Hawktalk

Facial recognition CCTV excluded from new data protection law by definition of “personal data”

I have come to the conclusion that the new definition of personal data in the Data Protection and Digital Information No.2 Bill (“No.2 Bill”) only applies to facial recognition CCTV if the data subject is on a watch-list.

If the individual is not on a watch-list, and the camera images are deleted immediately after checking the watch-list, then personal data are not processed and there are no data protection obligations (e.g. no transparency)

It then follows that if the watch-list, for example, involves details of criminals wanted by the police, many facial recognition systems will process personal data in total secrecy (i.e. no transparency).

This blog explains how the No.2 Bill’s definition of personal data moves such facial recognition CCTV systems into the twilight zone.

Suppose a facial recognition CCTV system is linked to a watch-list of suspects whose facial features have already been digitised (perhaps using the digitised biometric images derived from passport photographs).

Obvious examples of such watch-lists are: (a) a list of those who are of interest for law enforcement purposes or (b) those who commit a crime if they enter a specific area (e.g. those who have been excluded from entering a specific shop).

Suppose further, such a CCTV system is set up in a shopping centre and performs facial recognition on everybody who passes any of the system’s cameras.  The system sends a warning message to the camera operator if someone, on the watch-list, passes the camera; the system also retains the relevant images and other details of the encounter.  Only personal data of those on the watch list are retained.

The system is so designed that the details of those who are NOT on the watch list are not retained (i.e. deleted instantaneously) after the check against the watch-list is complete.

Bridges v South Wales Police

The system described above is the one that featured in the Court of Appeal judgement (Bridges v South Wales Police: paragraph 9, see references).  In this case, the data protection regime (in the DPA1998 and the pre-Brexit GDPR/DPA2018) was fully engaged because the Court determined that “personal data” were being processed about every individual whose image was captured by a Facial Recognition CCTV camera.

In the Bridges case, the Court’s interpretation of the definition of personal data was crucial.  This was derived by reference to Recital 26 of the pre-Brexit GDPR (or to Recital 26 of Directive 95/46/EC when the DPA1998 applied). These Recitals specified that if the information processed related to a living individual who was being singled out, then “personal data” were being processed.

Paragraph 46 of the Bridges judgment makes this point clear.  It states:

46. The primary point of dispute before the Divisional Court under the DPA 1998 was the extent to which using AFR Locate [the name used for the Facial Recognition CCTV system] entails processing personal data, SWP [South Wales Police] contending that the only personal data processed is the data of persons on the watchlist on the ground that it is only those persons that SWP can identify by name.

Having referred to the judgment of the Court of Appeal in Vidal-Hall v Google Inc [2015] EWCA Civ 311, [2016] QB 1003, and to the decision of the CJEU in Case C-212/13 Rynes v Urad [2015] 1 WLR 2607, the Divisional Court concluded (at [122]) that the processing of the Appellant’s image by the AFR Locate equipment was processing his personal data because the information recorded by AFR Locate individuated him from all others, that is to say it singled him out and distinguished him from all others.  (My emphasis).

As we shall see, “singling out” is NOT found in the new statutory definition of “personal data” in the No.2 Bill, and it is this omission that has significant consequences (i.e. SWP’s arguments in the first part of paragraph 46 as quoted above become correct).

Recitals are not law

The definition of personal data in the No.2 Bill is at first sight unchanged: “Personal data” means any information relating to an identified or identifiable living individual.  However, the No.2 Bill introduces the concept of direct or indirect identification of the individual into the statutory definition.

This new statutory definition, which also does not meet the standard of the Council of Europe Convention No 108 set in 1981 (see references), makes sure that the interpretation in Recital 26, as used in Bridges), is largely redundant.

This is because the Recitals themselves have no legal effect in the UK.  This was established in the case of Sanso Rondon v LexisNexis (see references), when the Court invalidated a requirement in Recital 80 (namely “the designated representative [of a controller or processor established outside the UK (or EU)] should be subject to enforcement proceedings in the event of non-compliance by the controller or processor”).

