such transfers for each of its clients.

At least one can say: “Because there is no evidence, the Consultation cannot be challenged or accused of being wrong”.

Reducing accountability – no to DPIA

Under the UK_GDPR, the requirement to undertake a DPIA is triggered when a controller processes personal data that the ICO has identified as high-risk processing (e.g. large scale processing of health records, large scale surveillance).   The ICO maintains a public list of such high risk processing (see references).

The Consultation’s proposal is to remove this requirement “so that organisations may adopt different approaches to identify and minimise data protection risks that better reflect their specific circumstances”.  In other words, it is the controller who decides when to do a risk assessment (i.e. not the ICO) and the controller adopts whatever risk methodology is deemed appropriate by it.

Note that the requirement to do a risk assessment is not being removed.   For example, the “requirements of the privacy management programme” include a requirement for a controller “to have in place risk management processes, including the processes which allow for the identification, assessment and mitigation of data protection risks across the organisation.”

By subsuming the replacement for DPIA as part of the controller’s privacy management programme, any failure to do perform a credible risk assessment cannot be enforced directly by the ICO unless the privacy management programme is, in-itself, deficient.  The proposed change thus protects the controller from being subject to enforcement for a failure to perform a risk assessment.

The change also effectively substitutes the criteria that the ICO has published with respect to  a DPIA with criteria determined by each controller; as noted previously this devolution of responsibility is a recipe for an inconsistent approach to risk assessment.

If there is high risk processing identified in a DPIA, the controller has no need to involve a DPO to get data protection advice, as required by A.39(1)(c), because the post of DPO could well be abolished (see last blog); the fact that the DPIA and DPO proposals are linked is absent from consultation.

In summary,  the proposed change is likely to protect controllers that adopt a lackadaisical approach to risk assessment.

Reducing accountability – no to prior consultation

The Consultation also removes the “prior consultation” provisions in A.36;  this arises when the controller identifies high risk processing that cannot be mitigated and approaches the ICO for “permission to process” (which can be refused).  The Consultation states that as very few controllers consult the ICO, the provision can be removed.

The reason for the low uptake is that prior consultation with the ICO is, in itself, a high risk exercise.  Approaching the ICO for prior consultation would be tantamount to asking the ICO: “Dear ICO, we have high risk processing where adopting GDPR procedures does not mitigate the high risk. Can we have permission to process?”.

Such an approach would have to go through the risk assessment procedures of an organisation, and in my view, the most likely outcome would be a decision not to process personal data until the unmitigated high risks can be reduced to acceptable levels.

That is why the provision is not used; it exists as a back-stop that allows the controller to make an approach to the ICO if there were extenuating circumstances which required the processing to occur despite the existence of residual high risks to data subjects.

The provision is in the controller’s interests if such circumstances arise as processing could get the go-ahead.  It is also in the data subjects interests as there is an independent assessment of whether or not such extenuating circumstances, claimed by the controller, should prevail.  The provision is designed as a provision of last resort and last resort provisions are rarely used.

The removal of the requirement for prior consultation with ICO will therefore increase the risk that such processing occurs without any consultation at all.

For example, suppose a Minister of the Crown sets mandatory high risk processing objectives for certain public bodies without providing these bodies with the resources to mitigate the data protection risks arising from the set processing objectives.

Without prior consultation, such processing can go ahead unabated.  And I suspect it will.

Reducing accountability – less data breach reporting

The Consultation proposes to remove the data breach reporting mechanism because there is over-reporting of data breaches to the ICO.  This over reporting is, in effect, being used as an excuse to raise the barrier for such reporting so that only material data breaches will be reported.

In further detail, the Consultation states that “organisations must report a breach unless the risk to individuals is not material”.  Note that the “risk to individuals” could be a low risk, medium risk or high risk (i.e. there is no change from the risk based assessments in the current arrangements for data breach reporting).

The only change relates to what “material” means.  For instance, a “material fact” is some piece of information important or relevant to an argument or debate.

Personal data material to the data subject therefore carries a connotation that the personal data is of “some importance” to the data subject.  In other words, breaches that the controller deems to be unimportant (e.g. involve non-material personal data) are not reported.

Does the Consultation explain how the controller identifies a data breach involving non-material personal data?  Answer: “No”.

Does the Consultation give examples of  what kind of data breaches are to be reported.  Answer: “No”.

The Consultation avoids these important questions by passing the buck to the ICO who is expected to provide examples of what is material and not material, and when to report and when not to report.

This is exactly the position as with the current data breach reporting regime.

Improve data breach guidance

I will now show how the current legislation is perfectly clear on the subject of data breach reporting to the ICO  – and that no change is needed.

A data breach has to be reported to the ICO “unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons” (A.33(1)).  Part of that breach report to the ICO includes a description of “the likely consequences of the personal data breach” [for natural persons];  (A.33(3)(c)).

The best way to get a handle on “unlikely to result in a risk to … natural persons” is to identify “the likely consequences of the personal data breach” [for natural persons]”.  Note that “likely consequences” of a breach is not what “could happen”; it means reasonable foreseeable consequences.

If one cannot identify any “likely consequences” for natural persons then it follows there is “unlikely to result in a risk to … natural persons” and the breach is non-reportable.

Unlike the Consultation, Recital 89 provides illustrative examples of likely consequences:  “physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality of personal data protected by professional secrecy or any other significant economic or social disadvantage to the natural person concerned”.

If the likely consequences involve none of the above, then the arguments for non-reporting to the ICO are likely to be established.

The way to overcome the problem of over reporting data breaches to the ICO is for the ICO improve her guidance.  The above shows there is no need to raise the threshold of data breach reporting so that only “material” impacts on individuals are reported.

Concluding comment: adequacy

Another significant omission in the Consultation is the impact of the proposed changes on the UK’s Adequacy Agreement with the European Commission.   The relevant part of the Agreement reads:

“The principle of accountability …has been retained … in the UK GDPR without material change and the same applies to Article 24 on the responsibility of the controller .. Article 30 on records of processing activities, Articles 35 and 36 on data protection impact assessment and prior consultation of supervisory authority have also been retained. Articles 37-39 of Regulation (EU) 2016/679 on the designation and the tasks of the data protection officers have been retained in the UK GDPR with no material changes”. (Para. 84)

Clearly, the assumption of that the Commission made, namely that there is to be no material change to the accountability arrangements,  is completely misplaced.  It is surprising that this problem is unworthy of mention in the Consultation.

The fact that UK standards are going down to the OECD level will, one assumes, not go unnoticed especially as the Consultation’s arguments for change are wholly unconvincing.

Data Protection Practitioner Course (Autumn)

Because of continued COVID uncertainty, fuel crisis, or the results at Barnsley FC the course can be attended in person, or via Zoom, or as a mixture if you something untoward happens: it's up to you.

• The Data Protection Foundation Course is in London, and starts Tuesday, November 16 (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]
• The Data Protection Practitioner Course is in London, and starts Monday, December 6 (5 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]

References

The list of when there is a need to perform a DPIA is on https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/data-protection-impact-assessments-dpias/when-do-we-need-to-do-a-dpia/#when4).

ICO on Accountability: https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2017/01/gdpr-and-accountability/

ICO privacy management programme is part of her Accountability Framework: https://ico.org.uk/for-organisations/accountability-framework/

ICO response to the DCMS Consultation: https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2021/10/response-to-dcms-consultation-foreword/