Hawktalk

Facial recognition CCTV excluded from new data protection law by definition of “personal data”

I have come to the conclusion that the new definition of personal data in the Data Protection and Digital Information No.2 Bill (“No.2 Bill”) only applies to facial recognition CCTV if the data subject is on a watch-list.

If the individual is not on a watch-list, and the camera images are deleted immediately after checking the watch-list, then personal data are not processed and there are no data protection obligations (e.g. no transparency)

It then follows that if the watch-list, for example, involves details of criminals wanted by the police, many facial recognition systems will process personal data in total secrecy (i.e. no transparency).

This blog explains how the No.2 Bill’s definition of personal data moves such facial recognition CCTV systems into the twilight zone.

Suppose a facial recognition CCTV system is linked to a watch-list of suspects whose facial features have already been digitised (perhaps using the digitised biometric images derived from passport photographs).

Obvious examples of such watch-lists are: (a) a list of those who are of interest for law enforcement purposes or (b) those who commit a crime if they enter a specific area (e.g. those who have been excluded from entering a specific shop).

Suppose further, such a CCTV system is set up in a shopping centre and performs facial recognition on everybody who passes any of the system’s cameras.  The system sends a warning message to the camera operator if someone, on the watch-list, passes the camera; the system also retains the relevant images and other details of the encounter.  Only personal data of those on the watch list are retained.

The system is so designed that the details of those who are NOT on the watch list are not retained (i.e. deleted instantaneously) after the check against the watch-list is complete.

Bridges v South Wales Police

The system described above is the one that featured in the Court of Appeal judgement (Bridges v South Wales Police: paragraph 9, see references).  In this case, the data protection regime (in the DPA1998 and the pre-Brexit GDPR/DPA2018) was fully engaged because the Court determined that “personal data” were being processed about every individual whose image was captured by a Facial Recognition CCTV camera.

In the Bridges case, the Court’s interpretation of the definition of personal data was crucial.  This was derived by reference to Recital 26 of the pre-Brexit GDPR (or to Recital 26 of Directive 95/46/EC when the DPA1998 applied). These Recitals specified that if the information processed related to a living individual who was being singled out, then “personal data” were being processed.

Paragraph 46 of the Bridges judgment makes this point clear.  It states:

46. The primary point of dispute before the Divisional Court under the DPA 1998 was the extent to which using AFR Locate [the name used for the Facial Recognition CCTV system] entails processing personal data, SWP [South Wales Police] contending that the only personal data processed is the data of persons on the watchlist on the ground that it is only those persons that SWP can identify by name.

Having referred to the judgment of the Court of Appeal in Vidal-Hall v Google Inc [2015] EWCA Civ 311, [2016] QB 1003, and to the decision of the CJEU in Case C-212/13 Rynes v Urad [2015] 1 WLR 2607, the Divisional Court concluded (at [122]) that the processing of the Appellant’s image by the AFR Locate equipment was processing his personal data because the information recorded by AFR Locate individuated him from all others, that is to say it singled him out and distinguished him from all others.  (My emphasis).

As we shall see, “singling out” is NOT found in the new statutory definition of “personal data” in the No.2 Bill, and it is this omission that has significant consequences (i.e. SWP’s arguments in the first part of paragraph 46 as quoted above become correct).

Recitals are not law

The definition of personal data in the No.2 Bill is at first sight unchanged: “Personal data” means any information relating to an identified or identifiable living individual.  However, the No.2 Bill introduces the concept of direct or indirect identification of the individual into the statutory definition.

This new statutory definition, which also does not meet the standard of the Council of Europe Convention No 108 set in 1981 (see references), makes sure that the interpretation in Recital 26, as used in Bridges), is largely redundant.

This is because the Recitals themselves have no legal effect in the UK.  This was established in the case of Sanso Rondon v LexisNexis (see references), when the Court invalidated a requirement in Recital 80 (namely “the designated representative [of a controller or processor established outside the UK (or EU)] should be subject to enforcement proceedings in the event of non-compliance by the controller or processor”).

The Court came to this conclusion because the requirement was found only in Recital 80 and was not explicitly linked in any obligation in any Article of the GDPR.  That is why the Court concluded that, in relation to the liability of the representative for non-compliance (e.g. by a controller):

“…if the GDPR had intended to achieve 'representative liability' [for non-compliance as specified in Recital 80] then it would necessarily have said so more clearly in its operative provisions [i.e. the Articles of the GDPR]…(paragraph 101).

In other words, the Recitals are there to help interpret the legislation if there is doubt as to what the statutory requirements in an Article mean.  If a provision described in a Recital is not echoed in a relevant Article, then the interpretation in the Recital can be invalid.

In summary, the requirement for “singling out”, although it remains in Recital 26, it is not supported by any “operative provisions” found in the new statutory definition of “personal data”.  To the contrary, the new “operative provisions” of the definition work to exclude any prospect for “singling out”.

DPDI definition of “personal data”

The No.2 Bill additionally requires that to be “personal data”, there has to be a living individual who is directly or indirectly identifiable; in the latter case, indirect identification has to be at the time of the processing and by using reasonable means.

This raises three additional questions to be answered before the processing of “personal data” by a CCTV system, similar to that under discussion, can be confirmed.

The first question is:  ‘Are individuals identified “directly”?’.  The No 2 Bill requires that “An individual is identifiable from information “directly” if the individual can be identified without the use of additional information”.

Clearly, in the case of facial recognition CCTV, the answer is NO.  This is because additional information has to be used to perform the identification of those images captured by a facial recognition CCTV system (e.g. the pre-recorded details of those on the watch-list).

In other words,  direct identification, is not relevant because identification of a living individual (on or off the watch list) requires "the use of additional information" (contrary to the definition of direct identification).

The next question is: ‘Are individuals identified “indirectly” as defined?’.  The No.2 Bill states that “An individual is identifiable from information “indirectly” if the individual can be identified only with the use of additional information”.

Clearly, the answer is YES as additional information is available as part of the CCTV system to identify those individuals on the watch-list.

But what about those NOT on the watch-list?

This question is answered by the third question in the series: “Is indirect identification easy to do “at the time of the processing” and by “using reasonable means”  (Clause 3A(2) requires “the living individual is identifiable .… by the controller or processor by reasonable means at the time of the processing”).

In this case, for those not on the watch-list, there are no reasonable means of achieving identification available at the time of the processing (e.g. from the time of collection by a camera, checking the watch list, and then its instantaneous deletion).

There are three main reasons for this conclusion:

• first, there is no “additional information” that is available by “reasonable means… at the time of the processing” in the CCTV system itself (or held by some other person);
• second, the image of the individual and related biometrics have been deleted almost instantaneously, so there is no need for additional information to perform the unwanted indirect identification;
• finally it would be unreasonable to ensure the Facial Recognition system retained details of individuals not on the watch-list. The far more reasonable proposition is to protect the interests of such individuals is by deleting their personal details instantaneously, as such deletion guarantees their privacy.  In addition,  the captured details cannot be further processed for purposes other than the original check of “is this individual on the watch-list?”.

In addition, Article 11 of the UK_GDPR specifically states that additional information is not required to be collected.  It says:

A.11(1) “If the purposes for which a controller processes personal data do not … require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation. (My emphasis to show that this is the case when an individual is not on the watch-list).

Hence, there are no data protection obligations placed on those data that concern those whose images are collected and then instantaneously deleted because the individual is  NOT on the watch list.  Quite simply, such a CCTV system does not process personal data (as newly defined) in these circumstances.

