Hawktalk

Voluntary disclosure to HMRC? Always lawful and always compatible

This blog questions how the Data Protection and Digital Information Bill (the “Bill”) impacts on the lawfulness and compatibility of any further processing by a controller, in particular, a controller that voluntarily discloses personal data to HMRC.  This worked example illustrates how this Bill further undermines the current level of protection afforded to data subjects.

In summary, the Bill allows HMRC to lawfully obtain personal data for its purposes via voluntary disclosure from any controller;  such disclosures can occur even when:

• there is no “public interest” component to a particular disclosure to HMRC and
• where a particular disclosure is not associated with any specific HMRC investigation (i.e. a failure to disclose does not prejudice HMRC’s collection or assessment of tax).

If these changes are enacted, it will become difficult for the data subject (or ICO) to claim that there has been unlawful processing of personal data by HMRC.

Although the example used is a disclosure to HMRC,  similar issues arise with voluntary disclosures of personal data to any law enforcement agency pursuing a criminal investigation, especially those agencies which bristle with information collecting powers (e.g. DWP).

As usual, the Explanatory Memorandum to the Bill does not touch on the subject matter of this blog (e.g. why is voluntary disclosure to be expanded in this way?); perhaps it is designed to be an Unexplanatory Memorandum.

The current compatibility test

Before describing the changes made by the Bill, it is worth understanding how the Purpose Limitation Principle and the compatibility assessment work together when disclosures to public bodies (e.g. to HMRC) occur under the current UK_GDPR regime.

The Purpose Limitation Principle requires personal data to be “collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes” (my emphasis).

So if a controller has collected personal data and is then asked to disclose such data to HMRC for its purposes, the relevant “further” processing specified by the Principle is the controller’s disclosure to HMRC for its tax purposes.

The key issue in this Principle is whether such a disclosure is “incompatible” or not.  This question is answered using the provisions of Article 6(4) which provides three options as to whether that further processing is incompatible.

In our example (voluntary disclosure to HMRC for tax purposes), the further processing is NOT incompatible if the processing:

• has the consent of the data subject
• constitutes “a necessary and proportionate measure … to safeguard …. any of the objectives referred to in Article 23(1)” (this is a reference to the possibility that a disclosure can satisfy an exemption specified in Schedule 2 to 5 of the DPA2018), or
• passes the compatibility assessment test (also detailed in A.6(4)). This considers, for instance, the nature of the personal data disclosed, the relationship between the disclosing controller and data subject, the impact on the data subject of the disclosure etc.

As there is an applicable exemption in Schedule 2, paragraph 2 of the current DPA2018 that covers all HMRC’s tax processing, it is the second bullet point that applies.

In further detail, this tax exemption can exempt any data subject right, the Lawfulness, Fairness and Transparency Principle and the Purpose Limitation Principle,  if application of any of these rights or Principles would “prejudice the assessment or collection of tax or duty”.

Thus before a controller volunteers disclosure to HMRC, HMRC would have to assert that a failure to disclose would prejudice these matters (e.g. collection of tax).  Once this assertion is documented, then the Purpose Limitation Principle is exempt and compatibility does not need to be considered by the disclosing controller.

Note that if there is “no prejudice” (i.e. the exemption does not apply) and in the absence of data subject consent, then the disclosure is likely to be incompatible in breach of the Purpose Limitation Principle.  It is this restriction that the Bill seeks to lift (i.e. make all voluntary disclosures of personal data compatible, in the absence of data subject consent and, without the application of the taxation exemption).

For completeness, the voluntary disclosure by the controller to HMRC has a lawful basis if the exemption applies. It is in “the public interest” as the HMRC are investigating (it’s in the public interest to catch tax evaders) and the disclosure is to another person (the HMRC) who has a function conferred on it by an enactment; namely Article 6(1)(e).  The gory detail of this position can be found in my previous blog.

What are the Bill’s changes?

In summary, the Bill introduces two Annexes:

• Annex 1 provides an A.6 lawful basis for a disclosing controller to make these voluntary disclosures (e.g. to HMRC); the new construction avoids the application of a “public interest” test to a particular disclosure of personal data (also explained in my previous blog).
• Annex 2 exempts the Purpose Limitation Principle in all circumstances (e.g. even when there is no prejudice to HMRC’s tax functions).

