Hawktalk

New DPDI Bill savings inflated by 324%; loss of Adequacy Agreement would cost UK over £2 billion

Many commentators have remarked how very similar the Data Protection and Digital Information (DPDI) (No.2) Bill is to the original DPDI Bill published last June.  If this is the case, how is it that the No.2 Bill’s projected “Best Estimate” savings is £4.7 billion over a decade, whereas the “Best Estimate” savings for the original DPDI Bill (the “No.1 Bill”) is a mere £1.45 billion over a decade?

Given the fact that there is no official comparison document, explanation or Keeling Schedule to explain these differences, nobody knows.  I know inflation is high, but it is not running at 324%.

As an aside, the Impact Assessment Update also estimates the likely “annual export revenue loss” of the Adequacy Agreement with the EU (if it fails) as between £210 million and £378 million per year. Assessed over a decade (the standard unit of time preferred by the Update), that is between £2.10 billion and £3.78 billion.  In other words, if the changes in the No.2 Bill lead to a discontinuation of the Adequacy Agreement with the EU, about half the “Best Estimate” savings are lost.

Some readers might recall I did a deep delve into the savings associated with the No.1 Bill.  I have reworked these using the new financials reported by Government.

Hence this blog provides an alternative financial analysis, based on verifiable figures which are easy to obtain unlike the Mystic Meg approach adopted in the 230 page “Impact Assessment Update” published to justify the No.2 Bill (see references).

Real numbers used

I am using six additional facts which are missing from the “Impact Assessment Update”.

1. Fact 1: Companies House has over 4 million companies registered in the UK (from Companies House website).
2. Fact 2: The total number of controllers on the ICO’s public register is 1,066,929. The breakdown of registration is: Tier 1: 966,587 (90.6% of the register): Tier 2: 93,604 (8.8%);  and Tier 3: 6,738 (0.6%). (Information from the ICO on 12 May 2022).
3. Fact 3: Approximate registration revenue per year is: Tier 1: £33.8 million; Tier 2: £5.6 million; Tier 3: £19.5 million. The  total ICO revenue collected is £59.0 million per year which is calculated by multiplying the number of controllers in each Tier, by the annual notification fee  for each Tier (Tier 1 (£35); Tier 2 (£60); Tier 3 (£2,900)).
4. Fact 4: The Annual Report (2020/21) indicates the cost of running the ICO is £56.4 million.
5. Fact 5: There are 67.1 million data subjects resident in the UK as per July 2020 (ONS website).
6. Fact 6:  The “Impact Assessment Update” states the true net benefit is between £1.27 billion per decade and £8.53 billion with the “Best Estimate” in the middle at £4.7 billion.  Note that the “best estimate” of the No.1 Bill is more or less the “low estimate” of the No.2 Bill (hmmm – how convenient!).

So what kind of questions do Facts like the above this raise?  Three spring to mind immediately:

• From Facts 1 and 2, it can be seen that only 1 in 4 companies at Companies House is registered with the ICO. So could the ICO garner more in notification fees (e.g. by looking for active companies registered at Companies House but not registered with the ICO)? This improved revenue stream could help the ICO generate more resources to provide clear advice to controllers.  This would be better than changing the law to improve the clarity of the UK_GDPR as claimed by the Government (see para 2 of the Explanatory Notes to the No 2 Bill).
• From Facts 3 and 4, could any future surplus in notification fees be earmarked by the ICO to employ more staff to deal with complaints? This better than the proposal in the No.2 Bill to deal with the ICO’s complaints system by allowing the ICO to dismiss, or not investigate, complaints from data subjects (e.g. in Clause 40).
• Should the notification fee (fixed in 2018) be increased? For example, increasing the notification fee for Tier 2 to £100 and Tier 3 to £3,500 increases ICO resources by over £10 million. An increase in fee that adjusts for inflation since 2018 (about 20%) would do something similar.

It is well known that the ICO has a significant backlog of cases; the last Annual Report (2021/22) shows that 57% of cases often take over 6 months to resolve.  The three options above give the ICO more resources to clear that backlog.  However, increasing ICO resources fails to get a mention in the “Impact Assessment Update”.

Notification – who pays?

