Hawktalk

DPDI Bill undermines transparency of Artificial Intelligence development and training

Last week, Prime Minister asked  “how can we write laws [to regulate AI] that make sense for something we don’t yet fully understand?”.  The PM does not appreciate that his Government has already drafted a law that applies to the processing of personal data for AI purposes but which has the objective of diminishing the protection afforded to data subjects.

In this blog, I show, in the context of scientific research, how the proposed DPDI No 2 Bill” (the “Bill” ) permits personal data to be used,  disclosed or transferred outside the UK for AI training and development purposes, in secret, without consideration of compatibility or the right to object to the processing.

The legislative steps in the Bill that achieves these objectives are as follows.

• Define “scientific research” so it includes private AI development and AI algorithm training (i.e from now on, read “scientific research” to include private sector AI research, training and development).
• Define “appropriate safeguards” for AI “scientific research” that are below the equivalent safeguards specified in the GDPR.
• Ensure that AI “scientific research” can be undertaken in the “legitimate interest of the controller or of a third party” if the previously mentioned “appropriate safeguards” apply. Thanks to this Bill, the “legitimate interests” lawful basis is likely emerge as the preferred alternative to “data subject consent” for most “scientific research” because of the reduction in the level of data subject protection.
• Ensure that any further processing for AI “scientific research” purpose is always deemed to be compatible with the purpose of obtaining, irrespective of that obtaining purpose or of the nature of the AI research.
• Introduce a transparency exemption which applies to existing data subjects described in any dataset. This exemption applies to the further use of personal databases for AI “scientific research” purposes by the controller or by any third party to whom the personal data is disclosed.

It is the lack of transparency which diminishes data subject rights. For instance, how do data subjects know they can exercise their rights if they do not know their personal data are being processed in the first place?

However, before we get to explaining all the above, the blog has to deal with the definition of “scientific research” and then “appropriate safeguards”.

Scientific Research

The analysis begins with the definition of “scientific research”.  This definition reads:

 “Any research that can reasonably be described as scientific, whether publicly or privately funded….”. and  “include processing for the purposes of technological development or demonstration, fundamental research or applied research, so far as those activities can reasonably be described as scientific…”.

Does this includes AI learning or AI development?  Well to get that answer I asked CHAT_GBT the question.  It replied:

“Yes, scientific research often involves AI and machine learning, which are important tools in various scientific disciplines. … Machine learning is a subset of AI that focuses on developing algorithms and models that can learn from data and make predictions or decisions based on that learning”.

So AI training and development can fall within “scientific research”. The next outstanding issue is whether the appropriate safeguards apply.

Appropriate safeguards

The “appropriate safeguards” (defined in A.84B; some detail in A.84C) can be summarised as follows.  To be helpful, I have added some commentary.

Safeguard 1: The processing of personal data does not permit identification of a living individual apart from the collection of personal data but the safeguard does not apply if the further AI “scientific research” purpose cannot be fulfilled without the identification of a living individual.

Commentary on Safeguard 1: The inference underpinning this safeguard is that the identification details in the personal data should initially be separated from the personal data after collection.

This separation could allow that in any subsequent processing,  the relevant (non-identifiable) data are treated as anonymous at the time of that processing  (even though the controller knows that, at a later time, how to reconstitute the data as personal data).  This increases the possibility that, at the time of that processing,  there would be no DP obligations arising from the further processing for AI (thanks to the new narrow definition of “personal data” in the Bill).

In any event, if the controller considers that the AI “scientific research” purpose cannot be fulfilled without using personal data, then the safeguard does not apply.

In practice, therefore, Safeguard 1 might prove to be not much of a safeguard.

Safeguard 2: The processing is “likely to cause substantial damage or substantial distress to a data subject to whom the personal data relates”.

Commentary on Safeguard 2: “Gosh” and “Crikey”!  Processing likely to cause moderate damage/distress to data subjects (i.e. anything short of substantial) is below this safeguard’s threshold. This is touted as safeguard? Surely not!

Safeguard 3: No decisions with respect to any particular data subject are made unless is it medical research approved by SoS, medical ethics committee etc.

