Hawktalk

What are the main features of the Data (Use and Access) Bill?

The blog concerns the content of the new  Data (Use and Access) Bill (DUAB) as published last week; it bears a strong relationship with the previous Data Protection and Digital Information (DPDI) Bills.  In fact, DUAB could easily have been named the DPDI (No 3) Bill.

The Bill itself is 138 Clauses, 16 Schedules and 251 pages; many of the provisions of DPDI re-appear in DUAB but with different Clause numbers. The Bill is a complex read as its data protection changes appear as amendments to existing legislation (i.e. one has to cross reference DUAB with the DPA2018 and the UK_GDPR to find out what is happening).

There are, in addition, three immediate political consequences with start of the Parliamentary processes in the House of Lords.

• First, it will be difficult for the official opposition to oppose DUAB since it contains many of the Conservative’s DPDI proposals. In other words, apart from the odd maverick intervention, the opposition to this Bill will not come from the two main political parties.
• Second, the Bill has started its Parliamentary life in the House of Lords. This, from the Government’s perspective, gets the awkward Parliamentary stages out of the way first and at a time when Peers and NGOs have not had much time to really understand the detail of the Bill’s proposals. The Commons passage is likely to be cursory given the Government’s majority in the Commons (as it was with the DPDI Bills).
• Third, if the Bill, after Second Reading in the House of Lords, is remitted to be considered under the Grand Committee procedure of the House of Lords, then voting on amendments to the Bill in Committee will not occur. This means that the Report stage will be the main area of voting contention, and where Government amendments to the Bill will surface for minimal debate. So expect Parliamentary scrutiny of the Bill’s content to be much diminished.

The blog is in three parts: what has been dropped from DPDI; what has been copied from DPDI; and what is new. If I have missed something out, please let me know.

Just so you know; I am reinstating our Zoom sessions on the major changes to the UK_GDPR and DPA2018, arising from DUAB, on January 28^th next year (Data Protection Day); details at end of the blog.

What was in DPDI but not in DUAB

DUAB does not contain any proposals:

• to weaken the definition of “personal data”.
• to change the status of Data Protection Officers (so Senior Responsible Individuals are gone).
• to change the requirements associated with the Record of Processing Activities maintained by a Controller or by a Processor.
• to change the circumstances when a DPIA has to be completed.
• to remove the requirement to have prior consultation with the ICO if there are high risks to data subjects that cannot be mitigated after a DPIA has been completed.
• to exclude subject access requests because they are vexatious.
• to encourage “electoral engagement” (I did not understand these in the DPDI anyhow).
• to specify the ICO’s strategic direction (but I suspect this can be done by other means).
• to permit the DWP access to bank records of benefit claimants including pensioners (expect this to appear in other Benefit related legislation).
• to abolish the Home Office’s Biometrics and Surveillance Camera Commissioner and merge the latter responsibility for CCTV with the ICO’s role.
• to scrap the requirement for a Representative in the UK if the controller is based outside the UK and offering services to those residing in the UK (i.e. the Representative in the UK is needed).

What’s in DUAB that was in DPDI

Like DPDI, the DUAB contains proposals that:

