Hawktalk

UK’s human rights proposals significantly weaken protection for all data subjects

The Ministry of Justice (MoJ) Consultation,  “Human Rights Act Reform: A modern Bill of Rights”,  has the potential to significantly undermine the application of UK’s data protection regime.

These MoJ proposals are in addition to the DCMS proposals which also weakened the UK_GDPR (discussed in various blogs last November).  Neither the DCMS nor the MoJ make any reference to the fact that their separate public consultations are connected when data protection is concerned.  One wonders how this fundamental omission was missed?

The MoJ Consultation, in summary, is designed to expurgate any European contamination associated with the words “necessary”, “public interest” and “proportionate”.  For example, MoJ proposes changing the interpretation of the word “necessary” so that “great weight” has to be given to Parliament’s view of what is necessary. The same goes for “public interest”.

This has a knock on to the data protection regime.  For example,  the word “necessary” is used in: three Principles in A.5; most lawful bases in A.6; most conditions for the processing of special category of personal data and criminal offence personal data (A.9, A.10 and Schedule 1 of the DPA2018) and several A.23(1) exemptions.

It can be seen that if that “great weight has to be given to Parliament’s view of "necessary" processing, then any enforcement action by the ICO becomes far more difficult. And if the data protection regime cannot be properly enforced, it follows that the protection for data subjects is weakened.

In addition, the MoJ Consultation uses the term “public interest” over 70 times, without a formal definition.  This is like the DCMS consultation “Data: a new direction” which uses the term “public interest” more than 40 times without defining it.

So when Ministers refer to “the public interest” what they mean?

As will be seen, the answer I derive is not a happy one.

ICO as A.8 ECHR Commissioner?

Both the DPA2018, UK_GDPR & Human Rights Act (HRA) are intertwined mainly through the word “necessary” as used, for example, in A.6 of the UK_GDPR or in A.8(2) of the European Convention on Human Rights (ECHR).

For instance, in the context of interference by a public body into an individual’s private and family life (e.g. by police surveillance), the interference (i.e. surveillance) can be justified if it is necessary to safeguard the functioning of a democratic society for reasons listed in Article 8(2) of the ECHR (e.g. “necessary … for the prevention of crime”).

The European Data Protection Board explained the linkage between the data protection and human rights regimes in the following terms:  “In cases where there is 'interference with privacy' [legitimised in terms of A.8(2) of the ECHR] a legal basis is required [as a result of A.6 of the GDPR] … as a precondition to assess the necessity of the interference”. (quotation from WP217).

In other words, when there is an interference by a public body, A.8(2) of the ECHR sets out a general “necessity” requirement for the processing of personal data to be lawful whilst A.6 of the GDPR additionally sets out why that processing is “necessary” (e.g. “necessary for a legal obligation” etc).

The corollary is also valid: a public authority does not infringe the A.8(1) ECHR right, if it can show that its interference by the processing of personal data is justified (i.e. necessary) and has an A.6 lawful basis (e.g. necessary for its public task).

Note that it is possible for the ICO to enforce A.8 ECHR when personal data are processed by a public authority via its link to A.6 of the GDPR.  For example,  if a public authority controller misapplied its powers to disclose personal data, then it could not rely on the obvious lawful basis as the disclosure of personal data would, for instance, not be necessary for a legal obligation  (as the legal obligation has been misapplied).

In other words, the breach of A.8 would also translate into a breach of the relevant lawful basis, in this example A.6(1)(c).  It is the same for “public task” in A.6(1)(e).

It follows that the ICO (as can any European Data Protection Authority) can make an assessment of necessity or proportionality and could become an A.8 Commissioner whenever personal data were processed by a public body.

Unfortunately all data protection regulators (UK and in Europe) down the ages have steadfastly refused to go down this road except, in the UK, for one notable case (see references which also contains a link to a definitive document on the reach of A.8).

Changes to “necessary” & “public interest”

The MoJ Consultation suggests two possible legislative changes to the human rights regime which have significant interpretive impact across the UK_GDPR.  Namely, those UK_GDPR provisions that rely on the words “necessary” or “in the public interest” for their effect.

Note that the text of the UK_GDPR does NOT change (e.g. the UK_GDPR provision still refers to “necessary”), but the interpretation and consequential impact on application or enforcement of the UK_GDPR does change significantly.

