Hawktalk

KC's legal advice supports Hawktalk’s claims of inadequate standards set by DPDI Bill

This is my contribution to the Second Reading (Lords) of the Data Protection and Digital Information (DPDI) Bill which is tomorrow.

First there is a legal opinion, just published by defenddigitalme from Stephen Cragg KC of Doughty Street Chambers. This is accessible from https://defenddigitalme.org/2023/11/28/new-legal-opinion-on-the-data-protection-and-digital-information-bill/ 

This legal opinion reinforces the major concerns raised in my previous blogs on the DPDI Bill.  Collectively these concerns weaken data subjects rights and the privacy protection afforded by the current UK_GDPR. They concern the definition of personal data, data sharing, third party marketing and scientific research/AI.

The changes mentioned below have not been debated fully in the Commons because of the strict time limits imposed by Government on these proceedings (e.g. 3hrs to debate 125 pages of Government amendments at Report stage).

Four concerns

The four concerns in the blog that overlap with the legal opinion are:

First, the definition of “personal data” results in a level of protection below that established by the DPA1984 and Council of Europe Convention No 108. This has the potential to result in great divergence from the European standard for data protection and threaten the UK’s adequacy agreement with the EU.

Readers might remember the problems raised by the Durant judgement which narrowed the scope of “personal data” under the DPA1998.  Here the European Commission commenced infraction proceedings that the DPA1998 was not a proper implementation of Directive 95/46/EC.  I should add that repeated FOI requests to the detail of these proceedings, two decades on, are still being refused.

Messing with the definition of personal data, as the DPDI Bill does, messes with all the data subject rights, Principles and obligations in the UK_GDPR.  That is why this undebated definitional change that weakens its scope is so fundamental to the level of data protection afforded by the UK’s DP legislation and the Adequacy Agreement with the EU.

Detail of the definitional changes can be found on https://amberhawk.typepad.com/amberhawk/2023/04/definition-of-personal-data-in-dpdi-no-2-bill-results-in-non-compliance-with-coe-convention-no108.html

Second,The powers that facilitate voluntary data sharing with (or between) any public body that asks for the personal data is a power grab by Ministers to define, that at any future time, any disclosure of personal data to any public body can become is lawful and compatible. It does not matter what the purpose of the processing is, so long as it falls within the official remit of the tasks of the asking public body the disclosure is a “Recognised Legitimate Interest”.

The provisions are so broad that they even encompass the other DWP personal data grab that can demand banking personal data of benefit claimants (including pension and child benefit claimants).  These compulsion powers are unnecessary as the DWP could easily use the extensive voluntary route proposed by the Bill.

Additionally, there is no evidence that the voluntary approach, touted by Government has failed. Hence it follows that the DWP’s justification for its major personal data grab is being made in the absence of any evidence that these ominous powers are required.

Grim detail on: https://amberhawk.typepad.com/amberhawk/2022/08/voluntary-disclosure-to-hmrc-always-lawful-and-always-compatible.html

Third, The changes associated with marketing are likely to result in a spammers’ charter for work email addresses. Collections of  harvested work email addresses can be used or disclosed (or transferred) for third party marketing on the basis of that third party’s “legitimate interests”. The right to object to marketing is much diminished and the Bill overturns the consent requirements for Third Party marketing that were established thirty years ago.

Detail on: https://amberhawk.typepad.com/amberhawk/2023/05/dpdi-no2-bill-dumps-all-data-subject-consent-requirements-for-third-party-marketing.html

Fourth, Scientific research is redefined to include AI training and development. The Bill permits large databases of personal data to be used, disclosed and transferred (including outside the UK) for AI training and development without the knowledge of the data subject (let alone their consent).