Commentary on Safeguard 3: this safeguard existed in the DPA1998 so it is nothing new.  However, for medical research it allows the SoS indirect powers to approve future AI “medical research” (e.g. via an ethics body made up of SoS appointees which could approve medical research for the NHS undertaken by USA high tec industries such as the Palantir).  Although this is touted as a safeguard,  in practice it could easily become a licence that allows the Government to exploit NHS personal data.

Safeguard 4:show respect for data minimisation Principle or pseudonymisation.

Commentary on Safeguard 4:  it’s noteworthy that an obligation with to respect “anonymising personal data” is missing”.  In addition, the safeguard is not new and replicates the controller’s obligation in Article 25 (data protection by design and by default).

Comparison with the safeguards specified in Recital 156 of the EU_GDPR shows the latter is far more protective of data subjects than this obligation (see below).

Recital 156: “…Those safeguards should ensure … that technical and organisational measures are in place to ensure,  in particular, the principle of data minimisation. The further processing of personal data for ..[“scientific research” purposes] …. is to be carried out when the controller has assessed the feasibility to fulfil those purposes by processing data which do not permit or no longer permit the identification of data subjects, provided that appropriate safeguards exist (such as, for instance, pseudonymisation of the data…)”

Note that Recital 156 equates pseudonymisation with the safeguard; the Bill merely equates “respecting for pseudonymisation” as the equivalent safeguard.

Finally, the S.o.S has powers to vary the “appropriate safeguards” (Article 84D).  It would be optimistic to say that these powers would be used to strengthen the data subject protection when the Bill’s direction of travel is clearly in the opposite direction.

Lawful basis for AI

Much processing for “scientific research” can continue to be undertaken using the lawful basis of fully informed and freely given “data subject consent”.  If data subjects give consent, they are obviously made aware of the AI “scientific research” purpose and are protected in that they can withdraw consent at any time.

Although the Bill makes changes to “consent” to make it more flexible for the “scientific research” purposes, the fundamentals of consent have not been changed by the Bill (e.g. records of consent have to be kept, withdrawal of consent is part of the Privacy Notice).

If, however, the lawful basis for such AI research changes to “legitimate interests”, then the right to object to the processing applies.  To exercise this right, data subjects have to present grounds relating to their individual situation and, in addition, data subjects have to be made aware that the right to object applies (e.g. in a Privacy Notice).

As will be seen, these last two requirements can be negated by the Bill.

As an aside, the ICO has already determined that the “legitimate interests”  lawful basis can be approved for medical research by the ICO (see references).  In fact, I expect this lawful basis to emerge as the preferred option for all “scientific research” (because of the diminution of data subject protection)

Legitimate interests in detail

Consider the “legitimate interests” lawful basis in detail; this reads:

“Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.…” (my emphasis)

If the processing causes no impact on the data subject, then there is unlikely to be overriding interests of the data subject to protect.  Indeed it will be difficult for the data subject to provide grounds that their interests or rights should prevail,  if there is no impact of the processing on them

Hence I expect the right to object to be refused and the processing for AI “scientific research” to continue unabated.

Note that this “legitimate interest” basis also allows a controller to lawfully disclose personal datasets to a third party for its legitimate interest in using such personal data for its AI  “scientific research” (see reference at end).

Secrecy and A.13

The Bill states that if the “appropriate safeguards” (see above) associated with the processing for an AI “scientific research” purpose apply,  there are circumstances when there is no need to tell existing data subjects about the further processing for this AI “scientific research” purpose. (I will explain “existing” later).

In further detail, exemption states that (my emphasis):

“If the controller intends to further process personal data…

(i) for (and only for) the purposes of scientific or historical research, the purposes of archiving in the public interest or statistical purposes, and

(ii) in accordance with appropriate safeguards [see above] and

providing the transparency information is impossible or would involve disproportionate effort” where

“Disproportionate effort” depends on “among other things, the number of data subjects, the age of the personal data and any appropriate safeguards applied to the processing”.