These proposed legislative changes will apply when an A.8 case is heard by a Court; these require the Court to give “great weight”:...

“… to Parliament’s view of what is necessary in a democratic society (and the fact that Parliament has enacted the legislation is for these purposes determinative of Parliament’s view that the legislation is necessary in a democratic society)”;

Or (this “or” could possibly end up being an “and”?)

“… to the fact that Parliament was acting in the public interest in passing the legislation” (page 100; MoJ Consultation;  my emphasis).

“Legislation” as used in the above quotations is defined to be  “primary legislation, and subordinate legislation …. which has been approved by a resolution of either or both Houses of Parliament” (i.e. the affirmative resolution Parliamentary procedure has been followed).

If the MoJ proposals become law, it can be seen that whenever Parliament enacts legislation that relates to (or requires) the processing of personal data, this fact has to be given “great weight” by the Courts when assessing whether the processing is “necessary” or “in the public interest”.

Clearly therefore, the ICO will also have to give them “great weight” prior to enforcing the data protection regime (or indeed in the ICO’s official data protection guidance).

Worked example

Suppose the ICO is enforcing the lawful basis used for the processing of personal data by a public authority and suppose further the processing was authorised by law or related to its public task functions as set in legislation approved by Parliament.

To have a successful enforcement under A.6, the ICO has to establish that the processing was neither “necessary” nor “in the public interest” AND overcome the “great weight” that has to be given to the alternative view (e.g. Parliament’s view that the processing was necessary).

This allows a public authority controller that is facing such ICO enforcement action (e.g. for unlawful processing) to defend the ICO’s action in Court (or Tribunal) arguing that: “The ICO has failed to give  “great weight” to Parliament’s view that the controller’s processing was indeed necessary”.

Similarly, if the “in the public interest” option arises; the argument changes to: “The ICO has failed to understand that “great weight” had to be given to the  “public interest” in the processing especially as the Controller was merely following Parliament’s wishes”.

Remember, in general, A.6(1)(e) provides a lawful basis for the processing if it is “necessary for the performance of a task carried out in the public interest” where the public interest in question is likely to carry automatic “great weight”  (in favour of the controller rather than the data subject).

Wider impact on the UK_GDPR

The question then arises as to whether this kind of knock on effect undermines other data protection provisions where the words “necessary” or “the public interest” are used?  I am afraid to say that I suspect this is the case.

For instance the word “necessary” appears in three Principles in A.5, most lawful bases in A.6, most conditions for the processing of special category of personal data and criminal offence personal data (A.9, A.10; Schedule 1) whereas ”public interest” appears in A.23 exemptions, certain rights (e.g. A.13), Schedules 1 to 5 of the DPA2018 (Special category of personal data and exemptions), transfer arrangements, data breach notification etc (and in a number of other places).

So assume the Government use powers approved by Parliament in the Digital Economy Act 2017 to specify data sharing between two controllers of specified personal data for a specified period.  Suppose further the ICO considers that the controllers were processing excessive personal data for far too long.

The controllers can resist any ICO enforcement to by arguing:

• Parliament has determined that the lawful basis for the processing is both “necessary” and “in the public interest” (i.e. A.6(1)(e)) and this fact should carry “great weight”;
• The Data Minimisation Principle is not breached because Parliament has explicitly stated the processing of certain items of personal data; these have been deemed necessary for the purpose and this fact should carry “great weight”;
• The Storage Limitation Principle is not breached because Parliament has explicitly specified the that personal data should be retained in a name linked form for a specific period; Parliament has deemed this retention time as being “necessary” for the purpose, and that this fact carries “great weight”.

It can be seen that there is not much data protection left  (e.g. transparency, security) and the provisions in the MoJ Consultation (as illustrated above) effectively comprise an exemption from the two Principles mentioned above and A.6. 

Note also that the data subject’s right to object also becomes almost exempt as the objection has to overcome the fact that Parliament has judged that the continued processing by the controller has to carry great weight.

With respect to “substantial public interest” (as used in Schedule 1 to legitimise the processing of special category of personal data),  the DCMS has suggested changes where legislation specifies when the substantial public interest is satisfied (para 297 of DCMS Consultation).

If this happens the processing will automatically become “necessary” and this fact will have to be given  “great weight” by the ICO.  The result is that such special category of personal data and criminal offence personal data could be made easier to process by public bodies to the detriment of the protected offered to data subjects.