First, however, new Article 8A introduced into the UK_GDPR by the Bill, states that the processing is automatically compatible if “the processing meets a condition in Annex 2”.  Annex 2 comprises a list of 11 conditions including taxation and law enforcement.

In the context of a voluntary disclosure to HMRC, Annex 2 provides two options for this disclosure.

Option 1 disclosure

The first option occurs when:

• “the processing is necessary for the purposes of making a disclosure of personal data to another person in response to a request from the other person” (e.g. in our example, the HMRC is the “another person” asking for a controller to disclose to it).
• “the request states that the other person (in our example, this is HMRC) needs the personal data for the purposes of carrying out processing that”—
  • “is described in Article6(1)(e)”  (e.g. for HMRC’s public task)
  • “has a legal basis that satisfies Article6(3)”  (e.g. HMRC’s public task is the functions bestowed on it by enactment), or
  • “is necessary to safeguard an objective listed in Article23(1)(c) to (j)”.  (Article 23(1)(e) explicitly refers to exemptions needed for “taxation matters”).

As there is an applicable exemption covering taxation matters in Schedule 2, paragraph 2 of the current DPA2018, one can see that Option 1 covers disclosures to HMRC in circumstances similar to the current arrangements but in the absence of “public interest” considerations.

So any controller volunteering personal data to HMRC via Option 1 does not need to consider the compatibility arrangements.

Option 2 disclosure

The second option is in Annex 2, paragraph 10.  Under the heading “Taxation”, the paragraph states that “This condition is met where the processing is carried out for the purposes of the assessment or collection of a tax or duty or an imposition of a similar nature”.

So why have two conditions that apply to disclosures to HMRC?  Well, if one condition applies when an exemption applies to the disclosure (Option 1), the Option 2 condition becomes relevant when the exemption cannot be applied.   Remember Annex 1 negates the need for a “public interest”  test to be applied to the disclosure to HMRC.

Hence the availability of an Option 2 disclosure confirms my conclusion that HMRC is seeking to lawfully obtain personal data from controllers even when (a) there is no public interest in the disclosure and (b) where such a disclosure is not associated with any specific HMRC investigation  (i.e. a failure to disclose does not prejudice HMRC’s collection or assessment of tax).

Note the taxation condition (paragraph 10) does not even require the disclosure to be “necessary” for HMRC functions, unlike the paragraph 5 which requires disclosure to be “necessary” for law enforcement processing.

Mind you, if the Government’s proposed Human Rights changes are implemented, the ICO and Courts will be required to give “great weight” to what Prime Minister Liz Truss decides as “necessary” and “proportionate”.  So, in practice, any “necessary” safeguard is likely to be significantly degraded (see references).

Concluding questions

The combined effect of Annex 1 and Annex 2 is to provide a huge exemption from the provisions that best protect the data subject from unlawful and incompatible processing.

The Annexes also provide an alternative mechanism for HMRC to obtain personal data without reference to its wide powers (e.g. under Schedule 36 of the Finance Act 2008).  These powers allows HMRC to demand any information or any document related to tax matters from almost anybody.

This raises three important policy questions which should be considered by Parliament prior to approving legislation that promotes the expansion of the proposed voluntary disclosure route.

• Are HMRC powers fit for purpose? If the answer is “no” why can’t Ministers approach Parliament with an argument for an upgrade of HMRC powers rather than expand the reach of voluntary disclosures to HMRC?
• Should HMRC be required to use its powers (e.g. Schedule 36) to demand personal data before it adopts a voluntary request for the disclosure of personal data?
• Should HMRC be required to state when using a voluntary disclosure arrangement that there is no obligation for a controller to disclose and if there were to be a refusal to disclose personal data there would be no detriment to the controller?

These questions certainly need answering in the context of HMRC and dare I say it, certain law enforcement processing and national security.  Perhaps the ICO could do the honors?

Autumn Data Protection Courses

I am holding another day course on the changes arising from the Data Protection and Digital Information Bill on Tuesday, September 27 (by Zoom only;  £250 + VAT per delegate).  Program available from:  info AT amberhawk.com

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection PRACTITIONER Courses are in London on Monday September 19-24 (5 days) and on Monday October 31-November 4 (5 days)
• The next Data Protection FOUNDATION Course is in London on Tuesday November 15-17 (3 days).