The data protection regime of the No.2 Bill only applies to those on the watch list.

Why secret CCTV facial recognition systems?

As a facial recognition system is not processing personal data if an individual is NOT on the watch list,  then there is no need to be transparent as the UK_GDPR does not apply.  There is no need for a lawful basis nor a condition to overcome the processing of Special Category of Personal Data as the information processed is not personal data.

Transparency is only needed for data subjects on a watch list.  However,  there are a number of exemptions in the DPA2018 that provide the controller relief from the need to be transparent if being transparent would prejudice the crime, taxation, immigration or law enforcement purposes etc (e.g. Schedule 2, paragraphs 2 or 4; Section 44 of the DPA2018).  Hence there is no need to be transparent in these cases also.

It follows that many facial recognition CCTV systems can be installed without any transparency obligations and used more or less in secret.  As stated at the beginning of the blog, they enter the data protection twilight zone.

As this is the case, expect the number of Facial Recognition systems to mushroom exponentially after the enactment of the No 2 Bill.

References

Edward Bridges and -the Chief Constable of South Wales Police: Neutral Citation Number: [2020] EWCA Civ 1058

Sanso Rondon v LexisNexis; Neutral Citation Number: [2021] EWHC 1427 (QB)

Definition of “personal data” in DPDI No 2 Bill results in non-compliance with CoE Convention No.108: https://amberhawk.typepad.com/amberhawk/2023/04/definition-of-personal-data-in-dpdi-no-2-bill-results-in-non-compliance-with-coe-convention-no108.html

Data Protection Courses (Summer 2023)

An all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill. Will be held on Thursday 13 July  2023 hopefully to include changes made during the Committee stage of the Bill.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection FOUNDATION Course is on Zoom only (June 20-22, 2023 (Tuesday to Thursday, 3 days: 45am to 5.00pm).
• The next Data Protection PRACTITIONER Course is in London on Monday, 24 July 2023 to Friday, 28 July 2023 (5 days: 9.30am to 5.30pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing [email protected].

Voluntary disclosure to HMRC? Always lawful and always compatible

This blog questions how the Data Protection and Digital Information Bill (the “Bill”) impacts on the lawfulness and compatibility of any further processing by a controller, in particular, a controller that voluntarily discloses personal data to HMRC.  This worked example illustrates how this Bill further undermines the current level of protection afforded to data subjects.

In summary, the Bill allows HMRC to lawfully obtain personal data for its purposes via voluntary disclosure from any controller;  such disclosures can occur even when:

• there is no “public interest” component to a particular disclosure to HMRC and
• where a particular disclosure is not associated with any specific HMRC investigation (i.e. a failure to disclose does not prejudice HMRC’s collection or assessment of tax).

If these changes are enacted, it will become difficult for the data subject (or ICO) to claim that there has been unlawful processing of personal data by HMRC.

Although the example used is a disclosure to HMRC,  similar issues arise with voluntary disclosures of personal data to any law enforcement agency pursuing a criminal investigation, especially those agencies which bristle with information collecting powers (e.g. DWP).

As usual, the Explanatory Memorandum to the Bill does not touch on the subject matter of this blog (e.g. why is voluntary disclosure to be expanded in this way?); perhaps it is designed to be an Unexplanatory Memorandum.

The current compatibility test

Before describing the changes made by the Bill, it is worth understanding how the Purpose Limitation Principle and the compatibility assessment work together when disclosures to public bodies (e.g. to HMRC) occur under the current UK_GDPR regime.

The Purpose Limitation Principle requires personal data to be “collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes” (my emphasis).

So if a controller has collected personal data and is then asked to disclose such data to HMRC for its purposes, the relevant “further” processing specified by the Principle is the controller’s disclosure to HMRC for its tax purposes.

The key issue in this Principle is whether such a disclosure is “incompatible” or not.  This question is answered using the provisions of Article 6(4) which provides three options as to whether that further processing is incompatible.

In our example (voluntary disclosure to HMRC for tax purposes), the further processing is NOT incompatible if the processing:

• has the consent of the data subject
• constitutes “a necessary and proportionate measure … to safeguard …. any of the objectives referred to in Article 23(1)” (this is a reference to the possibility that a disclosure can satisfy an exemption specified in Schedule 2 to 5 of the DPA2018), or
• passes the compatibility assessment test (also detailed in A.6(4)). This considers, for instance, the nature of the personal data disclosed, the relationship between the disclosing controller and data subject, the impact on the data subject of the disclosure etc.

As there is an applicable exemption in Schedule 2, paragraph 2 of the current DPA2018 that covers all HMRC’s tax processing, it is the second bullet point that applies.

In further detail, this tax exemption can exempt any data subject right, the Lawfulness, Fairness and Transparency Principle and the Purpose Limitation Principle,  if application of any of these rights or Principles would “prejudice the assessment or collection of tax or duty”.

Thus before a controller volunteers disclosure to HMRC, HMRC would have to assert that a failure to disclose would prejudice these matters (e.g. collection of tax).  Once this assertion is documented, then the Purpose Limitation Principle is exempt and compatibility does not need to be considered by the disclosing controller.

Note that if there is “no prejudice” (i.e. the exemption does not apply) and in the absence of data subject consent, then the disclosure is likely to be incompatible in breach of the Purpose Limitation Principle.  It is this restriction that the Bill seeks to lift (i.e. make all voluntary disclosures of personal data compatible, in the absence of data subject consent and, without the application of the taxation exemption).

For completeness, the voluntary disclosure by the controller to HMRC has a lawful basis if the exemption applies. It is in “the public interest” as the HMRC are investigating (it’s in the public interest to catch tax evaders) and the disclosure is to another person (the HMRC) who has a function conferred on it by an enactment; namely Article 6(1)(e).  The gory detail of this position can be found in my previous blog.

What are the Bill’s changes?

In summary, the Bill introduces two Annexes:

• Annex 1 provides an A.6 lawful basis for a disclosing controller to make these voluntary disclosures (e.g. to HMRC); the new construction avoids the application of a “public interest” test to a particular disclosure of personal data (also explained in my previous blog).
• Annex 2 exempts the Purpose Limitation Principle in all circumstances (e.g. even when there is no prejudice to HMRC’s tax functions).

First, however, new Article 8A introduced into the UK_GDPR by the Bill, states that the processing is automatically compatible if “the processing meets a condition in Annex 2”.  Annex 2 comprises a list of 11 conditions including taxation and law enforcement.

In the context of a voluntary disclosure to HMRC, Annex 2 provides two options for this disclosure.

Option 1 disclosure

The first option occurs when:

• “the processing is necessary for the purposes of making a disclosure of personal data to another person in response to a request from the other person” (e.g. in our example, the HMRC is the “another person” asking for a controller to disclose to it).
• “the request states that the other person (in our example, this is HMRC) needs the personal data for the purposes of carrying out processing that”—
  • “is described in Article6(1)(e)”  (e.g. for HMRC’s public task)
  • “has a legal basis that satisfies Article6(3)”  (e.g. HMRC’s public task is the functions bestowed on it by enactment), or
  • “is necessary to safeguard an objective listed in Article23(1)(c) to (j)”.  (Article 23(1)(e) explicitly refers to exemptions needed for “taxation matters”).

As there is an applicable exemption covering taxation matters in Schedule 2, paragraph 2 of the current DPA2018, one can see that Option 1 covers disclosures to HMRC in circumstances similar to the current arrangements but in the absence of “public interest” considerations.

So any controller volunteering personal data to HMRC via Option 1 does not need to consider the compatibility arrangements.