In the public interest?

With respect to enacting legislation, what Government wants usually is enacted;  there is no separation of powers in the UK as the executive (i.e. Government) sits in the legislature (i.e. Parliament) and is in control of the legislature’s agenda. This is exacerbated by an Electoral System that delivers majority Governments with a minority popular vote (e.g. 58% of the Parliamentary seats with 43.6% of the popular vote).

This means that opposition parties might huff and puff, but with a large majority, a Government should get its legislative way.

The point being made is that Parliament could vote primary legislation down but very rarely does so.  So when the MoJ Consultation refers to  “…Parliament’s view of what is necessary in a democratic society “  it is really referring to what the Government considers as being necessary in a democratic society.

Similarly when Parliament acts in the public interest in passing the legislation it is usually because Government has the view that the proposed legislation is in the public interest.

It’s the same with the secondary legislation subject to affirmative resolution procedures.  Although in theory, secondary legislation can be voted down, it is not.  A House of Commons Research Paper on Statutory Instrument explains that:

“In the House of Commons, the last time a draft Statutory Instrument subject to affirmative procedure was not approved was in July 1978 when the draft Dock Labour Scheme 1978 was defeated by 301 votes to 291. (see references).

So, in summary, what is necessary is what the Government specifies as necessary; what is in the public interest equates to the interests of the Government of the day.

But then it gets worse.  Given the primacy of the (almost Presidential) post of Prime Minister, what is “in the public interest” equates to “in the interests of Boris Johnson”, insofar, at the time of writing, he is the current Prime Minister of the UK.

Now that is a really unpleasant thought to end with.

Data Protection Courses (Winter 2022)

Because of continued COVID uncertainty, fuel crisis, or the results at Barnsley FC the course can be attended in person, or via Zoom, or as a mixture if you something untoward happens: it's up to you.

• The Data Protection Practitioner Course is in London, and starts Tuesday, March 22-25; March 29-31 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]
• The Data Protection Foundation Course is in London, and starts Tuesday, February 1st to 3rd (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]

References

Information Commissioner should enforce Article 8 privacy rights http://amberhawk.typepad.com/amberhawk/2010/04/information-commissioner-should-enforce-article-8-privacy-rights.html

Information Commissioner’s enforcement proceedings links Article 8 to unlawful processing. https://amberhawk.typepad.com/amberhawk/2012/11/information-commissioners-enforcement-proceedings-links-article-8-to-unlawful-processing.html

House of Commons Research Paper on Statutory Instruments: https://researchbriefings.files.parliament.uk/documents/SN06509/SN06509.pdf

Guide to Article 8 prepared by the Registry of the European Court of Human Rights: https://www.echr.coe.int/Documents/Guide_Art_8_ENG.pdf

Example of affirmative SI procedure for the “Economic Growth (Regulatory Functions) Order 2017”:  see middle of Ministers want to pull the strings and rein-in the ICO’s independence; https://amberhawk.typepad.com/amberhawk/2021/11/ministers-want-to-pull-the-strings-and-rein-in-the-icos-independence.html

Human Rights proposals undermine Data Protection and Adequacy

The proposals to change the human rights regime outlined in Ministry of Justice (MoJ) Consultation,  “Human Rights Act Reform: A modern Bill of Rights”, are truly awful.  This is especially the case when combined with the proposed restrictions on Judicial Review that helps ensure that public authorities process personal data lawfully in accordance with Article 8 (A.8) of the Human Rights Convention.

As will be seen in the next few blogs, the human rights legislation that protects us all and underpins the data protection regime is in serious jeopardy.  I therefore encourage readers to enter the fray and make their views clear. 

It goes without saying that these changes, if implemented, would significantly jeopardise the Adequacy Agreement with the European Commission.  Does the Ministry of Justice (MoJ) consultation mention the impact on the Adequacy Agreement? Of course not; like the DCMS consultation “Data: a new direction”, it remains silent on this important issue.

In addition, the MoJ’s case for changing the UK’s human rights regime with respect to A.8 is wholly misleading.  To use a topical idiom: the MoJ Consultation “is as truthful as a BoJo”.

In summary, the proposals are unacceptable and, in the next few blogs, I will explain why this is the case.

Summary of the changes

The text of the human rights listed in Schedule 1 of the Human Rights Act 1998 is not being changed; however, its interpretation and application is.