Full details (as we are upgrading our Amberhawk website), details of all the above courses can be obtained by emailing info AT amberhawk.com

References

How the Human Rights changes impact on data protection: https://amberhawk.typepad.com/amberhawk/2022/07/uk-bill-of-rights-set-to-undermine-uk_gdpr-and-adequacy.html  (see other references at the end of the blog)

I have produced a “Keeling Schedule” for the changes to A.5, A.6, A.13, A.14: you can download it from the References at the end of: https://amberhawk.typepad.com/amberhawk/2022/08/dpdi-bill-removes-public-interest-test-in-push-to-legitimise-general-public-sector-data-sharing.html

 

DPDI Bill removes “public interest” test in push to legitimise general public sector data sharing

This blog considers how the Data Protection and Digital Information Bill (the “Bill”) impacts on the lawful bases used in the context of voluntary data sharing with public bodies.

It explains how the Government is building a legal infrastructure that provides Ministerial powers to legitimise voluntary and general data sharing across the public sector which does not need to consider whether data sharing is in the “public interest”.

For instance, is it “in the public interest” to disclose personal data to protect vulnerable individuals? If your answer is “yes”, then the blog explains why there is no need for many of the new proposed lawful bases or for the abolition of the “public interest” test.  Indeed, one new proposed lawful basis can be developed to legitimise data sharing in general, also in the absence of any public interest consideration.

This blog is limited to how such expansive data sharing becomes lawful under the revised A.6 proposed in the Bill.  The blog also serves as a reminder of the significant impact of the proposed replacement of the Human Rights Act on this Bill; something that remains absent from all DCMS documentation on this Bill.

Current data sharing

Before describing the changes made by the Bill, it is worth understanding how voluntary disclosure/data sharing of personal data occurs under the current DP regime.

So suppose a Social Work department of a Local Authority (Controller A) wants to obtain personal data held by another body to protect a vulnerable person in its care.  So it asks another body (Controller B) to disclose the relevant personal data.  Assuming Controller B has no role or function in respect of protecting the vulnerable, how is such a disclosure made lawful under the current UK_GDPR/DPA2018?

Note there is a disclosing controller (Controller B) and an obtaining controller (Controller A) where obtaining and disclosure are both processing operations.  So Controller B’s disclosure is Controller A’s obtaining; it’s the same processing operation viewed from different ends of the telescope by each Controller.

This data exchange uses the lawful basis in A.6(1)(e) of the UK_GDPR/DPA2018 regime. This lawful basis requires that the “processing is necessary” for one of two options which are either:

(i)  “necessary for the performance of a task carried out in the public interest”  or

(ii)  necessary for “the exercise of official authority vested in the controller”.

Second, the expansion of the A.6(1)(e) lawful basis by Section 8(1)(c) of the current DPA2018 states that either requirement (i) or (ii) above can be satisfied if the processing is for “…the exercise of a function conferred on a person by an enactment…”.  Note that, in our example,  the use of the word “person” could refer to Controller A or Controller B.

The above identifies the questions that need to be asked prior to disclosure by Controller B: if the answers are “yes” then the disclosure can occur lawfully.   So:

• Is a disclosure to protect the vulnerable a “task in public interest”?
• Is that disclosure for “…the exercise of a function conferred on a person by an enactment…”? In this case, does the person (i.e. the Local Authority via its Social Work Department) have a function conferred by enactment to protect the vulnerable?

Note that Controller’s A processing  (i.e. the obtaining) does not need “a public interest test”; that is performed by Controller B prior to disclosure.  Clearly Controller A’s obtaining is part of the “official authority vested in the controller” because it is in “…the exercise of a function conferred on a person by an enactment…”  (where the person is the Local Authority again).

So both obtaining and disclosure are lawful – and in the public interest.

Now consider the following.  Do you think that: (a) disclosure of personal data to the police for a criminal investigation; (b) a disclosure to the relevant national security agency for a national security purpose, or (c) a disclosure to public bodies dealing with a national “emergency” (e.g. a large area flood) are also disclosures “in the public interest” in the same way as “protecting the vulnerable”?

I am convinced the answer is “yes”. And this is before one considers an alternative lawful basis (i.e. A.6(1)(f): disclosure from Controller B is in the legitimate interest of the Third Party (Controller A)).

I say this because, if you agree that the above options are all “in the public interest” then the conditions presented in Annex 1 after the first paragraph are redundant.