Option 2 disclosure

The second option is in Annex 2, paragraph 10.  Under the heading “Taxation”, the paragraph states that “This condition is met where the processing is carried out for the purposes of the assessment or collection of a tax or duty or an imposition of a similar nature”.

So why have two conditions that apply to disclosures to HMRC?  Well, if one condition applies when an exemption applies to the disclosure (Option 1), the Option 2 condition becomes relevant when the exemption cannot be applied.   Remember Annex 1 negates the need for a “public interest”  test to be applied to the disclosure to HMRC.

Hence the availability of an Option 2 disclosure confirms my conclusion that HMRC is seeking to lawfully obtain personal data from controllers even when (a) there is no public interest in the disclosure and (b) where such a disclosure is not associated with any specific HMRC investigation  (i.e. a failure to disclose does not prejudice HMRC’s collection or assessment of tax).

Note the taxation condition (paragraph 10) does not even require the disclosure to be “necessary” for HMRC functions, unlike the paragraph 5 which requires disclosure to be “necessary” for law enforcement processing.

Mind you, if the Government’s proposed Human Rights changes are implemented, the ICO and Courts will be required to give “great weight” to what Prime Minister Liz Truss decides as “necessary” and “proportionate”.  So, in practice, any “necessary” safeguard is likely to be significantly degraded (see references).

Concluding questions

The combined effect of Annex 1 and Annex 2 is to provide a huge exemption from the provisions that best protect the data subject from unlawful and incompatible processing.

The Annexes also provide an alternative mechanism for HMRC to obtain personal data without reference to its wide powers (e.g. under Schedule 36 of the Finance Act 2008).  These powers allows HMRC to demand any information or any document related to tax matters from almost anybody.

This raises three important policy questions which should be considered by Parliament prior to approving legislation that promotes the expansion of the proposed voluntary disclosure route.

• Are HMRC powers fit for purpose? If the answer is “no” why can’t Ministers approach Parliament with an argument for an upgrade of HMRC powers rather than expand the reach of voluntary disclosures to HMRC?
• Should HMRC be required to use its powers (e.g. Schedule 36) to demand personal data before it adopts a voluntary request for the disclosure of personal data?
• Should HMRC be required to state when using a voluntary disclosure arrangement that there is no obligation for a controller to disclose and if there were to be a refusal to disclose personal data there would be no detriment to the controller?

These questions certainly need answering in the context of HMRC and dare I say it, certain law enforcement processing and national security.  Perhaps the ICO could do the honors?

Autumn Data Protection Courses

I am holding another day course on the changes arising from the Data Protection and Digital Information Bill on Tuesday, September 27 (by Zoom only;  £250 + VAT per delegate).  Program available from:  info AT amberhawk.com

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection PRACTITIONER Courses are in London on Monday September 19-24 (5 days) and on Monday October 31-November 4 (5 days)
• The next Data Protection FOUNDATION Course is in London on Tuesday November 15-17 (3 days).

Full details (as we are upgrading our Amberhawk website), details of all the above courses can be obtained by emailing info AT amberhawk.com

References

How the Human Rights changes impact on data protection: https://amberhawk.typepad.com/amberhawk/2022/07/uk-bill-of-rights-set-to-undermine-uk_gdpr-and-adequacy.html  (see other references at the end of the blog)

I have produced a “Keeling Schedule” for the changes to A.5, A.6, A.13, A.14: you can download it from the References at the end of: https://amberhawk.typepad.com/amberhawk/2022/08/dpdi-bill-removes-public-interest-test-in-push-to-legitimise-general-public-sector-data-sharing.html

 

DPDI Bill removes “public interest” test in push to legitimise general public sector data sharing

This blog considers how the Data Protection and Digital Information Bill (the “Bill”) impacts on the lawful bases used in the context of voluntary data sharing with public bodies.

It explains how the Government is building a legal infrastructure that provides Ministerial powers to legitimise voluntary and general data sharing across the public sector which does not need to consider whether data sharing is in the “public interest”.

For instance, is it “in the public interest” to disclose personal data to protect vulnerable individuals? If your answer is “yes”, then the blog explains why there is no need for many of the new proposed lawful bases or for the abolition of the “public interest” test.  Indeed, one new proposed lawful basis can be developed to legitimise data sharing in general, also in the absence of any public interest consideration.

This blog is limited to how such expansive data sharing becomes lawful under the revised A.6 proposed in the Bill.  The blog also serves as a reminder of the significant impact of the proposed replacement of the Human Rights Act on this Bill; something that remains absent from all DCMS documentation on this Bill.

Current data sharing

Before describing the changes made by the Bill, it is worth understanding how voluntary disclosure/data sharing of personal data occurs under the current DP regime.

So suppose a Social Work department of a Local Authority (Controller A) wants to obtain personal data held by another body to protect a vulnerable person in its care.  So it asks another body (Controller B) to disclose the relevant personal data.  Assuming Controller B has no role or function in respect of protecting the vulnerable, how is such a disclosure made lawful under the current UK_GDPR/DPA2018?

Note there is a disclosing controller (Controller B) and an obtaining controller (Controller A) where obtaining and disclosure are both processing operations.  So Controller B’s disclosure is Controller A’s obtaining; it’s the same processing operation viewed from different ends of the telescope by each Controller.

This data exchange uses the lawful basis in A.6(1)(e) of the UK_GDPR/DPA2018 regime. This lawful basis requires that the “processing is necessary” for one of two options which are either:

(i)  “necessary for the performance of a task carried out in the public interest”  or

(ii)  necessary for “the exercise of official authority vested in the controller”.

Second, the expansion of the A.6(1)(e) lawful basis by Section 8(1)(c) of the current DPA2018 states that either requirement (i) or (ii) above can be satisfied if the processing is for “…the exercise of a function conferred on a person by an enactment…”.  Note that, in our example,  the use of the word “person” could refer to Controller A or Controller B.

The above identifies the questions that need to be asked prior to disclosure by Controller B: if the answers are “yes” then the disclosure can occur lawfully.   So:

• Is a disclosure to protect the vulnerable a “task in public interest”?
• Is that disclosure for “…the exercise of a function conferred on a person by an enactment…”? In this case, does the person (i.e. the Local Authority via its Social Work Department) have a function conferred by enactment to protect the vulnerable?

Note that Controller’s A processing  (i.e. the obtaining) does not need “a public interest test”; that is performed by Controller B prior to disclosure.  Clearly Controller A’s obtaining is part of the “official authority vested in the controller” because it is in “…the exercise of a function conferred on a person by an enactment…”  (where the person is the Local Authority again).

So both obtaining and disclosure are lawful – and in the public interest.

Now consider the following.  Do you think that: (a) disclosure of personal data to the police for a criminal investigation; (b) a disclosure to the relevant national security agency for a national security purpose, or (c) a disclosure to public bodies dealing with a national “emergency” (e.g. a large area flood) are also disclosures “in the public interest” in the same way as “protecting the vulnerable”?

I am convinced the answer is “yes”. And this is before one considers an alternative lawful basis (i.e. A.6(1)(f): disclosure from Controller B is in the legitimate interest of the Third Party (Controller A)).

I say this because, if you agree that the above options are all “in the public interest” then the conditions presented in Annex 1 after the first paragraph are redundant.

Indeed, I suspect that these later paragraphs in Annex 1 are included to act as a smokescreen to mask the real change in its first paragraph.

