Hawktalk

DUAB makes function creep in the public sector inevitable and lawful

This blog is the promised second instalment that deals with the powers in the Data (Use and Access) Bill (DUAB  “Bill”).  These powers give Ministers the ability to sweep aside key elements of the UK_GDPR that protects data subjects from function creep in the public sector.

In evidence in support the above statement, this blog explains details of:

• the two powers that give Ministers the ability to specify any voluntary data sharing with any public body as lawful and not incompatible with the purpose of the original obtaining of the personal data, so long as that public body states that it needs the personal data for any of its public tasks. The function creep arises because if personal data can flow to one public body for its public task, it can flow onwards to other public bodies for their public tasks.
• the power for Ministers to add general exemptions for pet political projects because they are deemed by Ministers to relate to “other important objectives of general public interest” (i.e. other than widely recognised public interest such as crime, tax, benefits, national security, child protection etc). This power essentially permits Ministers to claim that political processing objectives can be treated as objectives in the “public interest”.
• two exemptions that illustrate the control Ministers have over exemptions to the DPA2018. One exemption concerning immigration was subsequently deemed by the Courts to be unlawful (four times). The other involves total disregard of a Strasbourg Human Rights judgement (UK v Gaskin).  In both cases, the Government are still claiming the exemptions are “necessary and proportionate”. Official statements offering reassurance about exemptions, in general, are hence rendered worthless.

All three bullet points above applied to the two Data Protection and Digital Information Bills of the previous Government,  so they can expect to have the support of the official Opposition.

If anything is likely to resurrect risks to the UK’s “adequacy” determination with the European Commission, it is the way these two exemptions disregard the role of Parliament, show disrespect to Strasbourg jurisprudence, and illustrate the excessive range of Ministerial power.

Recognised Legitimate Interest power

In my last blog (December 5) I explained how the Bill provided the Secretary of State (“SoS”) with powers to specify that certain voluntary disclosures of personal data for pre-ordained Third Party public sector purposes would be in the Recognised Legitimate Interest of that Third Party.

In particular, I mentioned paragraph 1 of Annex 1 which opens up a general data sharing pathway for any public sector body seeking any disclosure of any personal data it deems necessary for its public task.

I also noted that a House of Lords Committee has called for the removal of this power from the Bill because the Government’s explanations for its inclusion were not credible.

A Recognised Legitimate Interest  means there is no need for a controller to perform a “Legitimate Interest Assessment”  that balances the Third Party’s interests against any overriding interest on the part of the data subject, prior to a disclosure of personal data to that Third Party.

This is because the balance has, by law, been pre-determined to be in the “legitimate interests” of the public sector Third Party.  In the case of generalised paragraph 1, this is irrespective of the purpose of the disclosure, so long as the personal data are deemed necessary for disclosure to the requesting public body.

Once processed by one public body, the shared personal data haves the potential to be shared with other public bodies for their public task  (perhaps as another Recognised Legitimate Interest or via existing data sharing gateways). That is why I describe this process as: “function creep”.

Finally, the use of a Recognised Legitimate Interest lawful basis fetters the right to object to such disclosures in the vast majority of circumstances because the balance has been pre-determined in favour of disclosure.

Article 23(1)(e): “general public interest”

The Bill also provides the SoS powers to add Recognised Legitimate Interest so long as any addition “is necessary to safeguard an objective listed in Articles 23(1)(c) to (j)”. This nerdy construction needs a bit of clarification!

In general, Article 23 begins with a power for the SoS to introduce exemptions from any data subject right and corresponding Principles so long as the exemptions are deemed to be “necessary”.  Reasons for the exemption are precisely listed in most of Article 23 (e.g. to protect an investigation into crime or safeguard an investigation into malpractice by a regulated professional such as a medical practitioner).

In general, I don’t think there will be much debate about the need for the exemptions described in most A.23 paragraphs (e.g. to protect a criminal or regulatory investigation).

However, Article 23(1)(e) widens this list of exemptions infinitely and the SoS can specify exemptions for “other important objectives of general public interest”. These exemptions are specified “in particular [for] an important economic or financial interest of the United Kingdom, including monetary, budgetary and taxation a matters, public health and social security”.