Clearly if a new AI project requires access to a large volume of personal data and the processing falls within the AI “scientific research” definition and the appropriate safeguards are applied, then this exemption is very likely to be engaged.  It follows that there is no need to inform data subjects described by such personal data about the further AI “scientific research”  purpose.

It means any database can be further used for AI “scientific research” purpose without any transparency to data subjects described in the data.  As stated previously, such secrecy also applies when there is a disclosure by a controller of these personal data to a third party in its legitimate interests for an AI “scientific research” purpose.

Note that the exemption does not apply to new data subjects who are added to a dataset after use or disclosure for the AI “scientific research” purpose.  This is because the disproportionate effort definition is unlikely to apply as new data subjects can easily be informed by an updated Privacy Notice describing this purpose.

I know this exemption is complicated!  This because it only applies to not informing data subjects already described in a dataset to a new further AI “scientific research” purpose associated with the processing of their personal data when the appropriate safeguards etc apply.

Compatibility, secrecy and A.14

Suppose a controller discloses a personal dataset, not for its own AI “scientific research” purpose, but for the AI “scientific research” purpose of a third party.  If the disclosing controller does not need to identify the further purpose to existing data subjects, what about the third party? Does that third party need to contact the data subject?

The answer is “no”, as there is a similar provision introduced as new Article A.14(6) that states the third party does not need to inform the data subject of its AI “scientific research” purpose if “disproportionate effort” applies and the appropriate safeguards apply.

If there were to be onward disclosure by a third party to another third party for its AI “scientific research” purpose, then the same exemption applies assuming disproportionate effort and the appropriate safeguards apply.

To avoid the risk that a further AI “scientific research” purpose is incompatible with the purpose of obtaining,  the Bill provides that any further use or disclosure for that purpose is deemed compatible, if disproportionate effort and the appropriate safeguards apply (see new Article 8A(3)(b)). 

In other words, “deemed compatibility” can also apply to any further third party disclosure for AI “scientific research” purposes.

Conclusion

The blog describes that, under the DPDI No 2 Bill, a controller can disclose, to any number of other controllers, a huge dataset of personal data in circumstances when there is no obligation to inform data subjects described in that dataset about the use or disclosure for an AI “scientific research” purpose so long as the disproportionate effort and appropriate safeguards criteria apply.

The blog also describes that the “appropriate safeguards” are not as safe as one would expect.

Because the UK has a transfer agreement with the USA, such a dataset can be transferred to the USA for another third party’s AI “scientific research” purpose, away from the UK/EU jurisdiction.  Because there is an exemption from transparency, this transfer is unknown to each data subject.

Readers are probably aware that Clearview, Facebook, Google, Twitter and Yahoo are all high tech USA companies that have been fined by European Data Protection Regulators and are all global players in AI “scientific research”.

Many will find it surprising that a large dataset of personal data can be lawfully transferred from the UK to the USA for any third party AI “scientific research” purpose without data subjects described in the dataset knowing about the circumstances of such a use or disclosure.

Given the above, I ask the reader a simple question: “What possibly could go wrong?”. Answers by email to the Prime Minister who needs enlightenment (Email form on https://contact.no10.gov.uk/Contact.aspx).

Forthcoming Data Protection Courses

Our well received, all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill will be held on Thursday 7 December  2023.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London on Monday, 20 November 2023 to Friday, 24 November 2023 (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (December 12-14, 2023: Tuesday to Thursday, 3 days: 9.45am to 5.00pm) or

Full details on Amberhawk’s website (www.amberhawk.com) or  obtained by emailing [email protected].

References

Use of legitimate interests for lawful basis in medical research : see para 3.16 of the Sandbox on Our Future Health: https://ico.org.uk/media/for-organisations/documents/4026890/our-future-health-regulatory-sandbox-final-report.pdf

Serious questions arising from ICO v Clearview Tribunal Decision

I was surprised by the recent Tribunal Decision (the “Decision”) which quashed Clearview’s £7.5 million fine on the grounds the UK_GDPR did not apply.   My puzzlement has given rise to several important questions about the Decision. These questions need an urgent answer; hence this blog.

Clearview is a USA company which has scraped billions of photos and personal data from the Internet and used them to sell services to law enforcement/national security agencies and similar agencies in other countries (e.g. notably in USA and in South America) but not the EU or UK (wonder why?).