Lawful basis under the Bill

The Bill introduces the following changes with respect to lawful basis:

First, the task specified in A.6(1)(e) is amended so that it is specific to the controller performing the processing.  This lawful basis now reads that the “processing is necessary for the performance of a task [of the controller] carried out in the public interest or a task carried out in the exercise of official authority vested in the controller;

Second there is a new A.6 lawful basis where the “processing is necessary for the purposes of a recognised legitimate interest” where the “recognised legitimate interests” are  listed in Annex 1 of the Bill.

Apart from the first paragraph, the Annex 1 list is as follows:  “National security, public security and defence”, "Emergencies“, "Crime", “Safeguarding vulnerable individuals” and a revised Democratic engagement purpose (which is not discussed here).

With respect to the Social Work example used above {disclosing Controller B to obtaining Controller A),  Controller B’s disclosure uses the Safeguarding vulnerable individuals” lawful basis whilst Controller A’s lawful basis remains “a task carried out in the exercise of official authority vested in the controller”.

So both obtaining and disclosure become lawful,  in the absence of any public interest consideration.

The absence of any consideration of a “public interest test” prior to disclosure will eventually mean that disclosures under the Bill are likely to occur where no public interest arises.  This position is aggravated by the Human Rights changes where “necessary” means “what the Government has determined as necessary” (see references for the reason why).

Even with respect to disclosures for crime prevention and detection etc, the DPA1984 and DPA1998, provided a test that prior to disclosure a disclosing controller had to assess whether a failure to disclose personal data would prejudice the crime prevention purpose etc.

This is not replicated in the Bill.  I leave it to readers to determine whether this is another example of data protection standards falling to reach those established by the DPA1984.

Any disclosure for any public sector task?

The first paragraph of Annex 1 is captioned:  “Disclosure for purposes of processing described in Article 6(1)(e)”; that is where any disclosure, any public body, any public task comes from.

In further detail, this paragraph states that a disclosure is lawful when:

“the processing is necessary for the purposes of making a disclosure of personal data to another person in response to a request from the other person”, and

“the request states that the other person needs the personal data for the purposes of carrying out processing described in Article 6(1)(e) that has a legal basis that satisfies Article 6(3)”.

Note the very weak wording in the above; the word “necessary” should have been linked to the disclosure purpose and NOT the purpose of making a disclosure (i.e. the mechanics of the disclosure procedure).  The fact that a controller “needs the personal data”  for any purpose for any public task in is far lower threshold than one that describes the disclosure as being “necessary” for a specific purpose.

However, as previously stated,  these weaknesses are aggravated when the proposed Human Right Act changes click in (i.e. “necessary” means “what the Government decides is necessary”).

So, what does A.6(3) do?

Note the reference that the legal basis has to satisfy A.6(3);  this is a reference to the requirement that the prospect for disclosure has to be laid down by UK domestic law.  For example, Part 5 of the Digital Economy Act 2017 specifies, in law, a host of disclosure arrangements.

If such a law exists, A.6(3) then allows the Secretary of State “to adapt the application of rules of this Regulation”  (i.e. modify the UK_GDPR) in the following areas:

• “the general conditions governing the lawfulness of processing by the controller”;
• “the types of data which are subject to the processing”;
• “the data subjects concerned”;
• “the entities to, and the purposes for which, the personal data may be disclosed”;
• “the purpose limitation” and “storage periods”; and
• “processing operations and processing procedures”.

Some of the powers to “adapt” the above are found at Clauses 5(4), 8A(5), 8A(6), 8A(7) and 8A(8) of the Bill.  For example, many disclosures are made exempt from the Purpose Limitation Principle via Annex 2 of the Bill.

Potentially these Ministerial powers can adapt any Principle, A.6 lawful basis (and A.9) to ensure that data sharing can proceed, relatively untroubled by the data protection concerns of data subjects.  It is these provisions that establish the legal infrastructure to legitimise voluntary and general data sharing across the public sector in the absence of  “public interest” considerations.

Although A.6(3) adds that “…domestic law shall meet an objective of public interest and be proportionate to the legitimate aim pursued”,  these requirements should not be considered reliable safeguards for data subjects.

When the Human Rights changes come into effect, the “public interest” effectively means “the interest of the Government of the day” and “proportionate/legitimate” means “what the Government considers proportionate/legitimate”.

Concluding comment

As specified in previous blogs, the proposed changes to the UK’s Human Rights regime infects the Bill like a malevolent virus.  Like all embarrassing diseases, the DCMS (and ICO) do not refer to the consequences of the proposed modifications on this Bill.

The requirement that the Courts and ICO give “great weight” to the Government’s determination of what is “necessary”, “proportionate” or “in the public interest” undermine the protections afforded to data subjects especially when public bodies are able to share their personal data without any consideration of the public interest.

Any allegation of “unlawful disclosure” under the Bill will become very difficult to prove, if the argument is reduced to one about the “weight” given to a particular disclosure.

The effect is to give public authorities a “Get Out of Jail Free Card” even when data sharing, not in the public interest, goes pear-shaped.

Autumn Data Protection Courses

I am holding another day course on the changes arising from the Data Protection and Digital Information Bill on Tuesday, September 27 (by Zoom only;  £250 + VAT per delegate).  Program available from:  info AT amberhawk.com

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection PRACTITIONER Courses is in London on Monday September 19-24 (5 days).
• The next Data Protection FOUNDATION Course is in London on Tuesday November 15-17 (3 days).

Full details (as we are upgrading our Amberhawk website), details of all the above courses can be obtained by emailing info AT amberhawk.com

References

How the Human Rights changes impact on data protection: https://amberhawk.typepad.com/amberhawk/2022/07/uk-bill-of-rights-set-to-undermine-uk_gdpr-and-adequacy.html  (see other references at the end of the blog)

I have produced a “Keeling Schedule” for the changes to A.5, A.6, A.13, A.14: download it here Download A6 changes DPDIB Aug

 

New Data Protection Bill defines “personal data” below DPA1984 threshold

This is the first in a series of blogs on the Data Protection and Digital Information Bill (the “Bill”) published just before the Parliamentary recess.  This blog explains:

(a) how the Bill’s new definition of “personal data” works;

(b) why the definition is very problematic for data subjects;  and

(c) how, after nearly four decades of data protection law in the UK, the Government is promoting a definition of personal data that is demonstrably weaker than that in the DPA1984.

The proposals in the Bill to change the definition of “personal data” did not feature in the DCMS original Consultation Document. This omission raises serious questions about whether or not other undisclosed horrors lurk in the depths of this Bill.

Remember as you read on, what is being proposed exists to “provide greater clarity about which type of data is in scope of the legislation” (p26 of the “Explanatory Memorandum”).  I should add, that this blog provides all the clarity absent from that Memorandum.

Why change the definition?

The purpose of the new definition of personal data is to distinguish between three types of data. These types are:

(a) personal data which relates to an identified or identifiable living individual where identification is usually by a controller or a processor using reasonable means. Such identification could be by name, address, location, social characteristics, identification numbers etc;

(b) non-personal data which is information that is likely to have been derived from personal data (or which is currently treated under the UK_GDPR as personal data),  but where a data subject is no longer identifiable without the expenditure of an unreasonable amount of effort on the part of a controller or a processor; and

(c) anonymous data which is data that cannot be attributed to a specific living individual.

The basic idea is that organisations that process “non-personal data” or “anonymous data” cannot be a controller or a processor as the data cannot be related to a particular living individual without unreasonable effort on the part of that controller or processor.

In other words, non-personal data and anonymous data are both free of any data protection concern (i.e. no obligations arise from the UK_GDPR).  The Bill’s objective is to widen the scope of these two categories by narrowing the scope of those data that are classified as “personal data”. That in summary is the name of the game.