Indeed, I suspect that these later paragraphs in Annex 1 are included to act as a smokescreen to mask the real change in its first paragraph.

Lawful basis under the Bill

The Bill introduces the following changes with respect to lawful basis:

First, the task specified in A.6(1)(e) is amended so that it is specific to the controller performing the processing.  This lawful basis now reads that the “processing is necessary for the performance of a task [of the controller] carried out in the public interest or a task carried out in the exercise of official authority vested in the controller;

Second there is a new A.6 lawful basis where the “processing is necessary for the purposes of a recognised legitimate interest” where the “recognised legitimate interests” are  listed in Annex 1 of the Bill.

Apart from the first paragraph, the Annex 1 list is as follows:  “National security, public security and defence”, "Emergencies“, "Crime", “Safeguarding vulnerable individuals” and a revised Democratic engagement purpose (which is not discussed here).

With respect to the Social Work example used above {disclosing Controller B to obtaining Controller A),  Controller B’s disclosure uses the Safeguarding vulnerable individuals” lawful basis whilst Controller A’s lawful basis remains “a task carried out in the exercise of official authority vested in the controller”.

So both obtaining and disclosure become lawful,  in the absence of any public interest consideration.

The absence of any consideration of a “public interest test” prior to disclosure will eventually mean that disclosures under the Bill are likely to occur where no public interest arises.  This position is aggravated by the Human Rights changes where “necessary” means “what the Government has determined as necessary” (see references for the reason why).

Even with respect to disclosures for crime prevention and detection etc, the DPA1984 and DPA1998, provided a test that prior to disclosure a disclosing controller had to assess whether a failure to disclose personal data would prejudice the crime prevention purpose etc.

This is not replicated in the Bill.  I leave it to readers to determine whether this is another example of data protection standards falling to reach those established by the DPA1984.

Any disclosure for any public sector task?

The first paragraph of Annex 1 is captioned:  “Disclosure for purposes of processing described in Article 6(1)(e)”; that is where any disclosure, any public body, any public task comes from.

In further detail, this paragraph states that a disclosure is lawful when:

“the processing is necessary for the purposes of making a disclosure of personal data to another person in response to a request from the other person”, and

“the request states that the other person needs the personal data for the purposes of carrying out processing described in Article 6(1)(e) that has a legal basis that satisfies Article 6(3)”.

Note the very weak wording in the above; the word “necessary” should have been linked to the disclosure purpose and NOT the purpose of making a disclosure (i.e. the mechanics of the disclosure procedure).  The fact that a controller “needs the personal data”  for any purpose for any public task in is far lower threshold than one that describes the disclosure as being “necessary” for a specific purpose.

However, as previously stated,  these weaknesses are aggravated when the proposed Human Right Act changes click in (i.e. “necessary” means “what the Government decides is necessary”).

So, what does A.6(3) do?

Note the reference that the legal basis has to satisfy A.6(3);  this is a reference to the requirement that the prospect for disclosure has to be laid down by UK domestic law.  For example, Part 5 of the Digital Economy Act 2017 specifies, in law, a host of disclosure arrangements.

If such a law exists, A.6(3) then allows the Secretary of State “to adapt the application of rules of this Regulation”  (i.e. modify the UK_GDPR) in the following areas:

• “the general conditions governing the lawfulness of processing by the controller”;
• “the types of data which are subject to the processing”;
• “the data subjects concerned”;
• “the entities to, and the purposes for which, the personal data may be disclosed”;
• “the purpose limitation” and “storage periods”; and
• “processing operations and processing procedures”.

Some of the powers to “adapt” the above are found at Clauses 5(4), 8A(5), 8A(6), 8A(7) and 8A(8) of the Bill.  For example, many disclosures are made exempt from the Purpose Limitation Principle via Annex 2 of the Bill.

Potentially these Ministerial powers can adapt any Principle, A.6 lawful basis (and A.9) to ensure that data sharing can proceed, relatively untroubled by the data protection concerns of data subjects.  It is these provisions that establish the legal infrastructure to legitimise voluntary and general data sharing across the public sector in the absence of  “public interest” considerations.

Although A.6(3) adds that “…domestic law shall meet an objective of public interest and be proportionate to the legitimate aim pursued”,  these requirements should not be considered reliable safeguards for data subjects.

When the Human Rights changes come into effect, the “public interest” effectively means “the interest of the Government of the day” and “proportionate/legitimate” means “what the Government considers proportionate/legitimate”.