Grim detail on: https://amberhawk.typepad.com/amberhawk/2023/10/dpdi-no-2-bill-undermines-transparency-of-artificial-intelligence-development-and-training.html

“Brexit bus numbers”

Government Ministers are continuing to spout nonsense numbers about projected savings arising from the DPDI Bill. To show this, I recently asked the ICO for details of notified controllers.  The response shows that the current notification figures are as follows:

• Tier 1 – 1,068,221 controllers; maximum turnover of £632,000 or no more than ten members of staff.
• Tier 2 – 108,934 controllers; maximum turnover of £36 million or no more than 250 members of staff.
• Tier 3 – 7,001 – large controllers; more than 250 staff or greater than £36 million turnover.

Now apply the above numbers to recent Ministerial statements given to Parliament that “justify” the legislative proposals.

Minister: “We are expecting micro and small businesses to save nearly £90 million in compliance costs every year: that is £90 million more for higher investment, faster growth and better jobs”. (2^nd reading DPDI, Hansard, 17/4/23 at col 69). £90 million per year is £900 million per decade (or £0.9 billion; this figure used later).

However, there are approximately 1.07 million Tier 1 small and medium sized controllers notified with the ICO.  This means that the “micro and small businesses to save nearly £90 million in compliance costs every year: comes to just under £90 per year per small business or  £1.61 per week per SME”.

Could be wrong, but I don’t think you get much investment and growth for £1.61 per week – except for a half a cappuccino from the local cafe.

The Minister at Report stage in the Commons: “Taken together, we believe these amendments will benefit the economy by £10.6 billion over the next 10 years. That is more than double the estimated impact of the Bill when it was introduced in the spring” (Report DPDI, Hansard, 29/11/23 at col 872).

To get an upper limit of these savings, assume all these savings are concentrated on Tier 2 and Tier 3 controllers (turnover greater than £632,000).  The ICO shows that there are 116,000 of them and the projected savings are £1.06 billion per year (but remember to subtract the SME savings of £0.09 billion stated above).

It can be seen that the projected £0.97 billion savings per year (£1.06-£0.09) represents an the average saving per controller of around £9,000 per controller.

In other words, for Tier 2 there is a saving of a maximum of 0.03% of turnover if the controller’s turnover is £32 million.  In other words, the touted savings are still insignificant.

Rwanda

Finally, to Rwanda.  The Safety of Rwanda (Asylum and Immigration) Bill defines Rwanda as safe for the transfer of migrants who risk their lives to arrive in those small boats.

However, Rwanda has not been identified as a territory that offers adequate level of protection for the transfer of personal data from the UK.  Hence Rwanda is unsafe for the general transfer of personal data concerning migrants to Rwanda, but is safe for the transfer of the migrants themselves.

You cannot make this stuff up.

Forthcoming Data Protection Courses in 2024

Our well received, all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information Bill will next be held on Thursday 29 February  2024.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London on Monday, 15 January 2024 to Friday, 19 January 2024 (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (April 9-11, 2024: Tuesday to Thursday, 3 days: 9.45am to 5.00pm)

Full details on Amberhawk’s website (www.amberhawk.com) or  obtained by emailing [email protected].

DPDI No.2 Bill dumps all data subject consent requirements for Third Party marketing

The DPDI No.2 Bill (the “Bill”) overturns the Third Party direct marketing rules in relation to data subject’s consent that have applied for 40 years, ever since the DPA1984.  This blog illustrates how Third Party marketeers will be able to lawfully rely on legitimate interest for such marketing.

For the purposes of this blog, the old ICO DPA1988 Guidance on the processing of personal data for a direct marketing purpose had a useful summary concerning the use of data subject’s consent.  This summary is unchanged by the UK_GDPR except consent has to be obtained by “opt-in”.

“Consent is central to the rules on direct marketing. Organisations will generally need an individual’s consent before they can send marketing texts, emails or faxes, make calls to a number registered with the TPS, or make any automated marketing calls under PECR.

They will also usually need consent to pass customer details on to another organisation under the first data protection principle.  If they cannot demonstrate that they had valid consent, they may be subject to enforcement action.”

For convenience, I have modified this summary to highlight the proposed legislative changes in the Bill:

“Legitimate interests is central to the rules on direct marketing. It is best practice for organisations to provide an opt-out to an individual before they can send marketing texts or emails to their customers, or pass customer details on to another organisation for their marketing purposes.