What has changed in the definition?

The Bill splits personal data into two further types by introducing the concept of “direct” and “indirect” identification of a living individual in the context of the personal data being processed. So, for example:

• “Direct identification” occurs when a living individual is identifiable from the data “directly” without the use of any “additional information”. An example would be a normal database that contains records such as the data subject’s surname,  address, date of birth, policy number as well as other data attributes.
• “Indirect identification” occurs when a living individual is identifiable from the data plus some other “additional information” which might be held by another person. An example would be a database of phone numbers where the identification of data subjects is known to be in a separate list (e.g. a telephone directory) held by the controller, processor or another person.  Pseudonymised personal data is expressly defined to be a class of data where indirect identification occurs.
  

In the case of “direct identification”, identification of a data subject has to be “by the controller or a processor by reasonable means at the time of the processing”.  More or less the same goes for indirect identification where such identification requires “additional information” to be held (or likely to be held) by a controller, processor or “another person”.

“Reasonable means” is defined as a non-exhaustive (illustrative) list which includes “among other things: (a) the time, effort and costs involved in identifying the individual by that means, and (b) the technology and other resources available to the person”. In other words, there could be other factors to consider (see Case 2 below).

Note that “at the time of the processing” in the context of “direct identification” is likely to be the time the controller or processor first obtains the personal data either from the data subject or from another source.  The same more or less applies if indirect identification is completed by a controller or a processor (i.e. data protection obligations kick in as soon as the additional information is obtained or is likely to be obtained).

Note also that in the context of “indirect identification” and before the additional information is obtained (or is likely to be obtained), the data processed by a controller or a processor is not personal data and is free from data protection obligations.

In the context of “indirect identification” by another person, the time of the processing is likely to be when the controller or processor knows (or should know) that the “additional information” has been obtained (or is likely to be obtained) by that “another person” who has expended “reasonable means” to identify a data subject.

Additionally, both “direct” and “indirect” identification of a data subject under this Bill requires an assessment, by the controller, of the “reasonable means” used to perform the identification.  This implies that if the means of identification are “unreasonable” for whatever reason, then the data are not personal data and no data protection obligations arise.

It can be seen that what “reasonable means” are available is very important to the personal data definition.   Note that if the controller assesses that the “reasonable means” are unreasonable, that controller will process the information as if it were not personal data (e.g. no transparency, security or rights).

In conclusion, if a controller gets its assessment of reasonable means wrong, the default position is that the processing occurs, in secret, until it is stopped by the ICO using his powers (which is increasingly unlikely).  As will be seen, this places too much power in the hands of the controller.

Finally,  identification (directly or indirectly) can be “by the controller or a processor”  (emphasis on “or”).  This opens up three possibilities which are (to me, very confusing):

• First that identification details are held by the controller but not by the processor. If this possibility is valid,  the processor’s data protection obligations do not apply as the processor is not processing personal data;
• Second that identification details are held by the processor but not by the controller. If true, the controller obligations do not apply (!!!).   But if this were true then the processor that performs the identification would become a separate controller or joint controller (surely!?);
• Finally, identification details are held by either controller or processor (or is known to be held by another person etc) then both controller and processor would be subject to data protection obligations This possibility obviously contradicts the first two.

I haven’t a clue what is going on here or why.  I find the use of “by … a processor” inexplicable and unnecessary; it is miles away from the “clarity” promised in the Explanatory Memorandum.

Illustrative scenarios: CCTV

Now we have a feel for what is going on with the definition of personal data, can we consider two cases. I have made these up to illustrate why the definition is problematic, so forgive any artificial construct.

Case 1: Consider a controller who employs CCTV operators in a City Centre. One operator is directing a police officer to intercept and arrest a thief who is wearing a red hat, orange shirt and blue jeans as the thief is dipping into shoppers’ handbags.

Now which of the following statements best “clarifies” whether the identification of a living individual is direct or indirect? Remember, you have to consider the “reasonable means” expended by the controller to perform this identification.

• The thief is directly identified via specific criteria (e.g. by monitoring a particular individual wearing a red hat, orange shirt and blue jeans).  Is this sufficient to deliver direct identification even though the CCTV operator does not know other important identification details (e.g. the thief’s name, date of birth, home address, National Insurance Number etc)?
• The thief is indirectly identified. Once apprehended, the police become the “another person” who completes the identification through the use of “additional information” easily collected by the police after arrest (i.e.  the “reasonable means” test is passed).  Note that with indirect identification, a key factor is that the “another person” obtains the “additional information” for identification; it does not matter that the CCTV operator does not obtain the “additional (identification) information” from the Police.

So which did you prefer?  Which option is more certain: direct or indirect identification?  Remember you should not muddy the waters by choosing both (as these concepts have been introduced to provide more “clarity” – Ha Ha).

If you chose indirect identification, now consider what happens if the police do not obtain the “additional information” for whatever reason (e.g. the thief disappears)? Because the “additional information” is not obtained, the CCTV operator is not processing personal data. ( I know that’s a rubbish conclusion but that is what this Bill does).

Research & Pseudonomisation

Case 2: Now assume a NHS Trust Hospital shares pseudonymised health personal data with a University for medical research purposes (i.e. the Trust keeps the identities; the University has all the medical details except identification).  Because pseudonymisation is involved, only indirect identification is relevant.

The University and Trust sign a legally binding data sharing agreement which states the Trust will never release the identity of any patient to the University.  To protect the identification personal data further, and unknown to the University, the Trust stores the only copy of the identity personal data with a secure Trusted Third Party. This Party is tasked with encrypting the data using techniques unknown to the Trust.

In summary, this scenario is constructed so that any access to identifying details is a “very last resort” matter and aimed at precluding general access to the identifying details in a large number of circumstances.

The question I am driving at is as follows: “Is the University processing pseudonymised personal data or is it processing “non-personal data”?”. The answer depends on your assessment of the “reasonable means” that could be used to perform the indirect identification by the University, Trust or Third Party?  

Although the “additional information” exists, does its existence as a very last resort matter, impact on “another person’s” ability to complete the identification using “reasonable means”?

Or does the complex construction, specified by the scenario, provide a sufficient barriers to preclude the general obtaining of “additional information” by “reasonable means”?  Is it possible that the University or Trust could reasonably argue, given that the definition of “reasonable means” is non-exhaustive, they have arranged matters so there were no reasonable means of identifying a living individual?

If so, then the University is not a controller;  it follows that it has no data protection obligations as a controller.  The patient cannot withdraw consent to the research, object to the processing, seek subject access and the University has no security, retention or transparency obligations and the data protection elements of the data sharing agreement are irrelevant.

Such processing will continue until the ICO intervenes  (unlikely in my view).  Quite simply the data subject risks being written out of the research equation. And that is before you get into the Research proposals in the Bill.

In conclusion, once this definition is enacted, there is a considerable risk that lawyers are likely to set to work creating circumstances for their clients where data subject protections vanish through the use of complex organisational structures, data sharing exchanges and contracts.

These will start with personal data, somehow produce “non-personal data”, which then can be scattered to the four corners of the Earth without any data protection concern.

Comparison with DPA1998/DPA1984

The Bill’s definition of personal data is completely different to the DPA1998 which also required identification of a living individual either to be direct (i.e. “from the data”) or “indirect” (i.e.  “from those data and other information which is in the possession of, or likely to come into the possession of, the data controller”).

Note that for indirect identification under the DPA1998, the main test was: (a) whether the controller held the identification details in his possession, or (b) was the controller likely to obtain those identification details later on, or (c) the controller did not hold any identification details.  Only in the latter case did the DPA1998 not apply.