Concluding comment

As specified in previous blogs, the proposed changes to the UK’s Human Rights regime infects the Bill like a malevolent virus.  Like all embarrassing diseases, the DCMS (and ICO) do not refer to the consequences of the proposed modifications on this Bill.

The requirement that the Courts and ICO give “great weight” to the Government’s determination of what is “necessary”, “proportionate” or “in the public interest” undermine the protections afforded to data subjects especially when public bodies are able to share their personal data without any consideration of the public interest.

Any allegation of “unlawful disclosure” under the Bill will become very difficult to prove, if the argument is reduced to one about the “weight” given to a particular disclosure.

The effect is to give public authorities a “Get Out of Jail Free Card” even when data sharing, not in the public interest, goes pear-shaped.

Autumn Data Protection Courses

I am holding another day course on the changes arising from the Data Protection and Digital Information Bill on Tuesday, September 27 (by Zoom only;  £250 + VAT per delegate).  Program available from:  info AT amberhawk.com

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection PRACTITIONER Courses is in London on Monday September 19-24 (5 days).
• The next Data Protection FOUNDATION Course is in London on Tuesday November 15-17 (3 days).

Full details (as we are upgrading our Amberhawk website), details of all the above courses can be obtained by emailing info AT amberhawk.com

References

How the Human Rights changes impact on data protection: https://amberhawk.typepad.com/amberhawk/2022/07/uk-bill-of-rights-set-to-undermine-uk_gdpr-and-adequacy.html  (see other references at the end of the blog)

I have produced a “Keeling Schedule” for the changes to A.5, A.6, A.13, A.14: download it here Download A6 changes DPDIB Aug

 

New Data Protection Bill defines “personal data” below DPA1984 threshold

This is the first in a series of blogs on the Data Protection and Digital Information Bill (the “Bill”) published just before the Parliamentary recess.  This blog explains:

(a) how the Bill’s new definition of “personal data” works;

(b) why the definition is very problematic for data subjects;  and

(c) how, after nearly four decades of data protection law in the UK, the Government is promoting a definition of personal data that is demonstrably weaker than that in the DPA1984.

The proposals in the Bill to change the definition of “personal data” did not feature in the DCMS original Consultation Document. This omission raises serious questions about whether or not other undisclosed horrors lurk in the depths of this Bill.

Remember as you read on, what is being proposed exists to “provide greater clarity about which type of data is in scope of the legislation” (p26 of the “Explanatory Memorandum”).  I should add, that this blog provides all the clarity absent from that Memorandum.

Why change the definition?

The purpose of the new definition of personal data is to distinguish between three types of data. These types are:

(a) personal data which relates to an identified or identifiable living individual where identification is usually by a controller or a processor using reasonable means. Such identification could be by name, address, location, social characteristics, identification numbers etc;

(b) non-personal data which is information that is likely to have been derived from personal data (or which is currently treated under the UK_GDPR as personal data),  but where a data subject is no longer identifiable without the expenditure of an unreasonable amount of effort on the part of a controller or a processor; and

(c) anonymous data which is data that cannot be attributed to a specific living individual.

The basic idea is that organisations that process “non-personal data” or “anonymous data” cannot be a controller or a processor as the data cannot be related to a particular living individual without unreasonable effort on the part of that controller or processor.

In other words, non-personal data and anonymous data are both free of any data protection concern (i.e. no obligations arise from the UK_GDPR).  The Bill’s objective is to widen the scope of these two categories by narrowing the scope of those data that are classified as “personal data”. That in summary is the name of the game.

What has changed in the definition?

The Bill splits personal data into two further types by introducing the concept of “direct” and “indirect” identification of a living individual in the context of the personal data being processed. So, for example:

• “Direct identification” occurs when a living individual is identifiable from the data “directly” without the use of any “additional information”. An example would be a normal database that contains records such as the data subject’s surname,  address, date of birth, policy number as well as other data attributes.
• “Indirect identification” occurs when a living individual is identifiable from the data plus some other “additional information” which might be held by another person. An example would be a database of phone numbers where the identification of data subjects is known to be in a separate list (e.g. a telephone directory) held by the controller, processor or another person.  Pseudonymised personal data is expressly defined to be a class of data where indirect identification occurs.
  