In many circumstances, especially where personal data is collected from publicly available sources, the information concerning the opt-out can be sent with the first marketing message.  Consent for a marketing purpose will only be required in exceptional circumstances (e.g. when using health personal data for a marketing purpose; sending an unsolicited email marketing message to a domestic email address).

This blog explains how the Bill achieves the above.

Changes to the UK_GDPR

Direct marketeers prefer “opt-outs” for marketing (e.g. “tick the box if you don’t want marketing”); by contrast, European DP regulators insist that consent for the marketing purpose should be an “opt-in” (e.g. “tick the box if you want marketing”).   As the lawful basis of “consent” requires an “opt-in”,  it follows that “legitimate interests” lawful basis, if used, can be satisfied with an “opt-out”.

This impasse has not been helped by the text of Recital 47 of the GDPR which supports claims for using “opt-out”.  The Recital includes the statement that “The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest”.

So what does that “may” mean?  Should that “may” be interpreted as allowing “legitimate interests” to be used only in “exceptional” circumstances (e.g. where obtaining data subject consent is impractical) or can legitimate interests apply in “most” circumstances  (e.g. as an alternative to obtaining data subject consent)?

The data protection regulators prefer the former, the direct marketing lobby prefer the latter.

The Bill has no truck with this divergence of views. It has determined that the legitimate interests lawful basis is satisfied if the processing of personal data is for a marketing purpose. (See the proposed new Article 6(9) of the UK_GDPR).

In further detail,  the lawful basis in Article 6(1)(f)  [..“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data”] is satisfied if specific processing of personal data is designated as being “necessary for the purposes of a legitimate interest”.

Such designated processing includes “processing that is necessary for the purposes of direct marketing” (my emphasis on is).  This “is” also means that no Legitimate Interest Assessment is required to balance the competing interests between controller or third party versus data subject.  The matter has been resolved in favour of processing of personal data for the marketing purpose.

Note that the Bill does not limit the application of legitimate interests to a marketing purpose undertaken by the controller who first collected the personal data directly from the data subject.  The provision is so generously drafted that it allows “necessary for the purposes of a legitimate interest” to apply to any Third Party marketing.

It follows that Third Party marketing can be legitimised by an opt-out.  Thus ending a four decade requirement that a controller indulging in Third Party marketing has to obtain data subject consent for that Third Party marketing.

Recognise that controllers are going use legitimate interest for its marketing wherever possible as this lawful basis is devoid of all the consent baggage which protects data subjects (e.g. it is as easy to provide consent as to withdraw consent;  evidence of consent).

Obtaining personal data from the data subject?

The rights and interests of the data subject as specified in A.6(1)(f) are the right to be informed about the marketing purpose (in A.13 and A.14) and the right to object to marketing (in A.21).  These are taken into account by offering an opt-out in every marketing communication with the data subject.

In addition, if a controller is obtaining personal data directly from the data subject, this opt-out has also to be provided before or at the time of collection.  This now includes any opt-out from any Third Party marketing purpose.

Fairness under the First Principle (of A.5) still requires the opt-out box to be prominently positioned but if the box is missed by a data subject, then the default position is that the data subject will be sent all controller (and any Third Party) marketing as described in the right to be informed/privacy notice, until the data subject reverses this position.

Finally in this section, those of you who fondly remember the DPA1984 and DPA1998, will look forward to re-engaging with the game of “Where’s Wally?”.  The “Wally” in question is identifying the location of the opt-out box that one has to tick before completing the rest of the form.

Obtaining personal data from elsewhere

But what happens in other circumstances when the personal data are obtained not from the data subject?  For example, suppose I trawl through an organisation’s public facing website picking up staff names and business email or postal addresses.

Usually, if one has the name of a member of staff  (e.g. Fred Bloggs) and the work place domain (e.g. domain.com) one can usually deduce a likely email address for each employee (e.g. [email protected]).

Such email addresses are personal data but the PECR marketing rules do not apply as the addresses hoovered up (or generated) do not belong to individual subscribers.