Clearview’s idea is that if, for example, a USA law enforcement agency is looking for a suspect or witness and have a blurry photograph, then they can scour Clearview’s databases to identify possible matches for that suspect or witness and/or their location.

Facial recognition and AI techniques are used in such matches. Clearview do not initiate a search but provide the personal data and the processing means by which a match is undertaken.  Note that Clearview retains much personal data that will NOT be used by, or disclosed to, its law enforcement clients (as such law enforcement bodies are unlikely to be searching for individuals unconnected with a police inquiry).

The more personal data Clearview scrapes from the Internet, the better chance that their clients score a “hit”. Equally, however, the more personal data Clearview will store on data subjects who are of NO interest to their clients.  The Decision reports that there are three billion images on Clearview’s databases.

GDPR did not apply; ICO powerless

The Decision concluded (at para 157) that the UK_GDPR “can apply where the monitoring of behaviour is carried out by a third party rather than the data controller” (i.e. the UK_GDPR applied even though Clearview’s law enforcement clients were performing the monitoring).

However, “the processing is outside material scope of the Regulation as provided for in Article 2 of the GDPR [as] it is not "relevant processing” for the purposes of Article 3 UK GDPR, as defined in Article 3(2A) [of the UK_GDPR] thereby removing the processing from the scope of UK” (para 157).

I have read this paragraph zillions of times but it is difficult to follow (mainly because the Decision says so little about how it came to its critical conclusions about relevant processing. See “Actions of a Foreign Government” below).

However, it is clear from para 157 that Article 3(2A) and its definition of "relevant processing” caused the ICO to lose the argument.  This gives rise to four important questions which are:

1. Does the UK_GDPR’s lack of jurisdiction also apply to the unadulterated EU_GDPR? If the answer to Q1 is “yes”, then there is a pan-European problem that should be considered by the European Data Protection Board.
2. If “no” to Q1, does the lack of jurisdiction issue apply just to the UK_GDPR because of a drafting issue?
3. If “yes” to Q2, was this drafting problem accidental (i.e. “stuff happened” because of the haste associated with UK’s wonderful “oven ready Brexit deal”). If so, will the Government commit to correcting this drafting error in the DPDI No 2 Bill or will it prefer to do nothing in order to curry favour with USA high tech involved with AI?
4. If “no” to Q2, was the drafting problem a deliberate In which case: “Why was Parliament not informed by DCMS Ministers of this important change?”.

Finally consider the consequences of a private USA company, scraping the Internet for billions of photographs and other personal data to be used by foreign law enforcement agencies,  where millions of EU/UK citizens have no DP rights.  Does this set of circumstances influence the answer to question: “Does the USA offer an adequate level of protection?”.

In short, from the UK perspective alone, the Decision appears to provide evidence that the USA does not offer an adequate level of protection for personal data transfers from the UK/EU to the USA.

Actions of a Foreign Government

I was struck by the following when reading the Decision:

“14.  In oral submissions it was accepted by the Commissioner that processing by a foreign government would not be within the scope of the Regulations due to the principles of international law that mean that one state cannot seek to bind another. The actions of a foreign state are out of scope, by application of Article 2(2)(a) GDPR and Article 3(2A) UK GDPR” (para 14)

So, the foreign government issue, which is crucial to the outcome of the Decision, was settled orally (i.e. possibly not written down).

The importance of this issue was repeated at the end of the judgement:

"153.  Therefore, the question for us remains the same. It is foremost a question of fact as neither party contends that the acts of foreign governments would be within the material/territorial scope of the Regulations because the activities of foreign governments fall outside the scope of Union law. It is not for one government to seek to bind or control the activities of another sovereign state". (para 153)

The police service in the USA comprises 18,000 organisations at federal, state, municipal and sheriff level; there are also policing oddities as there is in the UK (e.g. park or transport police).  These organisations may be funded by government but are not an executive arm of the government in the sense that politicians in power arbitrarily choose who to arrest or who to prosecute.  This is unlike, for example, law enforcement in Putin’s Russia or other autocratic states.