• Install a lawful basis of “recognised legitimate interests”, the most important one being the ability of any public body to ask another controller (usually in the private sector) for the disclosure of personal data it needs to deliver its functions. This applies to all public bodies and the Secretary of State (SoS) has powers to add to the “recognised legitimate interests” (but see next bullet). It is difficult to see how the right to object can prevail if the processing is made lawful in terms of a “recognised legitimate interest”.
• Specify that certain further processing purposes as compatible with the purpose of the obtaining of personal data; the SoS has powers to add to the list of  further “compatible” processing purposes.  These powers are unfettered; in extreme, it permits any future Government to define processing to be lawful, compatible (and provide for exemptions from rights courtesy of A.23(1)(e)).
• Introduce a lawful basis that allows USA law enforcement authorities to obtain telecommunications data for its law enforcement purposes, as per a reciprocal Agreement with the USA (the “Access to Electronic Data for the Purpose of Countering Serious Crime”) signed by Priti Patel when she was Home Secretary (October 2019). There is no information provided as to how this international Agreement has worked in practice or whether it is equally balanced.
• Limit the right not to subject to automated decision making processing or profiling to special category of personal data; this facilitates automated decision or profiling using normal personal data. Controllers are therefore free to make such automated decisions (e.g. to use AI techniques on the information scraped from the internet on applicants for employment).  This is “wild west” deregulation and is just asking for trouble.
• Clarify the time limits associated with the exercise of data subject rights (e.g. dealing with requests when the data subject’s original request does not identify the data subject).  The controller does not need to make excessive searches for the requested personal data; the search for personal data has to be "reasonable and proportionate ".
• Provide the data subject has the right to complain to the controller (i.e. to resolve an issue with the controller before complaining to the ICO); in summary this looks as if an FOI type internal review procedure will be needed.
• Overturn the 40 year old requirement (from DPA1984 days) to obtain consent for Third Party marketing as such marketing can be in the “legitimate interests” of that Third Party (i.e. an opt-out will do instead).
• Disapply transparency requirements when personal data are used for RAS purposes (Research, Archive and Statistical purposes) and to make any further RAS purpose always compatible with the processing so long as what is called “the appropriate safeguards” apply. This means that personal data can be exchanged secretly between a controller and any number of Third Parties for RAS purposes.  As with DPDI, one of safeguards does not impress: there is a requirement for the personal data processed not to cause “substantial damage” or “substantial distress”, as if causing “just short of substantial damage/distress” is acceptable.
• Permits the SoS to apply a “data protection test” when considering whether a country, part of a country, or a controller located in an country offers an adequate level of protection. These provisions increases the risk of divergence from European transfer standards if the European Commission and UK Government have different views on what “adequate” means.  Also I don’t understand how a country is not deemed adequate, but a controller, processor, or recipient located in that country is.
• Reinstates the complex proposals for transfers outside the UK for law enforcement; this includes the possibility of a law enforcement controller transferring personal data for law enforcement purposes by assessing the data protection test (instead of Secretary of State).
• Allow the SoS to designate that certain police personal data sets become subject to national security rules (i.e. the personal data subject to Part 3 of the DPA2018 can be designated as being subject to Part 4). The difference: the ICO can enforce Part 3, he can’t enforce Part 4 and the proposal has the effect of taking large volumes of personal data out of the UK's data protection regime.
• The ICO is abolished in favour of the Commission. The problem remains that the SoS appoints the most important members of the Commission and this ability to appoint has the potential to give the SoS undue influence over the Commission’s decision making processes (e.g. determining the policy towards enforcement of AI).
• The Commission still has to have regard for: the desirability of promoting innovation and competition; the importance of the prevention, investigation, detection and prosecution of criminal offences; and the need to safeguard national security.  In other words, these “regards” could fetter decisions to protect the privacy of data subjects.

What’s new

The new items I have identified are:

• Allowing the SoS to add items of special category of personal data so that the processing of newly define types of special category of personal data is prohibited (the example given is “neurodata”). These provisions cannot be used to modify the existing list of special category of personal data specified in A.9(1).
• Giving the Treasury powers over the use and disclosure of “business data” and “customer data” with the permission of the customer. If the “customer data” are also personal data, you may have to grapple with "recipient", "third party" and now “third party recipient” (so good luck with that one).  The objective is to establish “smart data” schemes, which allow the use the customer’s data to provide services for the customer or business as well as sharing or publication of contextual business data.

Concluding comment

There is no Keeling Schedule published for the DUAB at the moment; as with the DPDI Bill, the absence of a Keeling Schedule significantly hinders any prospect of an informed public debate about its content. Perhaps the ICO could publish one?

One cannot expect anyone to understand what the Government proposes if one has to cross reference the DPA2018; the UK_GDPR and this Bill at the relevant pages where amendments are proposed.  This is especially important as there appears to be major concerns (listed above).

I shall be returning to DUAB; so watch this space.

References

All DUAB documents (the Bill; explanatory memorandum etc) can be obtained from  https://bills.parliament.uk/bills/3825/publications

Winter Data Protection Courses

The first all-day Zoom workshop (10.00-4.30)  on the DATA (USE AND ACCESS) BILL will be held on Tuesday 28 January 2025  (£275+VAT per place).

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London on Monday, 18 Nov to Friday, 22 Nov and Monday, 20 Jan to Friday, 24 Jan 20 (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (December 8-10: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].

Upper Tribunal undermines data breach reporting under the UK_GDPR?