Fact 4 shows that notification to the ICO costs £0.6 billion per decade. So, abolishing notification fees would provide significant saving for all controllers; it would also a release a cohort of staff at the ICO to do things other than pen-pushing notification work (e.g. redeployed to reduce any backlog of complaints).  Evidently there are over 900 staff at the ICO!

It is well known that data protection is a balance between the interests of controller and of data subjects.  So why should controllers be faced with 100% of the costs of data protection compliance, when UK data subjects benefit directly from provisions in the UK_GDPR that protect them.  Surely, data subjects should contribute to the costs of data protection?

Historically, notification is a relic from the DPA1984. It was created at a time when most organisations did not have a main-frame computer and those that did have a computer, had only one.  Hence charging the minority of single computer owners (via notification fees) for the cost of regulation is understandable.

Now every citizen processes personal data as a controller (e.g. on social media) and is also a data subject.  So there are stronger arguments that the cost of data protection regulation should be drawn from general taxation with the ICO being a Parliamentary Officer like the Parliamentary Ombudsman (to maintain ICO independence).

Any consideration of the cost of notification or its abolition is missing from the “Impact Assessment Update”.

Savings? The real comparison

I am using the “Best Estimate” of £4.70 billion of savings over 10 years; this represents £470 million of savings per year over all controllers (£1 billion =£1,000 million).   As there are 1.07 million controllers (Fact 2), the average saving for each controller can be calculated at £439 per year per controller.  This is about £8.40 per week per controller; about the price of a bottle of plonk.

The conclusion one reaches is that such savings are insignificant.  Even a small business in Tier 1 (turnover up to £632K) is not going to get into financial difficulty because it does not save £8.40 per week.  The statement in the Press Release announcing the No.2 Bill (“new common-sense-led UK version of the EU’s GDPR will reduce costs and burdens for British businesses and charities”) is exposed to be palpably false and, dare I say it, “rubbish”.

So, suppose the UK_GDPR were unaltered; what would be the cost of maintaining the high level of GDPR protection for each data subject?  As there are 67.1 million data subjects in the UK (Fact 5), the savings of £470 million per year infer an cost of maintaining current UK_GDPR standards is £7.00 per year per data subject.  This equates to 13.5 pence per data subject per week, or just under 2p per day.

In other words, the Government are prepared to abandon the high level of UK_GDPR protection for all data subjects in order to save tuppence per day for each data subject. There is a well-known phrase “to spend a penny”; it appears the Government does not want to spend two.

Even if the £470 million yearly savings were all allocated to the 6,738 large controllers in Tier 3, the average annual saving is £69,753 per large controller.  This is an amount that would be unlikely to be identified in the balance sheet of a such controller as its revenues are in excess of £36 million per year.

The £69,753 figure is also below the cost of employing a DPO (which most large controllers are likely to employ, but not for much longer as the DPO role is being abolished as a savings measure).

Even if the £470 million were allocated to all the larger controllers in Tier 2 and Tier 3, the annual savings would be £4,683 per controller. There again pifflingly small for companies with turnover up to £36 million.  Even if all controllers were on the minimum turnover for Tier 2 (£632K), the savings represents 0.7% of turnover.  Again such comparison shows that the financial savings associated with the “burdensome paperwork” are negligible.

Remember all these numbers (e.g. 2p per day) are, according to the figures a best estimate; they could be much less.

Finally, suitably buried on page 218 of the “Impact Assessment Update”, are the annual costs that arise from the loss of trading with the European Union if the Adequacy Agreement is lost.  Over a decade, this loss is somewhere between £2.1 billion and £3.8 billion; the Update calculates that between 2817 and 9601 firms trading with the EU will also go bust.

Is the loss of Adequacy described in the Press Release or any relevant Ministerial statement about the No.2 Bill?  Of course not;  Brexit is a roaring success as we all know.

Concluding comments

Also missing from the “Impact Assessment Update” is any acknowledgement that large firms trading into Europe have to comply with the EU_GDPR as well as the No.2 Bill.  Such firms have to additionally appoint a Representative and adsorb the cost of EU_GDPR compliance.

Many private sector controllers in Tier 3 are likely to have to comply with twin data protection compliance regime (i.e. guesstimate around 4,000 controllers).