It is the use of “in particular” which makes the range of possible exemptions non-exhaustive, unlimited and illustrative.

Examples in the DPA2018 of “important objectives of general public interest” exemptions include the two exemptions which are explored in this blog: .the confidential references and immigration exemptions.

The immigration exemption

It is noteworthy that there was no immigration exemption from data subject rights in the DPA1984 and the DPA1998.  Indeed the lack of an immigration exemption was not aired publicly under these Acts.

Yet, suddenly, in 2016 an immigration exemption became an “important objective of general public interest” for the DPA2018.  Why was this?

Immigration has always been a bone of contention for those on the right of British politics (e.g. from Enoch Powell’s “rivers of blood” speech in 1968).  During the 1979 election Mrs Thatcher, then Leader of the Opposition, expressed concern that “people are really rather afraid that this country might be rather swamped by people with a different culture”.  Yet the DPA1984 did not contain an immigration control exemption.

Moving past the “Tebbit test” of the 1990s (Do “they” support the English cricket team?) to 2012, Mrs May, then Home Secretary, commenced her 'hostile environment' policy which contained a range of measures aimed at identifying and reducing the number of immigrants with no right to remain in the UK.

Remember the notorious poster van which toured the streets proclaiming that illegal immigrants should “go home or face arrest”.  The Windrush scandal was a consequence of this Home Office mind-set.

It was in support of the 'hostile environment' policy, that the immigration exemption was included in the DPA2018; political imperatives to bolster the Party’s voting base had transformed immigration into an “important objective of general public interest”.  Note that its purpose has nothing to do with crime, national security, tax or benefit claims etc, all of which have separate exemptions in the DPA2018.

The exemption merely exists for the administrative convenience of the hostile environment policy; it protects personal data from scrutiny by data subjects who are often exploited, financially destitute or living in vulnerable circumstances.  The “general public interest” is served, so it is claimed, by making it more difficult for those seeking refuge in the UK, to make their case for the right to remain.

This exemption has had to been rewritten three times, because its two previous incarnations were declared unlawful by four Courts: twice at the High Court and twice before the Court of Appeal (see references for grizzly detail).

It is difficult to believe that any competent Minister would make the same mistake twice (i.e. approve an exemption that could be struck out by the Courts, including on Appeal).  The only conclusion I reach is that Ministers knew both exemptions could be challenged in the Courts, and were prepared to push them through Parliament, with appropriate reassurances to Parliament, in the hope that they would not be challenged.

This explains why Ministerial proclamations, made to Parliament,  that the exemptions are “necessary and proportionate” or do not breach the Human Rights Convention are totally unreliable.

In summary, the history of the immigration exemption provides evidence that an “important objective of general public interest”  can degrade to “the party political interests of the Government of the day”.

Ministers can approve exemptions even when the exemptions themselves are known, by them, to be of dubious legality.

Confidential References exemption (DPA1998)

The DPA2018 changed the confidential references exemption to ensure that confidential references given or received were exempt from the right of access and the right to be informed. Data subjects do not know when they go for a job, that a secret confidential reference about them can be sent or obtained.

By contrast, under the DPA1998, the confidential reference exemption allowed personal data to be exempt from the right of access for the sending controller only.  Therefore prospective employees were able to know there was a confidential reference sent by their previous employer and make a request for subject access to the prospective employer who had received the reference.

If the employer refused to provide access on grounds of confidentiality, the data subject concerned could raise the matter with the Data Protection Commissioner (as the ICO was then called), who then could independently determine whether access (or not) should be provided.

This exemption was included in the DPA1998 in order for the UK to comply with the EHCR Judgment: Gaskin v UK (see references).

In further detail, Gaskin considered what should happen if, for example, there was an absolute refusal of a subject access request to a confidential reference, received from a Third Party, in circumstances where that Third Party refused consent for its release.

The Court concluded that there had to be a mechanism for an independent review. The matter could not be left to either the sender or recipient of the confidential reference because both have a vested interest in not providing access to the reference.