In summary, the MoJ proposed changes relevant to this blog (I.e. A.8) include:

• empowering domestic courts to apply human rights in the UK context. Comment: the UK Courts are not required to follow European Court of Human Rights judgments.
• changing the ability of individuals to protect their A.8 rights by requiring the UK courts to give “great weight” to the views of Parliament (e.g. the “public interest” or “necessity” is essentially determined by Parliament).  Comment: public bodies will be presumed to be working in “the public interest” when they act in a way that is authorised by legislation enacted by Parliament.
• changing the balance between A.10 (freedom of expression) and A.8 (respect to private and family life); there will be a presumption that the former should prevail over the latter. Comment:  this can be seen as a “thank you for your continued support”, from the Conservative Party,  to its friends in the largely Brexit supporting media.
• making it harder for individuals to take human rights cases by “ensuring that spurious cases do not undermine public confidence in human rights”. Comment: the individual could be required to exhaust other remedies first, then obtain leave of the court in order to pursue an A.8 case and then show prior “significant disadvantage” or demonstrating an “overriding public importance”.

Note that the above constitute a subtle change to our human rights.  The text of the actual rights has not changed but exercise of these rights, or an interpretation that favours the individual complainant, becomes very much harder to establish.

In summary, Government can claim “nothing has changed” (e.g. to the text of A.8 right), but a great deal will change when individuals attempt to exercise the A.8 right.

Adequacy down the tubes?

The threat to Adequacy Agreement arises because the European Commission thought that..:

• there was “… United Kingdom’s adherence to the ECHR … as well as its submission to the jurisdiction of the European Court of Human Rights”. (para 19; my emphasis). Comment: as explained above, the UK is no longer “submitting” to the jurisdiction of the European Court. The MoJ  Consultation spells this out “…that the judgments and decisions of the European Court  of Human Rights … are not part of the law of any part of the United Kingdom” (page 100 of MoJ)
• “….any person that considers that his or her rights, including rights to privacy and data protection, have been violated by public authorities, can obtain redress before the UK courts under the Human Rights Act 1998”. Comment: the MoJ proposals put considerable hurdles in the way of any person seeking such redress (e.g.  show prior “significant disadvantage” etc;  para 109).
• there was “continued adherence to such instruments” (i.e. “submission to the jurisdiction of the European Court of Human Rights”; para 120). ”. Comment: “continued adherence”  is no longer the case.

I now move on to the misrepresentation of A.8 position as expressed in the MoJ Consultation.

The case of Marper v UK

Marper v the UK is an important example of an A.8 case that the MoJ Consultation ignores (see references).

The case surrounds a simple question: “should the DNA sample and the numerical representation of that DNA sample,  be deleted if a suspect, charged of a crime, is acquitted?”.  So should the police be able to retain DNA of people found innocent?  Before reading on, what’s your answer: YES or NO?

As an aside, I explained in a blog 13 years ago that the current retention policy relating to DNA will eventually produce a DNA database that spans the population (see references).

Marper is interesting in that, when before the House of Lords (now called the Supreme Court), a panel of five law Lords (all senior judges) found unanimously in favour of retention of DNA by the police.  By contrast, a full panel of ECHR Court judges found 17-0 in favour of Mr. Marper (i.e. unanimously the other way).

If the Government’s proposals were to become law, DNA of the innocent would have been lawfully retained by the police as the highest Court in the UK would have made an unanimous determination.  Such retention would be very different for European police forces.

In addition, I suspect all the surveillance A.8 cases where the national security agencies and the police have overstepped the mark (e.g. bulk personal data collection; use of CCTV facial recognition) would have been lost if the MoJ’s proposals were law.

One obvious reason for this is that the claimant would not be able to overcome the “significant disadvantage” threshold.  For instance, how do you know that you are subject to secret covert surveillance?  Answer:  you don’t know.   So how can you establish “significant disadvantage” before taking action.  Answer: you can’t. 

In general therefore many actions on human rights grounds are likely to fall at first base.  There will be limited leeway for a judge to allow a case to go to trial if a "highly compelling reason" of "public importance" can be established pre-trial, but this pathway is designed to be exceptional-use only.

Should the MoJ Consultation have given examples like Marper that illustrate the complex human rights issues involved  (e.g. what happens if the UK is out of step with the rest of Europe) so that respondents can make an informed and balanced response? The MoJ answer is: “of course not”; the subject is not even raised.