As the personal data have been obtained from a source other than the data subject (e.g. from the company website), notification of the marketing purpose can be sent at same the time as the marketing message.

This is because Article 14(3)(b) states the controller can provide the right to be informed/privacy notice  “at the latest at the time of the first communication to that data subject”.  The first communication in this case being the marketing message plus the related opt-out details.

Hopefully the recipient of such an email at work will be diligent enough to find what these opt-out arrangements are.  If the communication is deleted unread, then further legitimate interest marketing emails (including any unticked opt-out Third Party emails) will continue to arrive in the Inbox.  Spam in the work-place is therefore set to increase.

Suppose another company  wants to use home address personal data for a postal marketing purpose.  So long as they do not collect the home addresses directly from the data subjects concerned,  they too can indulge in informing the data subject and provide an opt-out with their first marketing communication.  There again, if one fails to respond to the opt-out invitation then such marketing will continue until you do so.

The Third Party opt-out rules will also apply to your home and work phone numbers, so I would consider putting them both on the Telephone Preference Service.  However, if you sign up for a service, make sure you do not miss any associated opt-out of Third Party telemarketing.

If you miss it and return an unticked opt-out “approving” Third Party marketing, then TPS is unlikely to automatically save you from unsolicited telephone marketing: the missed Third Party opt-out could be enough to make those Third Party marketing calls legitimate.

No longer unfair

The old DPA1998 guidance stated that marketeers “… will also usually need consent to pass customer details on to another organisation under the first data protection principle”.

It is important to explain why this requirement will not apply with the Bill, as the ICO had previously employed an “unfair processing” argument to arrive at the requirement for data subject consent for Third Party marketing.

There are three main reasons why this approach does not work under the Bill:

• First the legitimate interest lawful basis makes the processing for a Third Party marketing purpose unequivocally and explicitly lawful; the statement in new A.6(9)  that the “processing that IS necessary for the purposes of direct marketing” makes sure of that.  If Parliament has determined that processing for a Third Party marketing purpose IS lawful, any unfair processing is not going to make that processing also unlawful.
• Second, the A.14(3)(b) requirement to send the right to be informed/privacy notice at the time of first communication with the data subject is satisfied, and the right to object requirement is offered as an opt-out so all the relevant rights of data subjects are respected. Hence the processing cannot be unfair on these grounds.
• Third, the DPA1998 and DPA1984 had a statutory interpretation of fairness that is absent from the UK_GDPR, and the fairness arguments associated with the previous legislation did not have to deal with the statutory provisions described in the two previous bullets. In other words, the changes made by the Bill will negate or distinguish the relevance of previous Tribunal precedents on data subject consent for Third Party marketing.

In general, I think the issue of “fairness” will be reduced to procedural irregularities and issues such as the opt-out box is not in the correct location, or the opt-out box is not prominent, or the box is a small type-face etc.  Fairness, in my view, will no longer require prior consent unless the legislation itself demands consent (e.g. as in some limited email marketing under PECR).

Concluding comment

It is clear to me the “legitimate interest” changes proposed by Government are a disaster; it risks a spammers charter.  And that is before any consideration of the expansion of the “soft-opt in” (which really is an opt-out) for individual subscriber emails.

The Bill's Third Party marketing proposals are either wholly careless or deliberate.  If it is the former, one wonders what other horrors in the Bill have been carelessly drafted.  If it is the latter, one wonders how much in donations have been promised to the ruling political party.

Data Protection Courses (Summer 2023)

An all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill. Will be held on Thursday 13 July  2023 hopefully to include changes made during the Committee stage of the Bill.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection FOUNDATION Course is on Zoom only (June 20-22 2023 (Tuesday to Thursday, 3 days: 45am to 5.00pm).
• The next Data Protection PRACTITIONER Course is in London on Monday, 24 July 2023 to Friday, 28 July 2023 (5 days: 9.30am to 5.30pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing [email protected].

Cartoon: Data Protection Regulators as guard-dogs; spot the British breed!