So the DPA1998 allowed the data subject to appeal to the Data Protection Commissioner, so that the Commissioner could take-on the independent review role as required by Gaskin.  The Commissioner could take enforcement action to order the release of the confidential reference, if this step was needed.

Gaskin said nothing about the status of the controller sending the confidential reference. Consequently, the Government could fashion an exemption which allowed the sending controller to claim an absolute exemption for personal data comprising a confidential reference.

This complicated procedure was explained and approved by Parliament several times in order to meet the ECHR requirements of Gaskin (e.g. Lords Hansard, 10 Jul 1998 : Column 1478).

Confidential References exemption (DPA2018)

However, this exemption has been expanded and in the DPA2018, confidential references can be withheld from a SAR by both the sender and recipient of the reference.  Additionally, the fact that the reference exists, can be kept secret as it is exempt from the right to be informed.  There was no debate in Parliament about abandoning the ECHR consequences of Gaskin.

In other words, the Government arbitrarily decided to ignore Strasbourg jurisprudence in Gaskin when it drafted the DPA2018 exemption, and it kept Parliament ignorant of these changes (i.e. there was no debate in either House about the exemption when the DPA2018 was a Bill).

As this exemption remains unchanged, the new Government is complicit in ignoring Strasbourg jurisprudence – a red line for the European Commission in adequacy terms.

As an aside, the Government of the day was basking in the benefits of Brexit(?!). Perhaps maintaining an ECHR judgement was too much for it politically to take (even though getting rid of the impact of Gaskin diminished workers’ rights, contrary to the Ministerial propaganda of the time).

Compatible processing power

The Bill contains a Ministerial power to deem certain processing of personal data to be compatible with the purpose of the original obtaining; there is no need to do the compatibility assessment as outlined in Article 6(4).

Roughly speaking, the disclosure list in Annex 1 is replicated in Annex 2 (with some additions). So if a further disclosure is deemed to be for a Recognised Legitimate Interest, the disclosure purpose is also deemed compatible with the purpose of obtaining.

The controversial disclosure which allows for general disclosure to the public sector (in paragraph 1 of Annex 1), additionally requires that the purpose of disclosure “is necessary to safeguard an objective listed in Articles 23(1)(c) to (j)”.

This looks like a protection for data subjects, but it is not.

All that is required is that, for such a disclosure of personal data to be deemed to be compatible, is that the disclosure has to be for any objective found in Schedules 2 to 5 of the DPA2018. (For readers not familiar with the DPA2018, the legislation contains 40 pages of exemptions!).

However, as we have seen above that Article 23(1)(e) contains a power that effectively equates an “important objective of general public interest”  with “the political interests of the Government of the day”.

So suppose a Minister wants to make any disclosure to any public body compatible with the purpose of obtaining, for a pet party political project.  All the Minister asks is: “Is there an exemption in the DPA2018 that fits the Ministerial requirements?”.

• If the answer is “yes”, the disclosure to the public body will be automatically compatible with the purpose of obtaining and the Minister does nothing; the lawful basis for the disclosure of personal data will be paragraph 1 of Annex 1.
• If “no”, the Minister fashions another exemption using the A.23 power, claims the exemption to be an “important objective of general public interest” (just like the dodgy immigration exemption). Then the disclosure becomes compatible.

The House of Lords Committee that looked at this power was not impressed.  It said that “the power relates to a fundamental principle in the UK GDPR that processing in a manner incompatible with the original purpose is not permitted”.

It added: “Given the fundamental nature of that principle and the fact that we found the Department’s reasons for needing the power unconvincing, we took the view in our report that the delegated power was inappropriate” (and should be removed).

Finally, I need to explain why taxation explicitly appears in the Annex 2 list but is absent from the Annex 1 list.

It is clear that disclosures to HMRC can occur via paragraph 1 of Annex 1 as they are a public body performing a public task.  However, HMRC is subject to an exemption that protects data subjects from inappropriate disclosures for taxation matters.