The case of Ellis

Does the MoJ give examples where it thinks individuals have won A.8 cases without merit? Answer: YES (in spades), especially in the area of prisoner voting and deporting immigrants.

However,  this “evidence” is presented in a very misleading way and this is illustrated by the case of R (Ellis) v the Chief Constable of Essex Police as used in the MoJ Consultation.

At the heart of Ellis is a simple question?  Should the police be able to deter crimes by printing posters or leaflets that identify known criminals who have been arrested or put behind bars?  So before reading on, what’s your answer: “YES”, “IT DEPENDS” or “NO”?

The MoJ consultation explains that the Ellis case:

“…has led to the situation where police forces face a real risk of legal challenge, where they wish to publicise the results of criminal activity or deter others by issuing posters identifying offenders who have been convicted for very serious crimes” (para 137).

Does the MoJ Consultation explain how the Court come to its conclusions in favour of Ellis? Of course not.  So I will provide the missing links.

In its evidence, the Probation Service provided the following explanation to the Court:

"If Gary Ellis were to be made subject to the Essex police naming scheme, this is likely to make worse the risk of homelessness, drug misuse, reoffending, non-compliance on licence and is likely to increase the risk of harm to the public. If named there is also the distinct possibility of some collateral harm to the parents of Gary Ellis, his ex-partner and his daughter."  (para 10-12 of the Ellis judgement).

So what’s your answer now: “YES” or “NO”?

In a later A.8 case, involving the London Borough of Brent (see references), the Ellis arguments resurfaced to prevent the distribution of a leaflet that identified youths who were excluded from a geographic area (e.g. a shopping centre).  The youths were subject to an Anti-Social Behaviour Order (ASBO) which specifically excluded named individuals from that area and the police wanted to enforce the ASBO by distributing a leaflet that identified those who were subject to the ASBO.

So should the leaflet be circulated by the police (e.g. to shopkeepers)? YES” or “NO”?

In this case, the A.8 argument used in Ellis was rejected by the Judge in the following terms:

“It is clear to me that whether publicity is intended to inform, to reassure, to assist in enforcing the existing orders by policing, to inhibit the behaviour of those against whom the orders have been made, or to deter others, it is unlikely to be effective unless it includes photographs, names and at least partial addresses.”  (para 40; my emphasis)

It is interesting to note that both the Met Police and L.B. Brent argued that the A.8 right was not engaged; the Judge rejected that view but concluded that “Article 8 could be involved if the publicity was found to be unnecessary or disproportionate”.

So these are the criteria that resolves the problem raised by the MoJ’s consultation in Ellis.  If the publication of personal data is necessary and proportionate then there is no A.8 breach, if publication is unnecessary or disproportionate there is an A.8 breach. 

In my view, all that is required is a proper assessment of necessity and proportionality; not a change in the law.   Is this explained by the MoJ Consultation? Of course not.  It wants to tip the scales in favour of Government.

Hence my conclusion that the arguments presented by the MoJ Consultation in support of the changes to the A.8 regime do not stand up to scrutiny.

Concluding comment

I have found one paragraph from the MoJ Consultation deeply unsettling and I wonder whether you read it the same way as I am.  This paragraph reads as follows:

“The Prison Service has settled claims alleging a combination of negligence, inhuman and degrading treatment (under Article 3), the violation of the right to a privacy (under  Article 8) and discrimination (under Article 14). This has cost the taxpayer around £7 million, including compensation paid out and legal costs” (bottom page 40).

Do you think the MoJ Consultation is suggesting that these settled claims are unfounded and should not have been settled?  Does this then imply that a small amount of “negligence, inhuman, degrading treatment, violation of the right to a privacy and discrimination” is somehow acceptable to the Prison Service?

As the MoJ Consultation wants to change the law, the answer is an inferred “YES”; hence my alarm. Note that the Consultation is promoting the “Prince Andrew” defence:  “No inhuman and degrading treatment occurred but we are paying compensation anyway (AND please sign our Non-Disclosure Agreement)”.

In other words,  the worrying reason why the Government is wanting to change the human rights regime to “make the law difficult to use so we can get away with it”.