I wonder therefore whether the use of Clearview’s services by USA law enforcement agencies comprise “actions of a foreign state” given the sheer number of independent policing agencies in the USA?  If the use was by say, the Department for Homeland Security, then one could argue this foreign government point.

However, the actions in question are not of one Department of State; the actions are of a devolved policing service involving thousands of bodies.  In other words, I am unsure whether these thousands of bodies can be viewed as “actions of a foreign state”.

Clearview is monitoring

In addition, unlike the Decision, I think that Clearview itself is monitoring behaviour of data subjects residing in the UK/EU.

Most personal data are NOT used by foreign police forces etc because they relate to data subjects who are NOT of interest to the police, and never shall be.  Such personal data are “retained” by Clearview (for a long time, one assumes) and retention is a processing operation, undertaken by Clearview, where there is no prospect of “actions of a foreign state”. The personal data are retained by Clearview until their deletion.

The Decision asserts that there is monitoring of behaviour by Clearview’s clients but not by Clearview itself.  I think this is an error.

To facilitate monitoring, Clearview retains bulk personal data in case some of these data become of later interest to the police.  Note that the personal data do not change when they are actually used or disclosed to the police.

If there is monitoring by the police (as the Decision states) when they initiate a search, it follows that the personal data must be organised in a structure that permits such monitoring, prior to that search.  As this structure is arranged by Clearview (“organisation and structuring” being two processing operations as defined), it follows that Clearview is also monitoring by pre-structuring the data in anticipation of a search by one of its law enforcement clients.

In my humble view, even if the foreign state point is lost, Clearview is retaining scraped personal data of those NOT of interest to the police for law enforcement and national security purposes as a controller, and is also monitoring behaviour as described in the Decision.

Conclusion

In other words, I need to be convinced that the Decision is correct.

Hence the interesting question: “does the current ICO have the stomach for an Appeal?”.  It is this final question that has to be answered soon.

References

Clearview AI Inc v The Information Commissioner [2023] UKFTT 819 (GRC) https://caselaw.nationalarchives.gov.uk/ukftt/grc/2023/819

Forthcoming Data Protection Courses

Our well received, all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill will be held on Thursday 7 December  2023.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London on Monday, 20 November 2023 to Friday, 24 November 2023 (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (December 12-14, 2023: Tuesday to Thursday, 3 days: 9.45am to 5.00pm) or

Full details on Amberhawk’s website (www.amberhawk.com) or  obtained by emailing info@amberhawk.com.

Cronyism at the Information Commission can undermine its regulatory independence

I have atoned for not delivering a blog for two months by reading Schedule 13 of the Data Protection and Digital Information No 2 Bill (the “Bill”).  As readers know, the Information Commissioner (ICO) is to be replaced by an Information Commission, and Schedule 13 outlines the procedural arrangements for the operation of the Commission.

Schedule 13 is not “a gripping read”.  With all its provisions about voting, quorums, Committees, Board Members, Chairs and Chief Executives, the text can be described in two words: one is a swear word and the other is “boring”.

However, this Schedule has the potential to transfer data protection power to the Secretary of State (“S.o.S”) through the appointment of (“trusted”) Non-Executive Members to the Commission.  The proposed Commission’s voting structure, from the direction of data protection policy to the appointment of the Chief Executive and other Committee Members, are all subject to the approval of these Ministerial appointees.

For example, new Clause 120B to the DPA2018 says the Commission (once established) has to have regard to a number of factors (e.g. innovation, competition, crime reduction, national security) as well as protecting personal data. The S.o.S can influence which of these factors prevail through the ability to appoint Non-Executive Members to the Commission.

In this Blog, I give several examples to highlight the risks to data subjects. The references relate to the Bill at Second Reading (Commons) if readers want to follow the points being made.

ICO becomes Chair NOT Chief Exec

When the Commission is established in about 2 years’ time, the current ICO becomes the Chair of the Board and not the Chief Executive (see Schedule 13, page 204, para 2(2)(sic)).  This is a surprise since it is usually the Chief Executive who is responsible for all day-to-day executive actions (e.g. detail of enforcement, strategy, policies).