The Annex 2 listing ensures compatibility without the need to consider that exemption.  In this way any disclosure to HMRC is compatible with the purpose of obtaining and the exemption that protects data subjects is wished away without any Parliamentary involvement.  More or less the same thing applies to disclosures for law enforcement purposes.

For some reason, the setting aside of these exemptions have not been mentioned by any Government Minister or in the Explanatory Notes.

Concluding comment

It is disappointing that the UK’s Information Commissioner is silent about the dangers that arise from these powers in the context of public sector data sharing.  He appears to be wholly unconcerned that the Government is dismantling the two provisions in the UK_GDPR that protects data subjects from unlawful and incompatible data sharing in the public sector.

Mind you, he was wholly approving about the previous DPDI Bills which were far worse from the data subject perspective, so his lack of concern with DUAB is par for the course.

The Commissioner’s policy of minimising the use of enforcement powers with respect of the public sector is only going encourage public authorities to make unnecessary requests for disclosure.

The Commissioner claims on his website that he wants to be “a regulator who empowers”.  In practice, his continued laissez-faire attitude merely empowers the Government to take more important protections for data subjects away.

Winter Data Protection Courses

Amberhawk is holding our first session on the changes to the UK’s data protection regime arising from the Data (Use and Access) Bill, by Zoom, on Tuesday January 28^th 2025: (10.00am-4.30pm;  £275+VAT).

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course: London on January 20-24 (5 days: Monday to Friday: 9.30am to 5.30pm) and on March 17 to March 21 (same timings).
• Data Protection FOUNDATION Course: London on March 11-13 (Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].

References

DUAB Powers should be removed: House of Lords Delegated Powers and Regulatory Reform Committee, 9th Report of Session 2024–25, HL Paper 49 (28 November 2024).

Confidential Reference Exemption was introduced to meet the requirements of the CASE OF GASKIN v. THE UNITED KINGDOM (Application no. 10454/83) in July 1989.

Immigration Exemption: THE 3MILLION and the OPEN RIGHTS GROUP v HOME OFFICE and DSIT, Neutral Citation Number: [2023] EWCA Civ 1474 from [2023] EWHC 713 (Admin); [2023] 1 WLR 3011.

Commentary:  The first attempt to introduce an immigration exemption was deemed unlawful following Judicial Review (JR) by the Court of Appeal ([2021] EWCA Civ 800, an appeal from [2021] 1 WLR 3611). After a further hearing to consider remedies, the Court suspended the effect of its declaration until 31 January 2022, so that the Government would have adequate time to amend the relevant provisions of the DPA by way of secondary legislation (see [2021] EWCA Civ 1573; [2022] QB 166).

These amended relevant provisions were also deemed to be unlawful by the Court of Appeal in a second judgment (see [2023] reference above).  In total, four Courts have determined that the immigration exemption was unlawfully drafted.

As an aside, the response of the Government was an attempt to make Judicial Review harder to take, mainly because NGOs were crowd-funding the £40K needed to commence JR proceedings.

Data Bill makes any data sharing with any public sector body lawful

This blog considers how the Data (Use and Access) Bill (the “Bill”) impacts on the lawful bases used in the context of voluntary data sharing with public bodies.

In summary, the Bill creates an infrastructure of Ministerial powers that ensures voluntary data sharing to the public sector has a lawful basis;  that such data sharing is not incompatible with the purpose of obtaining, and that such data sharing is, in practice, exempt from the right to object.

These powers have to be combined with the ability of Ministers in Article 23(1)(e) to specify new exemptions that can negate other data subject right on the grounds of “general public interest”. (This will be the subject of my next blog).

By creating a comprehensive gateway for voluntary disclosures to the public sector, the Bill also has the effect of undermining the role of Parliament in determining the conditions under which an organisation is obliged to provide personal data by law.

These Ministerial powers have been criticised by the House of Lords Delegated Powers and Regulatory Reform Committee (see references).  It recommends that the powers should be removed from the Bill, because they are “inappropriate” and the justification for them, provided by Government, is “unconvincing”.