In the case of “direct identification”, identification of a data subject has to be “by the controller or a processor by reasonable means at the time of the processing”.  More or less the same goes for indirect identification where such identification requires “additional information” to be held (or likely to be held) by a controller, processor or “another person”.

“Reasonable means” is defined as a non-exhaustive (illustrative) list which includes “among other things: (a) the time, effort and costs involved in identifying the individual by that means, and (b) the technology and other resources available to the person”. In other words, there could be other factors to consider (see Case 2 below).

Note that “at the time of the processing” in the context of “direct identification” is likely to be the time the controller or processor first obtains the personal data either from the data subject or from another source.  The same more or less applies if indirect identification is completed by a controller or a processor (i.e. data protection obligations kick in as soon as the additional information is obtained or is likely to be obtained).

Note also that in the context of “indirect identification” and before the additional information is obtained (or is likely to be obtained), the data processed by a controller or a processor is not personal data and is free from data protection obligations.

In the context of “indirect identification” by another person, the time of the processing is likely to be when the controller or processor knows (or should know) that the “additional information” has been obtained (or is likely to be obtained) by that “another person” who has expended “reasonable means” to identify a data subject.

Additionally, both “direct” and “indirect” identification of a data subject under this Bill requires an assessment, by the controller, of the “reasonable means” used to perform the identification.  This implies that if the means of identification are “unreasonable” for whatever reason, then the data are not personal data and no data protection obligations arise.

It can be seen that what “reasonable means” are available is very important to the personal data definition.   Note that if the controller assesses that the “reasonable means” are unreasonable, that controller will process the information as if it were not personal data (e.g. no transparency, security or rights).

In conclusion, if a controller gets its assessment of reasonable means wrong, the default position is that the processing occurs, in secret, until it is stopped by the ICO using his powers (which is increasingly unlikely).  As will be seen, this places too much power in the hands of the controller.

Finally,  identification (directly or indirectly) can be “by the controller or a processor”  (emphasis on “or”).  This opens up three possibilities which are (to me, very confusing):

• First that identification details are held by the controller but not by the processor. If this possibility is valid,  the processor’s data protection obligations do not apply as the processor is not processing personal data;
• Second that identification details are held by the processor but not by the controller. If true, the controller obligations do not apply (!!!).   But if this were true then the processor that performs the identification would become a separate controller or joint controller (surely!?);
• Finally, identification details are held by either controller or processor (or is known to be held by another person etc) then both controller and processor would be subject to data protection obligations This possibility obviously contradicts the first two.

I haven’t a clue what is going on here or why.  I find the use of “by … a processor” inexplicable and unnecessary; it is miles away from the “clarity” promised in the Explanatory Memorandum.

Illustrative scenarios: CCTV

Now we have a feel for what is going on with the definition of personal data, can we consider two cases. I have made these up to illustrate why the definition is problematic, so forgive any artificial construct.

Case 1: Consider a controller who employs CCTV operators in a City Centre. One operator is directing a police officer to intercept and arrest a thief who is wearing a red hat, orange shirt and blue jeans as the thief is dipping into shoppers’ handbags.

Now which of the following statements best “clarifies” whether the identification of a living individual is direct or indirect? Remember, you have to consider the “reasonable means” expended by the controller to perform this identification.

• The thief is directly identified via specific criteria (e.g. by monitoring a particular individual wearing a red hat, orange shirt and blue jeans).  Is this sufficient to deliver direct identification even though the CCTV operator does not know other important identification details (e.g. the thief’s name, date of birth, home address, National Insurance Number etc)?
• The thief is indirectly identified. Once apprehended, the police become the “another person” who completes the identification through the use of “additional information” easily collected by the police after arrest (i.e.  the “reasonable means” test is passed).  Note that with indirect identification, a key factor is that the “another person” obtains the “additional information” for identification; it does not matter that the CCTV operator does not obtain the “additional (identification) information” from the Police.

So which did you prefer?  Which option is more certain: direct or indirect identification?  Remember you should not muddy the waters by choosing both (as these concepts have been introduced to provide more “clarity” – Ha Ha).

If you chose indirect identification, now consider what happens if the police do not obtain the “additional information” for whatever reason (e.g. the thief disappears)? Because the “additional information” is not obtained, the CCTV operator is not processing personal data. ( I know that’s a rubbish conclusion but that is what this Bill does).