The Court came to this conclusion because the requirement was found only in Recital 80 and was not explicitly linked in any obligation in any Article of the GDPR.  That is why the Court concluded that, in relation to the liability of the representative for non-compliance (e.g. by a controller):

“…if the GDPR had intended to achieve 'representative liability' [for non-compliance as specified in Recital 80] then it would necessarily have said so more clearly in its operative provisions [i.e. the Articles of the GDPR]…(paragraph 101).

In other words, the Recitals are there to help interpret the legislation if there is doubt as to what the statutory requirements in an Article mean.  If a provision described in a Recital is not echoed in a relevant Article, then the interpretation in the Recital can be invalid.

In summary, the requirement for “singling out”, although it remains in Recital 26, it is not supported by any “operative provisions” found in the new statutory definition of “personal data”.  To the contrary, the new “operative provisions” of the definition work to exclude any prospect for “singling out”.

DPDI definition of “personal data”

The No.2 Bill additionally requires that to be “personal data”, there has to be a living individual who is directly or indirectly identifiable; in the latter case, indirect identification has to be at the time of the processing and by using reasonable means.

This raises three additional questions to be answered before the processing of “personal data” by a CCTV system, similar to that under discussion, can be confirmed.

The first question is:  ‘Are individuals identified “directly”?’.  The No 2 Bill requires that “An individual is identifiable from information “directly” if the individual can be identified without the use of additional information”.

Clearly, in the case of facial recognition CCTV, the answer is NO.  This is because additional information has to be used to perform the identification of those images captured by a facial recognition CCTV system (e.g. the pre-recorded details of those on the watch-list).

In other words,  direct identification, is not relevant because identification of a living individual (on or off the watch list) requires "the use of additional information" (contrary to the definition of direct identification).

The next question is: ‘Are individuals identified “indirectly” as defined?’.  The No.2 Bill states that “An individual is identifiable from information “indirectly” if the individual can be identified only with the use of additional information”.

Clearly, the answer is YES as additional information is available as part of the CCTV system to identify those individuals on the watch-list.

But what about those NOT on the watch-list?

This question is answered by the third question in the series: “Is indirect identification easy to do “at the time of the processing” and by “using reasonable means”  (Clause 3A(2) requires “the living individual is identifiable .… by the controller or processor by reasonable means at the time of the processing”).

In this case, for those not on the watch-list, there are no reasonable means of achieving identification available at the time of the processing (e.g. from the time of collection by a camera, checking the watch list, and then its instantaneous deletion).

There are three main reasons for this conclusion:

• first, there is no “additional information” that is available by “reasonable means… at the time of the processing” in the CCTV system itself (or held by some other person);
• second, the image of the individual and related biometrics have been deleted almost instantaneously, so there is no need for additional information to perform the unwanted indirect identification;
• finally it would be unreasonable to ensure the Facial Recognition system retained details of individuals not on the watch-list. The far more reasonable proposition is to protect the interests of such individuals is by deleting their personal details instantaneously, as such deletion guarantees their privacy.  In addition,  the captured details cannot be further processed for purposes other than the original check of “is this individual on the watch-list?”.

In addition, Article 11 of the UK_GDPR specifically states that additional information is not required to be collected.  It says:

A.11(1) “If the purposes for which a controller processes personal data do not … require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation. (My emphasis to show that this is the case when an individual is not on the watch-list).

Hence, there are no data protection obligations placed on those data that concern those whose images are collected and then instantaneously deleted because the individual is  NOT on the watch list.  Quite simply, such a CCTV system does not process personal data (as newly defined) in these circumstances.

The data protection regime of the No.2 Bill only applies to those on the watch list.

Why secret CCTV facial recognition systems?

As a facial recognition system is not processing personal data if an individual is NOT on the watch list,  then there is no need to be transparent as the UK_GDPR does not apply.  There is no need for a lawful basis nor a condition to overcome the processing of Special Category of Personal Data as the information processed is not personal data.

Transparency is only needed for data subjects on a watch list.  However,  there are a number of exemptions in the DPA2018 that provide the controller relief from the need to be transparent if being transparent would prejudice the crime, taxation, immigration or law enforcement purposes etc (e.g. Schedule 2, paragraphs 2 or 4; Section 44 of the DPA2018).  Hence there is no need to be transparent in these cases also.