For example, in relation to the removal of the power to negate Purpose Limitation Principle the Committee concluded: “Given the fundamental nature of that principle and the fact that we found the Department’s reasons for needing the power unconvincing, we took the view in our report that the delegated power was inappropriate” (and recommended its removal).

I would add that the first paragraph of Annex 1 (which legitimises disclosures to any public sector body) should also be removed from the Bill.  This blog explains why.

Recognised Legitimate Interests

The Government’s justification for the change in data protection  law is seductively simple; it goes like this.

Data protection is hard for many controllers, especially when faced with a one-off request for disclosure of personal data from any law enforcement agency, an agency that protects vulnerable children and adults, a national security agency, a defence agency, and for public security purposes or in emergency situations (e.g. floods).

In these circumstances, so the Government claim, many organisations hesitate and do not know whether to disclose personal data or not.

Hence the Bill will clarify the law by providing a list of Recognised Legitimate Interests, so controllers can disclose without performing any balancing test of the competing interests.  This is because Recognised Legitimate Interests have pre-determined the balance of interests is in favour of disclosure of personal data.

Hence, it is unlikely that there will be any overriding interests on the part of the data subject and that, as a result, the right to object to disclosure (and perhaps other subsequent processing that depends on that disclosure) is effectively extinguished.

Just in case the Government needs flexibility, it has provided a Ministerial power to make variations or additions to these Recognised Legitimate Interests.

How does disclosure work now?

So, suppose you get a request from a Local Authority Social Work Department:  “We are worried about Child X; can we have a copy of your personal data that relates to Child X?”. You go through some security questions to ensure it’s not a hoax (e.g. check who is asking) and then you can move on to the decision whether to disclose or not.

In order to make this decision, you will probably ask for information about the circumstances pertaining to the disclosure (e.g. “what are the worries”; “what do you want from us”; “how would our personal data help you” etc).  Normally you will need this type of information before you decide whether to disclose(or not).

If the request is genuine and the concerns about Child X are real, you have a choice.  Protect Child X or protect the putative child abuser’s privacy. So which one is it?

Not a difficult choice is it?

Then you square the disclosure of personal data with the data protection requirements.  Currently such a disclosure would be necessary “in the legitimate interest of a Third Party” (the Social Work Department) and the questions you have asked (e.g. why would our personal data help etc) create the balancing test of whether there exists overriding interests on the part of the data subject in not disclosing.

How does disclosure work under the Bill?

Now we come to the Bill and, for example, how it proposes to deal with the same disclosure protecting vulnerable children.  Remember the decision in favour of disclosure is baked in.

In response to the question: “we are worried about Child X; can we have a copy of your personal data concerning Child X?”, are you going to respond as follows:

“We have checked you are a Social Work Department and a public body with responsibility for child protection. You have asked for these personal data because they are needed to protect Child X.  We are NOT interested in any other details, so here is your personal data.”

Similar with an emergency:

“We know you are a public body tasked with responding to an emergency. You have asked for certain personal data that you state are needed.  We are NOT interested in what the emergency is, so here is your personal data”.

I suspect the answer is “NO”.

In practice, I also suspect you would still ask the questions of the kind: “what is the emergency or worries”; “what do you want from us”, and “why would our personal data help you” etc to decide whether or not to disclose.

In the rare case of a decision not to disclose, the fact that the lawful basis is a Recognised Legitimate Interest would not change that decision.  This is because the data protection considerations come after the details that inform the decision at to whether (or not) to disclose personal data.

In other words, there is very little will change in relation to the Recognised Legitimate Interests described above.  Controllers will still assess the situation prior to disclosure and the data protection elements are a  secondary consideration, and only relevant in support of the decision to disclose personal data.

This is why I have concluded all the Recognised Legitimate Interests are unnecessary in DP terms (except for one which we will come to next).   I am quite relaxed about the Recognised Legitimate Interests in the Bill (except for the one which we will come to next) because nothing has really changed.