 

Please look at this cartoon in the context of the blog posted below of the same date

References:

The Cartoon is lifted from a presentation in 2006 from a European Commission data protection official: http://www.abgs.gov.tr/tarama/tarama_files/23/SC23EXP_Protection%20of%20Personal%20Data.pdf

 

Two dozen cartoons about Privacy and FOI

Oh dear. After a long break, I somehow can’t be asked. However, I have to start somewhere.

One of the things we do at Amberhawk is review the last year and the year to come. We decided to refresh the web-site with a dozen or so new Chris Slane cartoons, so if you want to have a look and a Friday  laugh (hopefully), please click on Cartoons button on the blog (top left).

Wishing you well; serious blogging starts next week.

Leaked GCHQ Xmas Card resonates to Tolkien as Advocate General slams Data Retention Directive as breaching ECHR

 

I have just received from the Dark Web, a samizdat copy of GCHQ’s Xmas card complete with cartoon from Chris Slane. The references (see below) provide a download of the complete Xmas card, which presumably can be printed out on cardboard in hard copy.

I think we can assume that the card is genuine as it contains the exemption notice from the FOIA regime which I came across when I sought access to an unrestricted document (“HMG IA Standard No.6: Protecting Personal Data and Managing Information Risk”).

The exemption under FOIA means that although the Xmas Card is information originated from GCHQ, posted insecurely in the ordinary post,  and is clearly marked "unrestricted", the tax payer who pays for the Card cannot get a copy under FOIA (just like the HMG No 6 standard).

The card also contains a poem which is a parody of the poem which describes all 20 Rings of Power, as found in Tolkien’s book (the Lord of the Rings). The Poem goes as follows:

                    The Terror Bytes of Power

Two terabytes per day to retain all Google searches

Five keeps the content from surveillance perches

Seven for Skype when one speaks to mates

Twelve stores the traffic which flows to the States

And in the darkness where the watchers are

Few laws to obey; nor rules that bar

And for privacy let the protection die

In a secret state where the shadows lie.

In the meantime, the Advocate General (the leading legal advisor to the European Court of Justice has asked for the European legislature to re-draft the Data Retention Directive (which calls for the retention of metadata of all electronic communications to be retained for two years) as being in breach of Article 8 of the ECHR (right to a private and family life). This, of course, has been known to most of us for ages.

However, I want you to think about the Snowden revelations and then look at what the Advocate General points out, in this regard. He says that the use of telecoms data in accordance with the Data Protection Retention Directive:

• “may make it possible to create a both faithful and exhaustive map of a large portion of a person’s conduct strictly forming part of his private life, or even a complete and accurate picture of his private identity.”
• “There is, moreover, an increased risk that the retained data might be used for unlawful purposes which are potentially detrimental to privacy or, more broadly, fraudulent or even malicious”.
• “Indeed, the data are not retained by the public authorities, or even under their direct control, but by the providers of electronic communications services themselves. Nor does the Directive provide that the data must be retained in the territory of a Member State. They can therefore be accumulated at indeterminate locations in cyberspace”.

The European Union legislature:

• “should, in particular, have provided a more precise description than ‘serious crime’ as an indication of the criminal activities which are capable of justifying access of the competent national authorities to the data collected and retained”.
• “should have guided the Member States’ regulation of authorisation to access the data collected and retained, by limiting access, if not solely to judicial authorities, at least to independent authorities, or, failing that, by making any request for access subject to review by the judicial authorities or independent authorities and it should have required a case-by-case examination of requests for access in order to limit the data provided to what is strictly necessary”.
• “could have been expected to lay down the principle that Member States may provide for exceptions preventing access to retained data in certain exceptional circumstances or may prescribe more stringent requirements for access in situations in which access may infringe fundamental rights guaranteed by the Charter, as in the context of the right to medical confidentiality”.
• “should have established the principle that the authorities authorised to access the data are required, first, to erase them once their usefulness has been exhausted and, second, to notify the persons concerned of that access, at least retrospectively, after the elimination of any risk that such notification might undermine the effectiveness of the measures justifying the use of those data”.