Data Protection Courses

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection Foundation Course is in London, and starts Tuesday, February 1^st to 3^rd (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]
• The next Data Protection Practitioner Course is in London, and starts Tuesday, March 22 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]

References

The Adequacy Agreement with the UK: https://ec.europa.eu/info/sites/default/files/decision_on_the_adequate_protection_of_personal_data_by_the_united_kingdom_-_general_data_protection_regulation_en.pdf.

Human Rights Consultation Document from the MoJ: https://consult.justice.gov.uk/human-rights/human-rights-act-reform/.

Marper v UK references: Case of S. and Marper  v. The United Kingdom, (Applications nos. 30562/04 and 30566/04; judgement delivered 4 December 2008);  Regina v. Chief , Constable of South Yorkshire Police (Respondent) ex parte LS and Marper [2004] UKHL 39, judgment delivered 22 July 2004).

Blogs relevant to Marper:

• Marper case exposes how Parliament cannot consider human rights issues: https://amberhawk.typepad.com/amberhawk/2010/01/uk-terror-case-judgment-illustrates-a-failed-system-that-cannot-protect-privacy.html.
• Example of divergence between the UK and European approach to A.8 in Marper: https://amberhawk.typepad.com/amberhawk/2009/11/uk-courts-view-any-data-retention-as-human-rights-compliant.html.

2009 blog “Indefinite retention produces a DNA database that spans the population”: https://amberhawk.typepad.com/amberhawk/2009/12/indefinite-retention-produces-a-dna-database-that-spans-the-population.html.

R (Ellis) v the Chief Constable of Essex Police ([2003] EWHC 1321 (Admin)) https://www.bailii.org/ew/cases/EWHC/Admin/2003/1321.html.

R (Stanley et al) v Metropolitan Police and L.B. of Brent ([2004] EWHC 2229 (Admin)): https://www.bailii.org/ew/cases/EWHC/Admin/2004/2229.html.

Independent evidence that the DCMS data proposals could undermine adequacy.

First of all Happy New Year; I hope the recent festive excitement was not too infectious.  Indeed, with the risky policy of letting Omicron rip, let us hope there are not too many ex-data subjects, possibly as a result of the collapse of essential services.

I am starting the Year with a real treat; I have been given permission to publish the personal views of Rosemary Jay as submitted to the DCMS consultation “Data: a new direction” (see link at end of the blog).  It is a detailed 30 page submission.

I should add that I am a fan of all Rosemary’s writings and publications.  They are always well argued and fully referenced; the DCMS would be unwise to ignore her views.

In general, Rosemary thinks it was an error for the Consultation not to deal with the impact of the proposals on the UK’s Adequacy Determination from the European Commission.  She also agrees with the ICO that several proposals are unclear as to what is meant.

So if both the ICO and Rosemary are stating that the proposals lack clarity, the question must be asked as to how can the DCMS hold a meaningful public consultation?

Anyway, you don’t need me to prattle on;  so to whet your appetite, there follows several quotes from her text.