The Chair is not usually involved in such mundane day to day activity and its role is usually limited to a reassuring figurehead role and ensuring the Board runs smoothly.

Just think of your organisation and the roles of Chief Executive and Board Chair.  The Chief Executive has the real day to day power; the Chair stays aloof from the fray and only gets involved when an issue is huge, or the Board fails to operate properly.  And so it will be for this Commission.

As can be appreciated, the current ICO acts more like a Chief Executive and not a Chair (e.g. deciding on whether to enforce, issuing Codes of Practice, deciding on Guidance, making public statements).  In future. such actions are likely become the responsibility of the Chief Executive and  Non-Executive Members of the Commission and not the Chair.

So who becomes Chief Executive becomes very important.  This lucky person is appointed by the Non-Executive Members of the Commission, all of whom are appointed by the S.o.S.  There is no Parliamentary involvement in this selection.

In other words,  the Chief Executive is indirectly chosen by the S.o.S, as the Non-Executive Members of the Commission who appoint the Chief Exec are all appointed by the S.o.S.

In addition, to make sure that the Non-Executive Members of the Commission make the “right” Chief Executive choice, they must consult the S.o.S prior to appointment (so that the S.o.S. can signify approval of their choice: para 3(4)).

The current ICO as Chair

So what will Mr. Edwards do when the Commission comes into being? As the current ICO’s 5 year term is scheduled to end on 3 January 2027, he is likely to become Chair in the last year of his tenure.  It will probably take this last year to embed the new Commission’s governance arrangements.

If one assumes a two-year lead in time from the initial enactment of the Bill (likely in May-July 2024) and for the substantial provisions of a revised DPA2018 to come into effect (e.g. establishment of the Commission), then we are looking at Spring 2026 for the commencement of the Commission.

This two year delay is a reasonable assumption.  Such a delay occurred with the DPA1984 (commenced in 1986), the DPA1998 (commenced in 2000) and GDPR Regulation passed in 2016 (commenced with the DPA2018).  The delay is needed to rewrite the necessary Guidance on the revised DPA2018.

In other words, by 2026, the Government has to wait about 9 months or so before the current ICO rides off into the sunset (suitable gong in hand).

I suspect in practice that the current ICO will try and act in the same way as he does now.  However, it may come as a surprise to him (and future Chairs) that the real power lies with the Chief Executive and the other Non-Executive Members of the Commission chosen by the S.o.S.

There is the potential for conflict; for instance, suppose the Chair wanted to “do something” contrary to the views of the Chief Executive and Non-Executive Members of the Commission.  If this happens, any conflict is likely to be resolved by the votes of other Non-Executive Members of the Commission (all of whom have been chosen by the S.o.S.).  In this way, the Chair easily loses out.

In this management structure, the Chair is not free to develop UK data protection policy as the current ICO has done.  Instead of the Chair being the UK’s data protection leader (the current position), the risk is that the Chair becomes a “prisoner ” of the Commission’s management structures, as controlled by chosen S.o.S. acolytes.

Members of the Commission

The Commission consists of Executive and Non-Executive Members.  The Non-Executive Members of the Commission are only appointed by the S.o.S (Sched 13, para 3(2)(b)).  There is no Parliamentary involvement.

These Non-Executive Members do not get involved in day to day activities which are the responsibility of Executive Members.  Non-Executive Members, however, can be expected to be involved in approving overall policymaking as well as monitoring the activities of Executive Members.

Executive Members of the Commission can be appointed by other Non-Executive Members (para 3(3)) or by the S.o.S. (para 9).

Although there is “fair and open” competition for all Members of the Commission (para 5(2)), it has to be remembered that the S.o.S can influence who is on the shortlist; the risk of only choosing between “trusted potential appointees” is not eliminated.  This risk would be much reduced if, for example, there was a specific requirement to have Members who are mandated to look out for the interests of data subjects.

At any time, Schedule 13, para 4 requires the number of Non-Executive Members to be greater than the number of Executive Members. This means that there are skewed voting arrangements. The Non-Executive appointees (chosen by the S.o.S) have a vote;  all Executive Members (e.g. those chosen by Non-Executive Members) do not have a vote.