The Advocate General has not found, “in the various views submitted to the Court of Justice defending the proportionality of the data retention period, any sufficient justification for not limiting the data retention period to be established by the Member States to less than one year” (AG emphasis).

So it looks as if the year is ending on a powerful note for those who think that privacy needs an uplift in data protection; one hopes the powers that be are listening and effective changes to the protection afforded when we use the Internet will appear in the New Year.

On that optimistic note, I say have a happy holiday and recharge your batteries for what should be an eventful year. We do live in “interesting times”.

Hawtalk will be back in the New Year.

References

My run in on S.23 for FOIA (information originating from GCHQ) http://amberhawk.typepad.com/amberhawk/2010/12/as-gchq-keeps-tabs-on-foi-requestors-what-does-national-security-mean.html

The GCHQ Xmas Card can be loaded here Download GCHQ XMAS 2013 card

Advocate General Press Statement: : http://malte-spitz.de/wp-content/uploads/2013/12/CP130157EN.pdf

;

Cartoon to celebrate the "Black Friday Sales"

© Chris Slane

 

Cartoon: Keep up to date on Data Protection

This brief blog  is to alert you to our UPDATE day in London 

(Monday, October 28th) where I think I have compiled a very

interesting program – in fact the best so far. Speakers include

Tim Pitt-Payne QC on Monetary Penalty Notices, Rosemary

Jay on latest legal cases, Martin Hoskins on Privacy Impact

Assessments, Nick Pickles from BigBrotherWatch on “Big Data”,

and a speaker from the Law Commission on its data sharing 

consultation. The cost of the day session is £225+VAT 

(details on http://www.amberhawk.com/bookevents.asp).

At the end of the day, UPDATE delegates are invited to stay

for a short reception to launch Amberhawk Associates; our new

consultancy arm. Amberhawk Associates are a group of well

known, experienced information law practitioners who have

decided to pool their diverse skills.

 

 

Cartoon: Hawktalk is back towards the end of August

 

©Chris Slane

I need a holiday. So do you! See you towards the end of August

Messages

Data Protection intensive ISEB course in Edinburgh (commences 25th October). Freedom of Information intensive ISEB course in Manchester (commences September 21).

The Agenda for the Data Protection Update, on 17th October 2011 in London is on our web-site; the cost £195+VAT for the day. We also have in London a  Data Protection Audit course, a  Privacy Impact Assessment course: and Regulation of Investigatory Powers Act Course held on 12, 13 and 14 September. £400+VAT for the day per delegate.

You can book all these events online via  the “Events” section of the Amberhawk web-site.

Cartoon: with recent data losses in mind

 
                                                         ©Chris Slane

Advert. Forthcoming courses: Data Protection: London from May 10th; Manchester starts on 12th May.    FOI starts in London on 13 June.  Includes ISEB syllabus. Next Update is October 17th 2011 in London. We have timetabled our Audit, Privacy Impact Assessment, and RIPA courses for September 12th, 13th and 14th in London. Full details on the Amberhawk main site (www.amberhawk.com)

 

Catoon to celebrate the Internet

                                                                                           ©Chris Slane

Advert:  UPDATE session, April 11th, Central London: a snip at £195+VAT. Automated booking available on www.amberhawk.com

Programme

“What might a new data protection regime look like? What might the main changes be?”; Stephen McCartney, Strategic Liaison Group Manager, ICO

"Freedom of Information decisions on the personal data exemption"; Sue Cullen, Amberhawk

"Legal Update (Article 8, Enforcement and Data Protection Act)"; Rosemary Jay, Partner, Pinsent Masons

"Data Protection from the other end of the telescope: a view from the data processor (including the cloud)”; Louise Townsend, Accenture, Data Privacy Officer (UK and Ireland), Legal Counsel

"What’s new from the ICO’s website"; Sue Cullen, Amberhawk

"What’s new re Undertakings, Audit and Assessment" and "News Roundup"; Dr. Chris Pounder, Amberhawk