It follows that many facial recognition CCTV systems can be installed without any transparency obligations and used more or less in secret.  As stated at the beginning of the blog, they enter the data protection twilight zone.

As this is the case, expect the number of Facial Recognition systems to mushroom exponentially after the enactment of the No 2 Bill.

References

Edward Bridges and -the Chief Constable of South Wales Police: Neutral Citation Number: [2020] EWCA Civ 1058

Sanso Rondon v LexisNexis; Neutral Citation Number: [2021] EWHC 1427 (QB)

Definition of “personal data” in DPDI No 2 Bill results in non-compliance with CoE Convention No.108: https://amberhawk.typepad.com/amberhawk/2023/04/definition-of-personal-data-in-dpdi-no-2-bill-results-in-non-compliance-with-coe-convention-no108.html

Data Protection Courses (Summer 2023)

An all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill. Will be held on Thursday 13 July  2023 hopefully to include changes made during the Committee stage of the Bill.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection FOUNDATION Course is on Zoom only (June 20-22, 2023 (Tuesday to Thursday, 3 days: 45am to 5.00pm).
• The next Data Protection PRACTITIONER Course is in London on Monday, 24 July 2023 to Friday, 28 July 2023 (5 days: 9.30am to 5.30pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing [email protected].

Definition of “personal data” in DPDI No 2 Bill results in non-compliance with CoE Convention No.108

The press release associated with the DPDI No.2 Bill proudly states that the Bill ensures “that the new regime [is] built on the UK’s high standards for data protection and privacy”.

These new “high standards”, evidently, includes adopting a definition of “personal data” that fails to meet the data protection standards established by the text of the Council of Europe (CoE) Convention No. 108, as published in January 1981.

In other words, the most enduring international binding agreement on data protection is likely to be breached by the enactment of the No.2 Bill’s definition of personal data, some 42 years later.

Because this definition of personal data is deficient (see below), it follows all the substantive provisions (e.g. data subject’s rights, Principles, obligations) changed by the No.2 Bill also breach CoE No.108 requirements (as they are all couched in terms of this defective definition).

Additionally, as the No.2 Bill is at odds with CoE No.108, it follows that the No.2 Bill definition of personal data is also inconsistent with the GDPR (and perhaps has a knock-on impact with the Adequacy Agreement – not discussed here).

Note that meddling with the definition of personal data (in the way the No.2 Bill does) creates fundamental changes across ALL of the DP regime.  Quite simply, if the information is not personal data, then none of the UK_GDPR obligations apply.

Changes to “personal data” definition

The new definition of personal data distinguishes between two types of personal data depending on whether identification of a living individual is “direct” or “indirect” at “the time of the processing”.

With indirect identification, there is an additional “reasonable means” test to be passed before the information is treated as personal data (e.g. “the living individual is identifiable … by the controller or processor by reasonable means at the time of the processing”).

The two types of personal data, involving direct and indirect identification, mentioned above are:

• Direct “personal data” which relates to a living individual where, at the time of the processing, identification of the individual is by a controller or a processor without the use of any other information (e.g. the identification is directly contained in a database).

If you think about it, there is no need for a “reasonable means” test if there is direct identification of the data subject (as the identification information is sitting in the database!).

• Indirect “personal data” which relates to an identifiable living individual where the identification of the individual is by a controller or a processor but requires other information to be available to the controller or processor, using “reasonable means”, at the time of the processing.

In this case, the identification is indirect as other additional information is needed to complete any identification of a living individual (e.g. pseudonymisation of personal data creates an example of indirect identification).

By implication there are two types of information are not personal data.  These are:

• “not quite-personal data” which is my term for information which concerns a living individual but where identification of that individual at the time of the processing cannot be undertaken by a controller or by a processor without the expenditure of unreasonable effort to obtain the other additional information to complete the identification.
• anonymous data which is data or information that cannot be attributed to any specific living individual.

For anonymous data, the UK_GDPR recognises that because the living individual is not identifiable (i.e. attributable) in anyway, there are no obligations arising from the UK_GDPR, apart from the limited transparency requirements in Article 11.