Research & Pseudonomisation

Case 2: Now assume a NHS Trust Hospital shares pseudonymised health personal data with a University for medical research purposes (i.e. the Trust keeps the identities; the University has all the medical details except identification).  Because pseudonymisation is involved, only indirect identification is relevant.

The University and Trust sign a legally binding data sharing agreement which states the Trust will never release the identity of any patient to the University.  To protect the identification personal data further, and unknown to the University, the Trust stores the only copy of the identity personal data with a secure Trusted Third Party. This Party is tasked with encrypting the data using techniques unknown to the Trust.

In summary, this scenario is constructed so that any access to identifying details is a “very last resort” matter and aimed at precluding general access to the identifying details in a large number of circumstances.

The question I am driving at is as follows: “Is the University processing pseudonymised personal data or is it processing “non-personal data”?”. The answer depends on your assessment of the “reasonable means” that could be used to perform the indirect identification by the University, Trust or Third Party?  

Although the “additional information” exists, does its existence as a very last resort matter, impact on “another person’s” ability to complete the identification using “reasonable means”?

Or does the complex construction, specified by the scenario, provide a sufficient barriers to preclude the general obtaining of “additional information” by “reasonable means”?  Is it possible that the University or Trust could reasonably argue, given that the definition of “reasonable means” is non-exhaustive, they have arranged matters so there were no reasonable means of identifying a living individual?

If so, then the University is not a controller;  it follows that it has no data protection obligations as a controller.  The patient cannot withdraw consent to the research, object to the processing, seek subject access and the University has no security, retention or transparency obligations and the data protection elements of the data sharing agreement are irrelevant.

Such processing will continue until the ICO intervenes  (unlikely in my view).  Quite simply the data subject risks being written out of the research equation. And that is before you get into the Research proposals in the Bill.

In conclusion, once this definition is enacted, there is a considerable risk that lawyers are likely to set to work creating circumstances for their clients where data subject protections vanish through the use of complex organisational structures, data sharing exchanges and contracts.

These will start with personal data, somehow produce “non-personal data”, which then can be scattered to the four corners of the Earth without any data protection concern.

Comparison with DPA1998/DPA1984

The Bill’s definition of personal data is completely different to the DPA1998 which also required identification of a living individual either to be direct (i.e. “from the data”) or “indirect” (i.e.  “from those data and other information which is in the possession of, or likely to come into the possession of, the data controller”).

Note that for indirect identification under the DPA1998, the main test was: (a) whether the controller held the identification details in his possession, or (b) was the controller likely to obtain those identification details later on, or (c) the controller did not hold any identification details.  Only in the latter case did the DPA1998 not apply.

Under the Bill,  identification of the living individual has to be by “reasonable means”.  In other words, the identification details can be in the possession of the controller but it takes unreasonable effort to join the dots to a living individual.  In this case, the data are not personal data (even though the identification detail “is in the possession of the data controller” – the DPA1998 test).

This explains how the new definition of personal data in the Bill does not even elevate itself over DPA1998 standards. The DPA1998, I remind readers, were subject to infraction proceedings with the European Commission commenced in 2004. The Commission thought the DPA1998 was a defective implementation of Directive 95/46/EC and this included its definition of “personal data”.

Indeed, the definition of “personal data” in the DPA1998 was almost word for word taken from the DPA1984 (i.e. personal data was data that related to a “living individual who can be identified from that information (or from that and other information in the possession of the data user”(“data user” was the 1984 term for a controller).

In other words, from the data subject’s perspective, the Bill’s definition of personal data is even inferior to that found in the DPA1984

Concluding comment

So if the definition of personal data falls below DPA1984 standards, what is the Commission’s likely view of the Bill’s new definition in the context of Adequacy?

Send your answers on a post-card or email either to Auntie Nadine Dorries at the DCMS (before September 5th) and perhaps Uncle John Edwards at the ICO (before his next speech as he “believes the proposals strike a good balance in making improvements”).

Autumn Data Protection Courses

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• I am holding a day course on the changes arising from the Data Protection and Digital Information Bill on Thursday, September 15 by Zoom only (£250 + VAT per delegate).
• The next Data Protection PRACTITIONER Courses is in London on Monday September 19-23 (5 days);
• The next Data Protection FOUNDATION Course is in London on Tuesday November 15-17 (3 days)

Full details (as we are upgrading our Amberhawk website), details of all the above courses can be obtained by emailing info AT amberhawk.com