In summary, the press release headlined: “British Businesses to Save Billions Under New UK Version of GDPR” is pure spin.   Of course, that is the point of spin.  This headline figure in the Press Release has been parroted unthinkingly by the press and some DP observers (who really should know better).

However, it is a relief that the Secretary of State has not repeated her non-sensical claim made at the Party Conference last November that the UK_GDPR compliance cost 8% of company profits  - or £23 billion (see references).

In summary, it is difficult to avoid the conclusion that the figures presented in “Impact Assessment Update” and Press Release are of a quality best displayed on the side of a red Brexit bus (as driven by “honest” Boris Johnson).

Data Protection (Courses:Spring/Summer)

An all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill. Will be held on Thursday 18 May 2023.   The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection PRACTITIONER Course is in London on Monday, 22 May 2023 to Friday, 26 May 2023 (5 days: 9.30am to 5.30pm).
• The next Data Protection FOUNDATION Course is in London on June 20-22, 2023 (Tuesday to Thursday, 3 days: 45am to 5.00pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing [email protected].

References

DCMS fails to spend a penny to protect data subjects: https://amberhawk.typepad.com/amberhawk/2022/05/dcms-fails-to-spend-a-penny-to-protect-data-subjects.html   (old financial analysis of the DPDI No.1 Bill)

GDPR cost UK £23 billion says Minister in charge of data protection https://amberhawk.typepad.com/amberhawk/2022/11/gdpr-cost-uk-23-billion-says-minister-in-charge-of-data-protection.htm  (completely bonkers)

The Press Release associated with DPDI No.2 Bill: https://www.gov.uk/government/news/british-businesses-to-save-billions-under-new-uk-version-of-gdpr

DPDI Impact Assessment and other DPDI documents: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1140162/Data_Protection_and_Digital_Information_Bill_Impact_Assessment_-_June_2022.pdf

The DPDI No 2 Bill: https://bills.parliament.uk/bills/3430

DPDI No 2 Bill should be paused until the UK Bill of Rights position is resolved

The new Data Protection and Digital Information (No 2) Bill (“No.2 Bill”) has been published, minus any Keeling Schedule, and minus any indication of how the new Bill has diverged from the old.  The Department for Science, Innovation & Technology (DSIT) has this information to hand; its failure to publish it performs an unnecessary public disservice.

The press release accompanying the No.2 Bill says the legislation has been “Co-designed with business from the start, this new Bill ensures that a vitally important data protection regime is tailored to the UK’s own needs and our customs”.  It does not take an expert to guess that the No.2 Bill is likely to contain provisions tailored to diminish the protection for data subjects.

What about human rights (again)?

However, the first matter is that should be raised is a matter of procedure.  The No.2 Bill should not proceed to any further Parliamentary stage because the UK’s Bill of Rights is still awaiting its Second Reading.

The problem arises because the UK Bill of Rights is likely to have fundamental impact on the UK’s data protection regime (evidence from the ICO – see references) so much so, it is likely undermine completely any Parliamentary consideration of the data protection aspects of the No.2 Bill.

Quite simply, it is a waste of valuable Parliamentary time to consider this No.2 Bill, if the Bill of Rights devastates the data protection landscape to the extent that any Ministerial statement concerning data protection made during No.2 Bill debates (e.g. in relation to the principles or lawful basis) is rendered worthless.

Although the No. 2 Bill is accompanied with a Human Rights Memorandum,  this document is also wholly irrelevant.  It assumes the UK will follow Strasbourg Jurisprudence (e.g. it even quotes from several European cases and explains that voluntary data sharing by public bodies would fall within the UK’s “margin of appreciation”).  In addition, there is a statement on the face of the No.2 Bill saying it is ECHR compliant.

In other words, the No.2 Bill gives the impression that the UK follows the ECHR, when DSIT/Government knows that this is completely misleading if the UK Bill of Rights commences its Second Reading.

This can be seen from the Bill of Rights itself.  In clause 1(2) it says “that it is the Supreme Court (and not the European Court of Human Rights) that determines the meaning and effect of Convention rights for the purposes of domestic law”.  Clause 1(3) states “judgments, decisions and interim measures of the European Court of Human Rights (a) are not part of domestic law…..”. In other words,  the basic assumption towards human rights compliance is the complete opposite to that promulgated by the No.2 Bill.