Under the Bill,  identification of the living individual has to be by “reasonable means”.  In other words, the identification details can be in the possession of the controller but it takes unreasonable effort to join the dots to a living individual.  In this case, the data are not personal data (even though the identification detail “is in the possession of the data controller” – the DPA1998 test).

This explains how the new definition of personal data in the Bill does not even elevate itself over DPA1998 standards. The DPA1998, I remind readers, were subject to infraction proceedings with the European Commission commenced in 2004. The Commission thought the DPA1998 was a defective implementation of Directive 95/46/EC and this included its definition of “personal data”.

Indeed, the definition of “personal data” in the DPA1998 was almost word for word taken from the DPA1984 (i.e. personal data was data that related to a “living individual who can be identified from that information (or from that and other information in the possession of the data user”(“data user” was the 1984 term for a controller).

In other words, from the data subject’s perspective, the Bill’s definition of personal data is even inferior to that found in the DPA1984

Concluding comment

So if the definition of personal data falls below DPA1984 standards, what is the Commission’s likely view of the Bill’s new definition in the context of Adequacy?

Send your answers on a post-card or email either to Auntie Nadine Dorries at the DCMS (before September 5th) and perhaps Uncle John Edwards at the ICO (before his next speech as he “believes the proposals strike a good balance in making improvements”).

Autumn Data Protection Courses

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• I am holding a day course on the changes arising from the Data Protection and Digital Information Bill on Thursday, September 15 by Zoom only (£250 + VAT per delegate).
• The next Data Protection PRACTITIONER Courses is in London on Monday September 19-23 (5 days);
• The next Data Protection FOUNDATION Course is in London on Tuesday November 15-17 (3 days)

Full details (as we are upgrading our Amberhawk website), details of all the above courses can be obtained by emailing info AT amberhawk.com

UK Bill of Rights set to undermine UK_GDPR and Adequacy

A fortnight ago, the Government published its UK Bill of Rights to replace the Human Rights Act 1998 (HRA).

My main conclusions concerning the Bill of Rights relevant to data protection are:

• The Bill changes who interprets the meaning of necessity, public interest and proportionality and thereby changes the nature of the link between the UK_GDPR and A.8 of the European Convention of Human Rights (right of respect for private and family life etc).
• The Courts do not undertake the balancing tests associated with “proportionality”, “necessity” and what is “in the public interest”; these tests are undertaken by Ministers if a Government has a Parliamentary majority.
• The Bill is a significant risk to the Adequacy Agreement with the European Commission.
• The Bill protects the powers of the State from challenge, rather than protecting the individual from the misuse of State powers.
• The Bill is intellectually flawed with respect to its treatment of A.8 issues.
• The Bill allows Government to fashion wide ranging exemptions from the UK_GDPR, not listed in A.23 of the UK_GDPR; it also explicitly permits processing that breaches A.8.
• The Bill neither addresses nor resolves the serious data protection issues identified by the ICO in his evidence to the MoJ Consultation.
• The Commissioner might have misled Parliament in his recent Oral Evidence.

The Bill is intellectually flawed

Suppose legislation requires a public body to disclose specific items of personal data with another controller.  Under the current data protection regime, such a disclosure would be “necessary for a legal obligation” (the controller’s A.6 legal basis for the disclosure).

Additionally, such legislation that demands disclosure would also have to be justify its interference of the A.8(1) right in terms of  “necessity”  and “proportionality” as required by A.8(2).

Note that currently the two regimes (DP & ECHR) are firmly linked through the word “necessary” which has the same meaning in both regimes.  So, in our example above, the ICO can consider whether the test of necessity in human rights terms, applies to the disclosure of personal data in data protection terms (i.e. whether the disclosure is really necessary for a legal obligation).

Under the Bill of Rights, this is not possible. Processing becomes “necessary” because Ministers have used their Government majority to enact legislation, approved by Parliament.  The Courts have to give the greatest possible weight to the assumption that Parliament has balanced all the factors associated with necessity (and proportionality and in the public interest) when enacting that legislation.

In summary, under the Bill, Parliament determines the balancing concepts such as of necessity,  proportionality or the public interest in legislation as it passes through its Parliamentary stages.  This contrasts with the current position where the Courts (or ICO) consider such concepts, once legislation has been enacted.

The difference in timing exposes an intellectual shortcoming in the Bill of Rights.  The Bill’s position is that Parliament considers concepts such as “necessity” as the legislation passes through its Parliamentary stages (i.e. the legislation is not yet an Act of Parliament).

This is to be compared with the current position where legislation has been enacted, but its operation in practice has created a human rights difficulty which is being considered by the Courts.

In other words, balancing the concept of “necessity” etc is currently considered by a Court in the context of knowledge of all relevant facts.  Under the Bill, Parliament considers such concepts in the absence of any fact.

This is hardly a rational approach towards enacting trouble-free legislation.

Unlawful processing is OK!

Suppose a future piece of legislation, passed by Parliament, requires a public authority to process specific items of personal data items it already holds for a new purpose Z, disclose them another organisation for purpose X.  Assume further the Bill of Rights is an Act of Parliament.

All these processing activities are lawful, necessary, proportionate and in the public interest because the provisions of Bill of Rights requires the courts to assume Parliament has considered all the relevant balancing factors.

Indeed the Bill of Rights goes further, as it allows a public authority to process personal data in a way that is incompatible with a Convention right.

Although the Bill states that “it is unlawful for a public authority to act in a way that is incompatible with a Convention right” (e.g. the act in question being to process personal data as described above), this prohibition does not apply “as a result of one or more provisions on primary legislation, the authority could have not acted differently” (See Clause 12(2) of the Bill). 

As the processing in the above example is required by law, the public “authority could have not acted differently”. It follows that, if processing of personal data is required by law, it does not breach A.8 and never can be an unlawful breach of A.8.

If this interpretation carries over to the UK_GDPR, it serves as an exemption from the lawfulness requirements of the UK_GDPR and permits unlawful processing.

Why call it an exemption?

Suppose Parliament enacts a law which states that personal data have to be retained for seven years, when in practice the retention time should be one year.  The text of the Storage Limitation Principle states that personal data shall be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”.

Note that the current test of “necessity” is linked to the “purpose of the processing”.  Because the word necessary has the same meaning in the human rights and data protection regimes, the question the ICO could explore under the current regime is: “In the context of this seven year retention period, is the law that requires such retention, proportionate and necessary?”.

Under the Bill of Rights this question is not even asked. This is because it is presumed that Parliament has struck an appropriate balance between competing factors (e.g. proportionality, public interest, necessity) in approving this seven year retention period.  Indeed, the ICO is obliged to give Parliament’s balance “the greatest possible weight” if he were to enforce the Storage Limitation Principle.

In other words,  the prospect of enforcement for seven-year-retention is remote.  If an UK_GDPR provision cannot be enforced, then the provision itself is effectively exempt.  In the case above, the Storage Limitation Principle is effectively exempt for seven years.

In general, the Bill’s impact on the UK_GDPR is profound: any legislation if it contains provisions that relate to the processing of personal data, fashion future exemptions from the data protection regime, far beyond the requirements of A.23 of the UK_GDPR which requires any exemption to be “a necessary and proportionate measure in a democratic society”  (where it is assumed the Courts assess the underlined words).

If you want an example of legislation that contains many such processing provisions which are likely to conflict with the UK_GDPR, see S.12 of the Childrens Act 2004.  The ICO will have obvious difficulties in enforce UK_GDPR standards if the standards set out in S.12 differ.