Real reason for Recognised Legitimate Interests

The Recognised Legitimate Interest  the Government has wanted for some time has been piggy backed on all the others mentioned above.  It reads as follows:

“the processing is necessary for the purposes of making a disclosure of personal data to another person in response to a request from the other person, and

the request states that the other person needs the personal data for the purposes of carrying out processing … [for its public task or in its official authority under UK law].  The actual words used are “…described in Article 6(1)(e) that has a legal basis that satisfies Article 6(3)”.

This means any public body can ask any other controller (usually private sector) to disclose any personal data because they are needed for its functions.

And what is the purpose of this disclosure?  Because other Recognised Legitimate Interests do not apply, this purpose has nothing to do with law enforcement, protecting the vulnerable, national security, defence, public security or emergencies.

In summary, any old purpose will suffice so long as:

(a) it does not fall within the list in the last paragraph and

(b) the controller can claim that it is necessary for the functions of the public body asking for personal data.

And who enforces claims that the data subject has been wronged? Well it’s the ICO (who current policy is not to do much enforcement against the public sector).

In summary, the provision allows any public body to obtain any personal data from anybody else and places responsibility on the ICO to police every voluntary disclosure to the public sector via this provision.

Anybody should be able to see that this is not a viable system of regulation.

As a result, the provision risks degrading into an unregulated,  “free for all”,  voluntary data exchange with the public sector (which, of course, certainly since the ID Card Act debates of 2005, successive Governments have always wanted).

Undermining of the role of Parliament

Parliament has given, for example, HMRC powers to demand personal data; these have been debated and contested.  By contrast, this new voluntary approach negates the need for future debate over statutory powers because, in our example,  HMRC can merely ask via the new voluntary disclosure route.

To explain how this could work, suppose you get the following request from HMRC:

“We are investigating certain matters relating to taxation; can we have a copy of all  your personal data relating to the following list of your employees.  Such a disclosure of personal data would be lawful as it is a Recognised Legitimate Interest”.

So suppose you respond with:

“It would help us to decide whether to disclose if you could give us the further details: […followed by a list of questions pertaining to the disclosure].

Now you get the response:

“We do not want to answer your questions because it could have an impact on our inquiries. We have given you a clear statement that this disclosure is lawful and necessary for our public task. Because the disclosure is a Recognised Legitimate Interest, no reason has to be provided to you.  We confirm that there  is no impediment to your disclosure of personal data to us.”.

So over to you.  Would you disclose?  Is this an invitation to disclose you can’t refuse.

Now I am sure many brave data protection staff would say “no” but the decision to disclose does not depend on the bravado of DPOs.  I am fairly confident that many senior managers will conclude: “We don’t want to upset HMRC,  for the sake of a quiet life and good relations we will disclose”.

In this way, the statutory route for disclosure gives way to the new, possibly  “voluntary” route, where most controllers will “comply with the request”, albeit with gritted teeth.  HMRC’s statutory powers to demand personal data are unused (when Parliament expects them to be used) and held in reserve.

This explains why the first Recognised Legitimate Interest should be removed from the Bill.

Winter Data Protection Courses

Amberhawk is holding our first session on the changes to the UK’s data protection regime arising from the Data (Use and Access) Bill, by Zoom, on Tuesday January 28^th 2025: (10.00am-4.30pm;  £275+VAT).

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course: London on January 20-24 (5 days: Monday to Friday: 9.30am to 5.30pm) and on March 17 to March 21 (same timings).
• Data Protection FOUNDATION Course: London on March 11-13 (Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].

References

House of Lords Delegated Powers and Regulatory Reform Committee, 9th Report of Session 2024–25, HL Paper 49 (28 November 2024).

“Legitimate Interests” for AI Training? Remember the common law of confidence.

There is a current debate as to whether “legitimate interests” can be reliably used as a lawful basis by a controller when using personal data to train/test AI algorithms/systems and when AI systems are deployed.

This blog explains how the common law of confidence and two recent CJEU decisions work together to challenge this assumption.

The first half of the blog explains why “legitimate interests” can work as a lawful basis for AI training/testing in some instances.  In the second half, I explain why, because of confidentiality constraints, “legitimate interests” does not work in general.