The definitional change to personal data extends the “no obligations” approach of anonymous data to “not quite-personal data”.  This is made clear in the Explanatory Notes to the No.2 Bill  “the legislation does not apply to non-personal or anonymous data” (paragraph 101).  The important point here is that the Notes clearly separate anonymous data from non-personal data.

No examples of “non-personal data” (or not quite personal data to use my term for these data) are provided in the Explanatory Notes, nor in the Press Release mentioned above. This kind of omission is unforgivable; the public should not be left guessing what Government means here when its proposals put their privacy at risk.

Hence, my best guess for not quite-personal data is something like the following.  Imagine a set of pseudonymised personal data where the pseudonymising personal data linked to the identification details are removed from the set.

This leaves a set of attributes, each of which is derived from a specific living individual, but where that individual cannot be re-identified without, so the theory goes, the expenditure of unreasonable means. (But of course in my guess example, one can keep details to reverse this process quite easily).

Definition of “anonymous data”

The No.2 Bill definition of personal data overlooks the fact that Recital 26 of the GDPR explicitly contains a definition of  “anonymous information”  (e.g.  “information which does not relate to an identified or identifiable natural person”).

In further detail, Recital 26 states “The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information.”. (My emphasis to bring out the definition of anonymous information).

“Not quite personal data” could be equated with “anonymous data” if, for example, Recital 26 had stated something like: “This Regulation does not apply to data where identification of an individual is only possible by the expenditure of unreasonable effort on the part of the controller or processor at the time of the processing”.

But Recital 26 makes no such statement, so anonymous data and not quite personal data are different species of data (which, importantly, are also not personal data according to the No.2 Bill).

“Reasonable means”

Major problems arise from the definition of “reasonable means” as applied to the definition of personal data.

“Reasonable means” is defined as a non-exhaustive (illustrative) list which includes “among other things: (a) the time, effort and costs involved in identifying the individual by that means, and (b) the technology and other resources available to the person”.

Note that if an organisation (e.g. one that has few resources) assesses that there are no “reasonable means” are available to it, then that organisation can process that information as if it were not personal data (i.e. no UK_GDPR obligations such as transparency, security or rights etc).

However, at the same time, a well-resourced organisation (e.g. perhaps an organisation that has benefited immensely from the obvious Brexit dividends) can come to the opposite conclusion.

Thus a set of not quite personal data in the hands of one organisation could be personal data in the hands of another organisation as a controller or processor, both at the [same] time of the processing.

By contrast, at any particular time, anonymous data by the Recital’s definition remains anonymous irrespective of the nature of the organisation processing the data, because the data cannot be attributed to an identifiable living individual.

So if a “resources poor” organisation and a “resources rich” organisation used the same pool of “not quite personal data”, the latter is likely to be a controller processing personal data whilst the former would not.  This inconsistent position is extolled by the Explanatory Notes as “providing greater clarity” about the definition of personal data.

Also note that if an organisation gets its assessment of reasonable means wrong  (e.g. it assesses that the identification of living individuals needs unreasonable means), the default position is that the organisation is not a controller and the data are not personal data.  This is the position of greatest risk for data subjects because the data are not subject to the UK_GDPR.

This partly explains why the No.2 Bill’s ill-conceived meddling with the definition of personal data is likely to be detrimental to the interests of all data subjects.

The Bill's default position is not the privacy enhancing one (e.g. as espoused in data protection by design and by default); it’s the privacy busting one (e.g. as practiced by Facebook or Clearview AI Inc).

“At the time of the processing”

As already stated, indirect identification of the data subject for the No.2 Bill has to be at “the time of the processing” (e.g. “the living individual is identifiable … by the controller or processor by reasonable means at the time of the processing”).

Suppose personal data are processed at the time of the processing then a controller can inform the data subject of the intended future processing purposes of his/her personal data and the relevant A.6 lawful basis as required by A.13(1)(c) and A.14(1)(c) of the UK_GDPR.  So far, so good.

