Omissions in Human Rights proposals degrade privacy and freedom of expression

A brief blog to encourage readers to submit comments to the MoJ's Human Rights consultation that ends today at a minute to midnight. I also make available a copy of my evidence to the MoJ (see references).

This Consultation has slipped through the net relatively unnoticed as it is aimed at “legal practitioners”, “experts”, “academics” and “advocates of human rights law”. The Consultation is NOT aimed at the 60 million data subjects who are directly affected by the proposed changes. Although the consultation period closes tonight there is an extended period of 19^th April date for those who need Easy Read or audio versions of the consultation documents.

It is also alarming that the former appeal judge who led a government-commissioned review of the Human Rights Act has told MPs he does not consider that the government’s consultation on reforming the 1998 legislation reflects his report.

The major problems with the Consultation can be summarised by what it does NOT state. These omissions can be listed as follows:

Absence of any consideration or analysis of the impact of the human rights proposals on the current UK_GDPR data protection regime in the UK or how they impact on data subjects (60 million in the UK alone them).
Absence of any consideration or analysis of the impact on the proposals for changing the UK Data Protection Regime as proposed by the DCMS in a separate consultation “Data: a new direction”.
Absence of any consideration or analysis of the impact of these proposals on the Adequacy Agreement agreed with the European Commission, resulting in the likely cessation of that Agreement.
The lack of evidence for rebalancing Articles 8 and 10 (private and family life versus freedom of expression and to impart information) as proposed in the Consultation.
Absence of any consideration or analysis of the impact of these proposals on the provisions that relate to the Special Purposes in the DPA2018.
Absence of any consideration or analysis of the impact of these provisions on the FOI/FOISA or EIR/EIRSA regimes (e.g. the data protection/FOI interface).
Misrepresentation of case law that relates to the processing of personal data mentioned in the Consultation (e.g. ML v Slovakia; Ellis v Essex Police) and omission of relevant case law (e.g. Stanley et al v Met. Police and L.B. Brent; Marper v UK)
The lack of due process in Parliament to ensure changes to the human rights of UK citizens are subject to detailed scrutiny. The proposals include the use of secondary legislation (i.e. via Ministerial powers) to deliver changes to individual human rights with minimal involvement of Parliamentary scrutiny (this use of secondary legislation is wholly unacceptable in my view).

I should add, there is no reference in the Consultation to the proposed changes arising from the Judicial Review and Courts Bill that is intend to restrict Judicial Review and certain decisions of the Upper Tribunal. Given that with respect to A.8 and data protection, Judicial Review is a major safeguard for data subjects (e.g. in facial recognition CCTV; immigration exemption) this omission is also surprising.

How can you have a public consultation with these gaps? However, I conclude, in data protection terms that:

the Consultation, if its proposals are enacted, is likely to result in weaker protection for data subjects whenever a controller’s processing of personal data is “necessary” or “in the public interest”; this weakening can extend to private sector controllers via A.6, A.9 and A.5 Principles.
The fact that the DCMS Consultation did not discuss the impact of its proposed changes on the Adequacy Agreement (e.g. lack of an independent regulator) nor on the relationship between data protection and human rights is astonishing.
The fact that the Consultation did not discuss the knock-on effect of the proposed human rights changes on data protection enforcement (e.g. via processing that is “necessary” or “in the public interest”) is also astonishing.
The Adequacy Agreement is likely to be revoked. This is a subject is also deemed unworthy of mention in the Consultation.

Data Protection Courses (Spring 2022)

Because of continued COVID uncertainty, the course can be attended in person, or via Zoom, or as a mixture if you something untoward happens (e.g. you have to isolate mid-course).

The Data Protection Practitioner Course is in London, and starts Tuesday, March 22-25; March 29-31 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]
The Data Protection Foundation Course is in London, and starts Tuesday, May 9-11 (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]