Protecting powers not humans

It is important to understand, the UK Bill of Rights does not grant rights to protect individuals from the abuse of powers by the State.  Instead the Bill protects the powers of the State from individuals who currently argue in Court that such powers have been unlawfully exercised.

This objective is achieved by making it more difficult for an individual to commence a Court case under the UK Bill of Rights.  If, for example, Ministerial or public authority powers are misused, the complainant has first to show “significant disadvantage” from the misuse of powers.

Then the individual has to overcome the very strong presumption that the Minister (or public authority) is acting lawfully, proportionally, in the public interest etc.  If the issue under scrutiny accords with legislation enacted by Parliament (which has considered all relevant balancing factors remember!) and if the controller is a public authority that has no choice, then the use of these powers is not a breach of A.8. (See the section on Unlawful processing is OK above).

If, perchance, an individual complainant then took the case to the Strasbourg Court of Human Rights and won, the Bill of Rights ensures the UK Courts and Government can effectively ignore that Strasbourg jurisprudence (see next section).

That’s why the Bill protects the powers of the State from interference from data subjects and does not protect data subjects from the excessive use of State power.

How the Bill protects state powers

There are three procedural changes, targeted at the courts, that also protect the powers of Ministers or of the State from scrutiny.  These are set out in Clause 1 of the Bill of Rights.

• “it is the Supreme Court (and not the European Court of Human Rights) that determines the meaning and effect of Convention rights for the purposes of domestic law” (Comment: this allows future “Strasbourg jurisprudence” concerning the use of powers to be ignored);
• “courts are no longer required to read and give effect to legislation, so far as possible, in a way which is compatible with the Convention rights” (Comment: this permits UK Bill of Rights to diverge from existing human rights precedents and existing Strasbourg jurisprudence; it also removes the requirement to ensure that an interpretation of any legislation is supportive of human rights);
• “courts must give the greatest possible weight to the principle that in a Parliamentary democracy, decisions about the balance between different policy aims… are properly made by Parliament” (Comment: this allows Government, via its Parliamentary majority, to constrain further the Courts drawing a conclusion that a particular right has been infringed when powers are used).

The Explanatory Notes to the Bill state that a court must understand that “judgments, decisions and interim measures” of the ECHR “are not part of domestic law” and that the Principle of Parliamentary democracy (i.e. what Parliament enacts) is expected to prevail unless a case before the Court is exceptional.

As Government is in control of the Parliamentary agenda (e.g. Government Bills tabled before Parliament are usually enacted), another way of summarising the Bill’s impact is as follows:  “the powers that Ministers specify for themselves in legislation is what Parliament decides in terms of the Bill of Rights”.  And “what Parliament decides is what the Courts must give the greatest possible weight”.

A shorthand for this is:  under the Bill, “Ministers propose; the Courts dispose”.

Adequacy down the tubes?

The Adequacy Agreement between the UK and European Commission mentions the current Human Rights Act over 50 times and assumes that the:

• “… United Kingdom’s adherence to the ECHR … as well as its submission to the jurisdiction of the European Court of Human Rights” is assured. (my emphasis).  Comment: as can be seen from the Bill of Rights, the UK will be no longer “submitting” to the jurisdiction of the European Court.
• “….any person that considers that his or her rights, including rights to privacy and data protection, have been violated by public authorities, can obtain redress before the UK courts under the Human Rights Act 1998”. Comment: this is no longer true as the Bill of Rights imposes a significant threshold on the person seeking redress to show that he/she is a “victim” of an action that results in “significant disadvantage” to that person (Clause 15(3) of the Bill).
• there is “continued adherence to such instruments” (e.g. “submission to the jurisdiction of the European Court of Human Rights”). ”. Comment: The Bill of Rights ensures that “continued adherence…”  is no longer the case.

So what are the implications of the above for Adequacy?

• Does the above mean that the UK will lose the Adequacy Agreement immediately? Answer: “NO” as the Bill has yet to pass through Parliament.
• Does the above mean that the European Commission could argue that the UK is set to renege on the Adequacy Agreement? Answer: “YES”, and at any time.
  
• Could the European Commission set in motion the steps needed to revoke the Adequacy Agreement? Answer: “YES”, and at any time.
  

You don’t need to take my word for it:  the ICO could not be clearer in his evidence to the MoJ: “In order to maintain EU adequacy decisions, the Government should ensure its proposals continue to effectively implement the ECHR in British law”; para 4.23).

How necessity etc is determined

Article 8 of the ECHR contains the balance between the right to respect for private life (A.8(1)) versus the lawfulness of any interference with that right (A.8(2)).  This raises the question of whether or not any interference is  “in the public interest”, “necessary” or “proportionate”.

Clause 7 of the Bill of Rights sets out the role of Parliament in assessing these concepts when balancing different objectives (e.g. in A.8)).  It states that when a Court is a considering whether there is a breach of a right, it must “strike the appropriate balance” between:

• “different policy aims” (e.g. as in A.8(1) and A.8(2) ECHR). Comment: the Explanatory Notes says this also “includes weighing up competing social and economic considerations”;
• “different Conventions rights” (e.g. as with A.8 and A.10 ECHR);
  
• “the Convention rights of different persons”; or
• “a combination of matters mentioned in (i) to (iii)” Comment: the Explanatory Notes says this, includes balancing “a person’s Convention rights” against “the interests of society at large”.

In striking that “appropriate balance”, a Court must (i.e. NO flexibility here):

• “regard Parliament as having decided, in passing the Act” (i.e. the Act under scrutiny by the Courts), “that the Act strikes an appropriate balance” between the matters as set out in (i)-(iii) above; and
• place “the greatest possible weight” on the principle that “in a Parliamentary democracy, decisions about how such a balance should be struck are properly made by Parliament”.

In the context of A.8, the Courts must assume Parliament has considered different policy aims (e.g. whether the law enforcement authorities can access a database of personal data).  Such consideration will naturally include concepts such as necessity, in the public interest and proportionality.

It can be seen that the courts will find it very difficult to diverge from this “appropriate balance” as it has to give this balance “the greatest possible weight”.

This difficulty also applies to the ICO when enforcing the UK_GDPR.

Conclusion

The ICO published a trenchant criticism of the MoJ Consultation document of the impact of the Bill of Rights on the UK_GDPR (see references).  Since then Information Commissioner has gone quiet on this impact.

The Commissioner might think that the problems he raised in his submission to the MoJ about “in the public interest”, “necessary” and “proportionality” have gone away.  They haven’t.  Whilst these were explicit in the MoJ Consultation, they are implied in any detailed analysis of Clause 7 above.

Indeed, when the Information Commissioner was last before MPs, he said the following in relation to a direct question about the Adequacy Agreement:  “As I say, when the European Commission comes to look at the law and examine it, I hope that it will see everything that guarantees a sufficient level of protection of Europeans’ data in the United Kingdom” (Q287; see references).

I can’t see how the Commissioner has reached this conclusion.  The statement to Parliament is, in my view, misleading.