Further evidence for the negation of human rights arises from the aptly named “Illegal Immigration Bill” (IIB);  this explicitly raises the idea that the UK will not follow ECHR.  Indeed, many human rights commentators have suggested that the IIB creates a vast smorgasbord of ECHR non-compliance.  This includes breach of: the right to life;  freedom from torture and from slavery;  the right to a fair trial and the risk of detention without trial;  the lack of respect for family and private life;  the prospect of discrimination, and finally removal of the right to seek a legal remedy.

As an aside, the IIB sets a dangerous precedent in that it is an example of Government enacting legislation that it knows is likely to breach the ECHR.  Just imagine data sharing legislation being enacted (via a large majority Government that has a minority of the popular vote) that included something like: "The minister unable to confirm the data sharing law is compatible with A.8".

In addition, the UK’s  Adequacy Agreement with the European Commission mentions compliance with ECHR judgements and refers to the Human Rights Act over 80 times.  There is no point Ministers saying the Adequacy Agreement “is safe with the No.2 Bill”, if the risk of trashing it arises from the implementation of the UK Bill of Rights.

Finally, look at the Transfer Risk Assessment published by the ICO, in particular Q4 which deals with a human rights assessment.  The expected bonfire of human rights, consequent on the passage of the IIB, would probably mean, using the ICO’s own risk assessment methodology, that the UK would become a dodgy, no-go area for certain transfers from the EU.

The Bill of Rights subjugates the No.2 Bill

The UK Bill of Rights fundamentally changes the interpretation of the word “necessary” which is integral to the application of: any lawful basis (A.6 of the UK_GDPR); the Data Protection Principles (A.5); the Special Category of Personal Data conditions (A.9); the processing of Criminal Offence personal data (A.10); the understanding of Schedule 1 (DPA2018);  the exemptions from rights (A.23), and finally, transfers outside the UK (A.49).

This is confirmed by the ICO’s evidence to the MoJ (see references). For instance, the ICO writes:

• “Changes in how the concepts of necessity and the public interest are assessed in human rights law will inevitably have an knock on effect on their assessment in data protection  law”.
• “The concept of necessity is fundamental across the DPA/UK_GDPR (Article 5 principles, Article 6 lawful bases, Article 9 conditions for processing special category data, Article 23 exemptions, and Schedule 1)”.
• “…likely impact could make it more difficult for the ICO to protect individuals data” (e.g. “if public authorities are be able to rely on public interest grounds in a presumptive way”: (para 3.27).

The human rights challenges arising from the No.2 Bill as explained in the Memorandum are a mere pinprick compared with the privacy wasteland promised by the UK Bill of Rights.

Concluding comment

In short, Parliament needs protecting from a Government that presents one Bill for detailed consideration, when it knows that these considerations are made redundant by other legislation, also before the Parliament at the same time (in this case, the UK Bill of Rights).

An honest Government would progress, or ditch, the UK Bill of Rights first, and then second, move on to the No.2 Bill so the data protection changes can be properly debated.

Data Protection Courses (Spring 2023)

Because of the uncertainty (e.g. transport, strikes etc), the following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection PRACTITIONER Course is in London on Monday, 22 May 2023 to Friday, 26 May 2023 (5 days: 9.30am to 5.30pm).
• The next Data Protection FOUNDATION Course is in London on June 21-23, 2023 (3 days: Wednesday to Friday 9.45am to 5.00pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing info AT amberhawk.com.

References

The ICO’s evidence re the Bill of Rights is summarised/accessible from my blog at:  https://amberhawk.typepad.com/amberhawk/2022/05/ico-confirms-human-rights-changes-undermine-uk_gdpr.html

Blog post: UK Bill of Rights set to undermine UK_GDPR : https://amberhawk.typepad.com/amberhawk/2022/07/uk-bill-of-rights-set-to-undermine-uk_gdpr-and-adequacy.html

Press release and Human Rights commentary is accessible at https://www.gov.uk/government/news/british-businesses-to-save-billions-under-new-uk-version-of-gdpr

Bill of Rights: https://bills.parliament.uk/bills/3227