The Upper Tribunal (UT) appeal [DSG Retail Limited -v- ICO; see references] is important even though it relates to the DPA1998; the judgement has the potential to undermine the data breach reporting requirements of the UK_GDPR/DPA2018. This blog explains why this is the case, why legislative changes might prove to be necessary and, for good measure, provides details of two errors in the UT’s analysis.

The appeal concerns the meaning of “personal data” in the context of the security obligations of the DPA1998.  In summary, the ICO’s position was as follows:  DSG Retail had poor security and it reported the loss of 5.6 million credit card numbers and expiry dates.  As a result the ICO levied a large Monetary Penalty Notice, originally £500K but later reduced to £250K.

DSG’s successful counter argument was as follows: although the data lost by DSG Retail were personal data, the data were not personal data in the hands of the hackers. This was because data subjects could not be identified using “reasonable means” (the test described in Recital 26 of both Directive 95/46/EC and UK_GDPR).

Because there were no personal data in the hands of the hackers, there could be no “substantial damage or distress” caused by the data breach (the threshold for a Monetary Penalty Notice under the DPA1998). So it followed, that there should be no fine at all.

To cut to the chase, this latter view was preferred.

Why an impact on the UK_GDPR?

First, the UT stressed that the parties to this appeal accepted (i.e. the ICO accepted) “… that the relevant provisions of the ‘new’ regime under the Data Protection Act 2018 (DPA 2018) and the UK General Data Protection Regulation (UK GDPR) are materially the same”.

Second UT concluded that if there were to be a hacking incident involving a controller’s personal data and if the data exposed were not personal data in the hands of the hacker, then there would be unlikely to be a risk to data subjects.

It follows that in UK_GDPR terms, a personal data breach involving millions of credit card details (as per DSG Retail)  would not even be reportable under the UK_GDPR terms as a personal data breach, as that breach “is unlikely to result in a risk to the rights and freedoms of natural persons” (the threshold in A.33(2)) assuming the hackers do not know who has what credit card.

Yes, there has been a personal data breach on the part of the controller,  but there is no risk to data subjects as the hackers are unable to reidentify data subjects using reasonable means (see Recital 26, UK_GDPR).

It then follows that such a personal data breach is not reportable to the ICO and it also follows that the ICO will become ignorant of these serious types of mega breaches of security.

This is a consequence of the UT conclusion: “As the risk to be guarded against is the risk of data processing by third parties, the question of whether personal data is involved is to be judged from the perspective of the data that the third parties can access (rather than the entirety of the data held by the data controller)” (my emphasis of para 123).

Of course it could be claimed that the controller has breached other security provisions (e.g. the requirements in A.32).  But if the ICO is unaware of this kind of non-reportable security breach, it is difficult to see how these provisions are enforced.

This explains why a change in the law might be needed (e.g. for the controller to report to the ICO, large personal data breaches involving millions of records irrespective of the risks to data subjects).

The history relates to FOI

Readers steeped in freedom of information legislation (FOI) should recognise the dilemma of whether a third party requestor holds personal data or not.  It arises, for example,  when a FOI requestor asks for statistical data which are derived from personal data; for instance, “how many late abortions were there in the North of England last year”.

Now quite clearly in the hands of the NHS, the information is personal data as they know the identity of the patients having late abortions.  However, in the hands of the FOI requestor, the number of late abortions does not lead to the identification of these patients (using the “reasonable means” available to the requestor).

It then follows that a public authority (e.g. a NHS body) that received this type of FOI question would not be able to apply the FOI exemption associated with the protection of personal data, because in the hands of the requestor, the requested statistics do not lead to the identity of any data subject.

This is different to the FOI request of the form: “how many pupils, attending St. Mary’s School in Putney, were excluded last term?”.  In this case, the highlighting of the particular school, means it’s quite simple to go to the school in the morning and ask the Mums in the playground: “who has been excluded?”.

With this latter type of FOI request, the exemption to protect personal data does apply because in the hands of the requestor, the statistics can lead to the identification of data subjects using “reasonable means”.

As an aside, anyone who wants to explore the current case-law on this dilemma (which gave rise to the ICO’s idea of a “motivated intruder” test) this UT judgement is highly recommended.

So did the UT get it wrong (error 1?)

The first problem is that the UT, to arrive at its conclusions, over-relied on the “motivated intruder” test as formulated by the ICO.  This test permeates the UT’s discussions of “personal data”.