What is surprising is that reference to the common law of confidence is absent from the ICO’s guidance on AI.

When does legitimate interest work

Suppose a controller wants to explore the use of AI to make “efficiency savings” (e.g. a euphemism for reducing staff numbers) or to “enhance customer experience” (e.g. making it harder for a customer with a difficult problem to talk to a human).

Suppose further, nothing has changed in the controller’s processing environment except the desire to process its existing collection of personal data in order to explore the potential use of AI (i.e. “proof of concept” processing).

There are four key processing assumptions I am making in during this proof of concept phase; these are:

• the controller ensures that “there is no impact on any data subject of any kind whatsoever”;
• there are no transfers outside the UK and established security/accountability standards are maintained throughout the testing;
• no special category of personal data or criminal offence personal data are processed (as this would involve speculating about the Article.9 (UK_GDPR) or Schedule.1 (DPA2018) requirements); and
• personal data relating to those who have objected to marketing are excluded, if direct marketing is a main objective of the deployment phase of AI.

The CJEU has determined (twice) that a commercial interest of the controller is indeed a legitimate interest (see references). This means that the controller can rely on the legitimate interests lawful basis to assess whether it can improve services and profitability using AI.  In DP terms the “processing is necessary for the purposes of the legitimate interests pursued by the controller” (the first part of the balancing test required by A.6(1)(f)).

At the same time, there is little risk that “such interests are overridden by the interests … of the data subject...” because there is no impact on any data subject.  Put simply, the counter-balancing risk of an overriding interest on the part of the data subject almost vanishes because of the application of the first bullet-point assumption above.

Second there is no need to do a DPIA (A.35).  A DPIA is only needed when the processing “is likely to result in a high risk to the rights and freedoms of natural persons”.   However, as the controller has determined that its own AI proof of concept processing has no impact on the data subject, there is no high risk to any data subject.  A DPIA is unnecessary.

Third, there is no need to worry about the automated decision making provisions (A.22).  These apply when “a decision based solely on automated processing, including profiling… produces legal effects concerning him or her or similarly significantly affects him or her”.  There again, the controller has determined at the outset the proof of concept processing presents no legal/significant effects on any data subject. So no worries then.

Fourth, there are no incompatibility issues (as per A.6(4) and A.5(1)(b)) as the processing for a further purpose is very similar to the purpose of obtaining (e.g. the exploration of how existing services, known to the data subject can be improved by processing personal data using AI techniques).

This is because there is a strong “link between the purposes for which the personal data have been collected and the purposes of the intended further processing” (the test in A.6(4)(a)). Additionally there is no change in “the relationship between data subjects and controller” (test in A.6(4)(b)),  and “the possible consequences of the intended further processing for data subjects” are negated (test in A.6(4)(d)) because there is no impact on any data subject.

Fifth, there should be no problems concerning the data subject’s right to object (A.21).  This arises because the data subject has to present “grounds in relation to his or her particular situation”, and these grounds are going to be difficult to establish if the processing has no impact on any data subject.

Finally, the Transparency/Privacy Notice might need adjusting, but not if it already says something like “we additionally use your personal data to develop or improve our services to you”.

The above analysis works for the proof of concept phase when using ordinary personal data which, as we shall see, are not subject to an obligation of confidence.

Obviously the provisions that are ignored during the testing phase must be considered before the processing moves beyond the proof of concept phase.  Indeed, there would be no point proceeding with any proof of concept processing, if there were to be no lawful basis for the deployment phase itself.

The common law of confidence

Suppose you tell me something in confidence. What are you expecting me to do after you have told me?  Can I use or disclose this confidential information for my benefit without your consent?

In general, a duty of confidence can arise either expressly or by implication if:

• the content of the information possesses the “essence” of confidentiality (e.g. something personal or sensitive for whatever reason), and
• the information has been collected in circumstances where confidentiality can be expected (e.g. in a closed room where you and your GP/solicitor discuss your medical/legal options).