The Committees

The Commission is free to establish committees that contain “other persons” who are not Members of the Commission or employees (para 13).  Indeed, the Commission can delegate any of its functions (e.g. enforcement) to that Committee or indeed to those “other persons” (para 14) whoever they may be.

There is no obligation for these “other persons” to possess suitable qualifications, or to apply for advertised positions, or to be subject to Parliamentary scrutiny.

Worst case scenario:  Non Executive Members (i.e. “S.o.S. chosen cronies”) vote for like-minded Executive Members (i.e. more cronies) and “really trusted” members of all important Committees (e.g.perhaps semi-cronies) to generate and approve all “appropriate” data protection policy.

Of course, many may argue that this worst case of cronyism won’t happen.  However, that misses the point.  The fact that this worst case position can be constructed from the comitology specified in this Bill shows that any guarantee that the Commission is 100% independent of S.o.S. influence is demonstrably false.

A set of worst case scenarios

This lack of independence is reinforced by other provisions in the Bill.  I give three examples, but to understand what I am driving at, assume the Commission is controlled by (or contains) a set of S.o.S approved, Non-Executive, “friends”.  All of the examples below give rise to a potential conflict of interest that is likely to be detrimental to the interests of data subjects.

Example 1: Clause 19 of the Bill (Law enforcement Codes of Conduct) specifies that Codes of Conduct can “demonstrate compliance with the requirements of this Part” (i.e. the law enforcement Part 3 of DPA2018).  In other words, the law enforcement provisions of Part 3 are satisfied if the processing meets the requirement of a Code of Conduct.

Sounds reasonable until one considers how a Code of Conduct is produced?

Well, the Commission (via its Non-Executive Members chosen by the S.o.S.) identifies an expert public body to draft a Code of Conduct (e.g. how about the Home Office? What a surprise!) which then submits its text, eventually to the same Non-Executive Members for approval on behalf of the Commission.

In this way, there is a potential conflict of interest if a Code of Conduct permits the Home Office to determine lawful processing for the controllers under its own departmental remit.  This conflict of interest would be reduced if there were Members charged with looking after the interest of data subjects.

Example 2: Clause 25(3) which introduces Section 82A(8) into the DPA2018 which allows Part 3 personal data to be designated as being subject to national security processing rules.  Before issuing a designation notice, the S.o.S. “must consult the Commission”.

In practice, this means the S.o.S. consulting a Commission controlled by Non-Executive Members where the S.o.S. has appointed these Members to the Commission.  This more or less repeats the conflict of interest re law enforcement, as there is unlikely to be much disagreement about a designation notice.

The result of this conflict of interest is that national security compliance with the DPA2018 becomes even weaker; again an argument for the existence of Members charged with looking after the interest of data subjects.

Example 3: Clause 30 which includes reference to the panel that is formed to consider any draft Code of Practice (e.g. on data sharing).  If this panel were to become a Committee of the Commission, this in turn means that the members of that Committee and the draft of a Code of Practice would be signed off by Non-Executive Members chosen by the S.o.S.  This mechanism risks skewing Code of Practice content in favour of a text that is favourable to the S.o.S.

Note I have not mentioned a role for the Chair in any of the above. By a miracle of Comintern comitology, devised by this Bill, the Chair has no defining role.

Conclusion

The ICO often states that he is satisfied that regulatory independence is guaranteed under the DPDI No 2 Bill.  In evidence to the Bill’s Standing Committee he said: “I do not believe it [the Bill] will undermine our independence at all. What I think it will do is to further enhance and promote our accountability”.

I hope the ICO now appreciates that he risks being profoundly wrong.

Forthcoming Data Protection Courses

Our well received, all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill will be held on Thursday 7 December  2023.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London on Monday, 20 November 2023 to Friday, 24 November 2023 (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (December 12-14, 2023: Tuesday to Thursday, 3 days: 9.45am to 5.00pm) or

Full details on Amberhawk’s website (www.amberhawk.com) or  obtained by emailing [email protected].