The judgement approvingly quotes the ICO’s motivated intruder” test:

“… assumes that the ‘motivated intruder’ is reasonably competent, has access to resources such as the internet, libraries, and all public documents, and would employ investigative techniques such as making enquiries of people who may have additional knowledge of the identity of the data subject or advertising for anyone with information to come forward.

The ‘motivated intruder’ is not assumed to have any specialist knowledge such as computer hacking skills, or to have access to specialist equipment or to resort to criminality such as burglary, to gain access to data that is kept securely.”  (my emphasis of para 14 of Judgement).

Now please answer the following YES/NO question: do you expect a hacker, who has used unlawful means to exfiltrate DSG’s data, to only use lawful means as a motivated intruder to complete the identification of data subjects?

Or do you think it reasonable to assume that our motivated intruder would also rely on unlawful means (e.g. to complete identification of data subjects by searching the dark web to see if anyone had, for example, lists of credit card numbers linked to credit card holders).  If you agree that this is a reasonable assumption, then the motivated intruder justification, as used by the UT, falls.

Another way of looking at it as follows: what is the point of gaining unlawful access to credit card numbers and expiry dates, if someone does not try and link the credit cards with the data subjects?

This is not the UT’s  conclusion.  It stated that the lower Tribunal (FTT) failed to consider:

“…the risks that shortcomings in security gave rise to, not simply by reference to what actually happened in the attack. This will involve consideration of what a motivated attacker could and could not have obtained data-wise from the DSG estate as a result of the [security] shortcomings. The FTT's decision has not addressed this”. (My emphasis of para 127).

So did the UT get it wrong (error 2?)

You will note that UT reasoning in para 127 (quoted immediately above) -relies on identification details to transform the hacked data into personal data, coming from other DSG Retail’s other personal data holdings and not from other sources (e.g. the dark web).  This assumption dominates the UT’s judgement.

For instance, the UT state that the lower Tribunal did not consider:

whether the data exfiltrated by the hacking attack “could be linked by a motivated attacker to other data put at risk by DSG that would identify the cardholders in question”  (para 173(ii)), or

whether “a motivated attacker could and could not have obtained data-wise from the DSG estate as a result of [security] shortcomings”. (para 127).

The UT’s  standpoint is generalised as follows:

“If a third party can only obtain anonymous data and the key to any pseudonymised material remains behind a [secure] wall [under DSG control] then then, accessing that vanilla data would not amount to an “unauthorised or unlawful processing of personal data”. (para 114). (The term “vanilla data” is used by the UT to describe anonymous data)

Hence the UT’s conclusion:

“Accordingly, the FTT’s decision involved a material error of law in deciding that there had been a contravention of the DPA 1998 ….without determining whether that data would be personal data in the hands of third parties who could access all the data put at risk by DSG’s failings”.

Concluding comment

Fortunately, the UT did not overturn the case entirely as it focused on resolving the “issue of construction” and “a question of law of special difficulty”.  Consequently, it referred the substantive issues back to a newly convened First Tier Tribunal that would use the UT’s case-law determinations as its starting point.

In summary, a fresh Tribunal view of the facts, fettered by the UT’s (dodgy) reasoning.

So will the ICO fight a second case at the FTT using the points raised in this blog which were not considered at the UT?

Given that these legal proceedings relate to the DPA1998 and were commenced by the previous Commissioner, I would not be surprised if the current Commissioner threw in the towel and withdrew the Monetary Penalty Notice.  Afterall, the UT’s judgement will be difficult to set aside.

However, if “towel chucking” is the order of the day, then this judgement because of the similarities of the personal data position in the DPA1998 and in the UK_GDPR (as agreed by the ICO – see above),  has the potential to undermine data breach reporting under the UK_GDPR in the circumstances of a non-reportable mega personal data breach of the kind experienced by DSG Retail.

Fortunately, the Government has just published new data protection related legislation: "The Data (Use and Access) Bill (see references).  What better place to amend the law to ensure that the UT’s view does not prevail.

References

The Upper Tribunal case: DSG Retail Limited -v- Information Commissioner [2024] UKUT 287 (AAC)

The text of the Data (Use and Access) Bill can be found on: https://bills.parliament.uk/bills/3825/publications

Winter Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London on Monday, 18 Nov to Friday, 22 Nov and Monday, 20 Jan to Friday, 24 Jan 20 Sept (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (December 8-10: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].