Not all the information imparted is subject to an obligation of confidence, and in general, there needs to be a case-by-case analysis of the specific circumstances surrounding the transfer of information.  Confidential details can easily lose any claim to confidentiality (e.g. if overheard as part of a noisy argument or displayed on a laptop screen when travelling on a crowded train).

In summary, your financial personal data are usually confidential, but not if financial details have been made public on Facebook.  Your medical record is confidential, but your name and address contained in that record might not be confidential.  By contrast, names and addresses of those in witness protection are obviously confidential.

In general, a duty of confidence often arises with the following personal data: financial affairs, tax, benefits, means testing, grants, health, social work, education and policing.  Employee personal data are often confidential (e.g. Occupational Health or disciplinary mechanisms) but your pay grade is unlikely to be confidential (as pay grades are made public in job adverts).

Indeed, special category of personal data and criminal offence personal data are often good examples of confidential personal data.

A breach of confidence

A breach of confidence can arise by a use or disclosure of confidential details for another purpose.  “Disclosure” is widely recognised as a cause of a breach of confidence (e.g. a GP who discusses your medical records in the pub), however much case law relates to “use”.

This historic use case-law often related to the protection of Intellectual Property.  For example, suppose you are a Victorian widget manufacturer (circa 1880).  I come to you with a “super-widget” design and once you have satisfied all my orders, you begin producing a “super-duper widget”, based on my design, in competition with me.  Perhaps you can improve my design – who knows.

The point is that you could only have produced your “super-duper widget” by using the confidential design for my super-widget.  You have not disclosed any confidential information you received, rather you used that information for your benefit instead.

Coming back to data protection, “use” and “disclosure” are “processing” operations.  Hence to use or disclose confidential personal data for other purposes can involve a breach of confidence.

Of course, confidentiality is not an absolute. There are several legal requirements (e.g. Court Order, statutory demand) or public interest reasons (e.g. law enforcement request, protecting children or the vulnerable) where one can lawfully set aside an obligation of confidence in the absence of consent.

However, if these two do not apply, then the only justification for setting aside an obligation of confidence is when the data subject has consented to the further use or disclosure.

This includes using existing confidential personal data for AI training purposes  (and indeed in any deployment phase).

Consequences (CJEU)

There are two decisions of the CJEU that support the above argument. CJEU case 621/22, which concluded that a controller can rely on the legitimate interests lawful basis for commercial reasons so long as the controller ”having regard to all the relevant circumstances, that the interests or fundamental freedoms and rights of those users [a reference to the interests of the data subject] do not override that legitimate interest of the controller”.

In my view, the interests of the data subject in maintaining his or her confidentiality are very likely to override the legitimate interests of the controller who sets confidentiality aside for its own commercial interests.

The relevant conclusion of CJEU case 621/22 added that whilst the legitimate interest pursued by that controller do not require “that such an interest be determined by law, it requires that the alleged legitimate interest be lawful”.

In my view this means that in the UK, the reference to a lawful legitimate interest includes the consideration of the application of the common law of confidence to that legitimate interest.

Concluding comment

It is likely to be difficult to rely on “legitimate interests” as the correct lawful basis if confidential personal data, already processed by a controller, are further used in AI proof of concept processing and in later deployment.

This is because it is usually in the overriding legitimate interest of the data subject to preserve his or her own confidentiality over the commercial interests of the controllers that happen to supply services to the data subject.

Confidentiality constraints, in my view, push one in the direction of consent as the correct lawful basis.

Winter Data Protection Courses

Amberhawk is holding our first session on the changes to the UK’s data protection regime arising from the Data (Use and Access) Bill, by Zoom, on Tuesday January 28^th 2025: (10.00am-4.30pm;  £275+VAT).

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course: London on January 20-24 (5 days: Monday to Friday: 9.30am to 5.30pm) and on March 17 to March 21 (same timings).
• Data Protection FOUNDATION Course: London on March 11-13 (Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].

References

CJEU Case C-252/21  (involving Facebook/Meta)

CJEU Case C‑621/22 (involving Koninklijke Nederlandse Lawn Tennisbond)

ICO’s lawfulness guidance on AI: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-do-we-ensure-lawfulness-in-ai/#purposes