However, suppose at the time of the processing an organisation is processing not quite personal data.  Then there is no obligation at the time of the processing to be transparent to any data subject as the data are not personal data and the organisation is not a controller.  A.13 and A.14 only apply when actual personal data are processed (e.g. when indirect identification is completed).

So it can be now be seen that sets of not quite personal data can be legitimately processed without any data protection obligation (e.g. perhaps transferred to the USA, or possibly to Russia or China).

Suppose an organisation has obtained not quite personal data and transferred such data to the USA (for example) and re-identification occurs in the USA (perhaps via a number of other organisations dotted around the world to confuse any audit trail).

As such organisations are established well outside the jurisdiction of the UK_GDPR (or any EU version of the GDPR), then data subjects and regulators would be powerless with respect to such personal data once re-identification has occurred.

Such a loophole is only possible by changing the current definition of personal data so that it depends on the time of the processing (and in the case of indirect identification, the reasonable means needed to identify a living individual).

It is interesting to note that the definition of personal data in the GDPR does not contain these qualifications (e.g. “at the time of the processing”) so the definition in the No.2 Bill does not meet GDPR standards.

As stated above, the Government claims that there are “high standards for data protection and privacy”.  In practice, any consideration of the Bill’s new definition of personal data exposes that claim as highly suspect.

Identification by “controller or processor”

Now consider why the definition of personal data specifies that the identification of a living individual has to be  “by the controller or a processor”.  To explain this, consider the processor definition:  “the natural or legal person … which processes personal data on behalf of the controller”.

Note that to be a processor, an organisation has to process personal data (as defined in the No.2 Bill) on behalf of a controller.  Hence the organisation is not a processor when it processes not quite personal data.

It follows that for not quite personal data there are no contractual conditions, security or transfer obligations, no data breach procedures or reporting (even when the risk of re-identification could be potentially high) and minimal risk of effective sanction from the UK’s ICO (not even a Reprimand!).

So if an organisation based in the USA somehow obtains a copy of a set of not quite personal data and then re-identifies the data to become personal data, such an organisation becomes a controller outside the jurisdiction of the GDPR (the No.2 Bill negates the need for a Representative in the UK).

Quite simply, the words “by the controller or a processor”  appear in the definition of personal data is to ensure that not quite personal data can be shared with anybody without interference by the UK’s data protection regime.

Surprisingly, this is left unexplained in the Explanatory Notes that accompanies the No.2 Bill.

Comparison with CoE No 108

The text of the 1981 Council of Europe Convention 108 on data protection states in Article 2(a) that “personal data” means “any information relating to an identified or identifiable individual (“data subject”).   Article 3(1) requires “The Parties [e.g. UK Government) undertake to apply this convention to automated personal data files and automatic processing of personal data in the public and private sectors.”

I contend that the No.2 Bill’s definition of personal data is in clear breach of the text of CoE No. 108 as published in 1981; the same clear breach goes for the definition of personal data in the latest version of 2018 (CoE No. 108+).

This is because there is no concept of “direct” or “indirect” identification of individuals,  “reasonable means of identification” and “at the time of the processing” in the CoE’s definition of personal data.

It follows that the definition of personal data in the No.2 Bill does not meet the CoE requirements and that, if enacted, the UK will “fail to undertake to apply this convention to automated personal data files and automatic processing of personal data in the public and private sectors” (as all the substantive protection for data subjects is couched in terms of CoE’s definition of personal data).

Question: if the above happens, would you advise the transfer of personal data to the UK?

Concluding comment

CoE No. 108 was first published on 28 January 1981, a date now celebrated annually as Data Protection Day. The No.2 Bill, if enacted as described above, would make such celebrations unique for UK data protection people.

Instead of organising a party, they will organise a wake.

 

Data Protection Courses (Summer 2023)

An all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill. Will be held on Thursday 13 July  2023 hopefully to include changes made during the Committee stage of the Bill.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection PRACTITIONERCourse is in London on Monday, 22 May 2023 to Friday, 26 May 2023 (5 days: 9.30am to 5.30pm).
• The next Data Protection FOUNDATION Course is on Zoom only (June 20-22, 2023 (Tuesday to Thursday, 3 days: 45am to 5.00pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing [email protected].