1. “The consultation includes a number of helpful and practical proposals. However the wide scope means that it can be difficult to tease out the useful and/or significant elements. In some cases the impact of the proposals is not clear and in some places it is difficult to work out how different aspects of the proposals fit together”.
2. “In addition there are some regrettable omissions…. The most striking omission is the absence of any assessment of the proposals on the UK’s adequacy finding from the EU. , it may mean that many who read the consultation paper will assume that none of these proposals will have a potential impact on adequacy.”
3. “It seems that an assumption of legitimate interests is reasonable (a bit like the old registration or notification exemptions – processing widely accepted as low risk) however the categories proposed need to be re-examined. Overall the better approach may be to add a presumption of legitimacy which could be rebutted in specific cases, particularly in the case of internal business purposes”.
4. “In relation to cookies this proposal seems nugatory and adds nothing to the impact of PECR and should be removed” [for the reasons set out in Rosemary’s evidence]…“...It is regrettable that cookies have been included in this section on legitimate interests without reference to the section of the paper covering PECR related issues, including the placing of cookies”.
5. “The proposals to remove the DPO role, DPIAs and central records of processing; the proposed changes to the position and independence of the ICO; the potential changes to the compatibility regime; the potential removal of the Article 22 rights; the proposal to diminish the test of fairness in relation to AI, and the cookie proposals all raise potentially serious problems with the adequacy assessment”
6. “There seems no point in removing the role of the DPO which is now well-understood and utilized, and replacing it by a “suitable individual responsible for the privacy management programme”.
7. “As a result the failure to evaluate and discuss the adequacy risks attached to different parts of the proposed changes means an essential element of the relevant policy consideration is missing in every aspect of the proposal”.
8. “Secondly there is little clarity over which parts of the proposals would impact on the law enforcement and security provisions in the Data Protection Act 2018 (DPA 2018)”.
9. One proposal that a new legal basis for processing is not required for compatible processing (justified in terms of an “odd sentence in Recital 50”) “….is fatally flawed”.  It would undermine the UK regime by importing an unjustified liberty to carry out new processing without proper assessment and ensuring the application of adequate grounds for processing in the particular case.  As the grounds for processing are a fundamental concept in the GDPR this would amount to a significant undermining of the UK regime”.
10. “These proposals are extremely confusing [relating to  when further processing may occur when the original lawful ground was consent].  It is difficult to have any real sense of what is being proposed.
11. “The conflation of research with non-research further processing is misleading. The proposals need to be clearly re-drafted and set out concisely what is being proposed in each case. In particular the cases where there is a statutory presumption of compatibility need to be distinguished from those where there is no such presumption, therefore re-use for research purposes should be clearly distinguished and it made clear the second section does not cover re-use for research”.
12. “Further, the use of the broad, generic term “public interest” needs to be addressed – there is no generic test of public interest and it needs to be considered and applied in specific contexts; re-consent or consent situations should be distinguished from those where there is no consent or no other ground”.
13. “It cannot be asserted that there is always a public interest in all research, or that, to the extent there is a public interest, it is always of the same nature or importance. Research into the hair colour of women who buy stiletto heels in not on a par with research into the causes of diabetes. Accordingly there is no justification for removing the rigour of the law from all research and a more appropriate and balanced option needs to be considered”.
14. “Irrespective of the purpose of the processing or the purpose of collection, it [the Consultation Document] recommends permitting the re-use of personal data for a new purpose, including an incompatible purpose, where the processing safeguards an important public interest”.
15. “ Irrationally (and arguably giving a misleading impression) this also covers where the data subject has “reconsented” to the new purpose which is a wholly different fact set and should be clearly differentiated. In such a case the controller can rely on the consent and the issue of compatibility does not arise”.

Concluding comments

Sometimes, I wonder who actually is driving some of the changes proposed by the DCMS; my nightmare is that it is the same people who wrote that awful TIGRR report (see references).

My blogs before Xmas provide ample evidence of a relatively low standard of data protection knowledge that is inherent in some of the DCMS justifications for its proposals (e.g. especially around consent, incompatibility, research and accountability).

In addition, I think the DCMS proposals:

• put the ICO’s independence at risk.
• in relation to transfer from the UK are far too loose and will be unacceptable in the EU.
• for a privacy management programme to replace accountability obligations is a recipe for inconsistent data protection management on the part of UK controllers.
• are not supported by evidence; that is why the DCMS Consultation asks for evidence.

It is strange that the Government wants to attract high tech industry to the UK whose customers are likely to include many EU controllers; such customers will expect that AI services and software products, produced in the UK, to satisfy the EU_GDPR requirements.

The fact that such products and services are produced in a country that has low data protection standards, as outlined by the DCMS proposals, does not strike me immediately as being a strong USP.

Hence losing that Adequacy Determination is an important factor;  Rosemary is absolutely correct to point out that the absence of Adequacy discussion in the DCMS Consultation was a major mistake.

Finally, given the political difficulties of the Prime Minister is in with his own Party, there is a real risk that the GDPR (and the proposed changes to the Human Rights Regime) will be red-meat to be thrown to the right wing of the Conservative Party (e.g. the TIGRR brigade) as an example of the UK “taking back control”.

In practice, the real threat is to UK data subjects losing control and the deliberate undermining of their privacy protection.

Data Protection Courses (Winter 2022)

Because of continued COVID uncertainty, fuel crisis, or the results at Barnsley FC the course can be attended in person, or via Zoom, or as a mixture if you something untoward happens: it's up to you.

• The Data Protection Practitioner Course is in London, and starts Monday, January 25-27; February 8-10 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]
• The Data Protection Foundation Course is in London, and starts Tuesday, February 1st to 3rd (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]

References

Load a copy of Rosemary’s personal evidence here: Download RJ personal view on DCMS Data proposals

The blog “TIGRR, Eeyore and Pooh Bear decide to destroy the GDPR”: https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html