Autumn Data Protection Courses

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection PRACTITIONER Courses is in London on Monday September 19-24 (5 days); full details by emailing info AT amberhawk.com
• The next Data Protection FOUNDATION Course is in London on Tuesday, July 12-14 and November 15-17 (3 days); full details by emailing info AT amberhawk.com

References

Link to all UK Bill of Rights documents: https://www.gov.uk/government/publications/bill-of-rights-bill-documents  (you will need the Bill & Explanatory Notes)

Link to ICO’s Human Rights response to the MoJ (a must read): https://ico.org.uk/about-the-ico/consultations/ministry-of-justice-consultation-human-rights-act-reform-a-modern-bill-of-rights/

The link to my four blogs on the MoJ human rights Consultation (see end of): https://amberhawk.typepad.com/amberhawk/2022/03/omissions-in-human-rights-proposals-degrade-privacy-and-freedom-of-expression.html

All the draft Oral evidence transcripts (the ICO one quoted above is 8^th June) can be found on: https://committees.parliament.uk/work/1733/the-right-to-privacy-digital-data/

DCMS fails to spend a penny to protect data subjects

The Queen’s Speech is accompanied by a long document that describes important elements of the proposed Parliamentary legislative programme. This year it’s called the “Lobby Pack”.

The entry in the Lobby Pack for the Data Reform Bill is a brief summary of the points raised in the DCMS consultation document; the MoJ entry for a Bill of Rights, even less of a summary of its proposed human rights changes.  There is no obvious modification to the proposals arising from the public consultations; it as if the consultations had never happened.

Both entries fail to mention that the respective Data Protection and Human Rights proposals are inter-linked and neither mentions the risks to the Adequacy Agreement with the EU.  Both sets of changes are promoted as “benefits of Brexit” and both re-assert their respective myths (e.g. reduction in controller obligations, easier data sharing, expansive transfers outside the UK and weaker regulation maintains a high standard of protection for data subjects in the UK).

Analysis of the “Key Facts” provided in the Lobby Pack shows that the DCMS numerical arguments for changes to the UK_GDPR are also very misleading.  Indeed, I will go as far to say that the DCMS have published dodgy digits that are no more reliable than those displayed on the side of that infamous Brexit battle-bus.

This blog provides a proper numerical analysis of these Facts;  this shows how the DCMS changes to the DP regime favour the interests of large controllers which comprise 0.6% of the controller community.  Projected average savings are calculated to be pitiful £2.60 per controller per week.

With respect to human rights proposals, the blog explores one of the two “Key Facts” to reveal something deeply disturbing about prison policy.

A £1 billion data protection claim

With respect to data protection, the Lobby Pack reports as a “Key Fact”,  that a DCMS analysis “indicates our reforms will create over £1 billion in business savings over 10 years by reducing the burdens on businesses of all sizes”. My emphasis of all becomes obvious later.

This £1 billion savings announcement was so eye-catching that a well-known DP lawyer was quoted in the press as saying “the reforms are likely to result in significant savings for businesses”.  This is of course, the propaganda message the DCMS wants to promote.  As we shall see, this message is 100% wrong as the touted savings per business are insignificant.

The correct DCMS figure for projected saving over 10 years is £1.45 billion.  This more accurate figure is contained in a document entitled:  “Data: a new direction: Analysis of expected impact” (see references) which was published at the same time as the original DCMS Consultation.

So, over the next decade, according to this impact Analysis just mentioned:

• Under a heading “Reducing barriers to responsible innovation” there is a saving for all controllers of £1,111.0 million. This is achieved by “clarifying legitimate interests”, “simpler gateway for research”, easier data subject “permissions for AI systems”, “Clarifying the fairness principle”, “Clearer standards for data minimisation”.
• Under a heading “Reduce burdens on business and deliver better outcomes for people” all controllers are saved £578.3 million. This is achieved by: “Reforming breach reporting requirements”; easing “Privacy and rights in relation to electronic communications”, and “amending bulk subject access requests”.
• On the negative side there are increased “familiarisation costs” of £239 million for all. (My emphasis on all in the above).

Adding the first two savings and subtracting the saving in the third bullet gives total of £1.45 billion per decade  (which includes the PECR savings which, in theory, should be discounted as they are not associated with UK_GDPR).  However, this makes the £1.45 billion savings figure an upper limit; whilst the “over £1 billion” figure is a lower limit. (Warning: nerdy explanation as to why an upper limit is preferable is in the references).

Some real facts

I am using five additional facts which are missing from the DCMS analysis:

1. Fact 1: Companies House has over 4 million companies registered in the UK (from Companies House website).
2. Fact 2: The total number of controllers on the ICO’s public register is 1,066,929. The breakdown of registration is: Tier 1: 966,587 (90.6% of the register): Tier 2: 93,604 (8.8%);  and Tier 3: 6,738 (0.6%). (Information from the ICO on 12 May 2022).
3. Fact 3: Approximate registration revenue per year is: Tier 1: £33.8 million; Tier 2: £5.6 million; Tier 3: £19.5 million. The  total ICO revenue collected is £59.0 million per year which is calculated by multiplying the number of controllers in each Tier, by the annual notification fee  for each Tier (Tier 1 (£35); Tier 2 (£60); Tier 3 (£2,900)).
4. Fact 4: The latest Annual Report (2020/21) indicates the cost of running the ICO is £56.4 million. Note that there is a potential for a small surplus as Registration fees can be more than the ICO’s running costs in data protection.
5. Fact 5: There are 67.1 million data subjects resident in the UK as per July 2020 (ONS website).

So what kind of questions do Facts like the above this raise? Three spring to mind immediately:

• From Facts 1 and 2, it can be seen that only 1 in 4 companies at Companies House is registered with the ICO. So could the ICO garner more in registration fees (e.g. by looking for active companies registered at Companies House but not registered with the ICO)? This improved revenue stream could help the ICO generate more resources to provide advice to controllers.  Is this better than changing the law because of a lack of clarity in the UK_GDPR as claimed by the DCMS in its Consultation?  Your answer is……
• From Facts 3 and 4, could any future surplus in registration fees be earmarked by the ICO to employ more staff to reduce the complaints backlog? Is this better than the DCMS proposal to deal with the ICO’s complaint backlog by passing legislation that allows the ICO to dismiss or not investigate complaints from data subjects?  Your answer is……
• Should the notification fee (fixed in 2018) be increased? For example, increasing the notification fee for Tier 2 to £100 and Tier 3 to £3,500 increases ICO resoursces by over £10 million.

These obvious question (and others) should have been raised and answered in the DCMS consultation; it wasn’t.  It’s another omission.

Cui bono?

The ICO’s registration breakdown above (see Fact 2) reflects the size of the controller; Tier 1 includes micro companies of less than 10 staff; Tier 2 includes SME’s less than 250 staff but more than 10 staff, and Tier 3 is large controllers with complex data processing needs.

So who benefits from the DCMS proposals for easier data sharing, less data breach reporting,  easier lawful processing of health personal data, removing ROPAs and DPOs, easier data transfers and less structured accountability requirements?

Is it a controller from Tier 1, Tier 2 or Tier 3?  What’s you answer?

Oh, you chose Tier 3,  what a surprise!!  It can thus be seen from Fact 2 that most of the changes the DCMS are proposing is primarily for the immediate benefit of 0.6% of the controller community in Tier 3; the community of controllers that hold the maximum amount of personal data on the majority of data subjects in the UK.

It follows the DCMS changes do not reflect the interests of all controllers as stated in the Key Facts; instead they reflect the immediate interests of a relatively small number of large controllers.  DCMS arguments about “removing the burdens etc” from “all controllers” are completely bogus. For example,  the DCMS proposal to scrap DPOs is unlikely to impact many Tier 1 controllers, unlike Tier 3 controllers which probably have a DPO.

Let’s play with the numbers

Start with the £1.45 billion of savings over 10 years; this represents £145 million of savings per year over all controllers (£1 billion =£1,000 million).  As there are 1.07 million controllers (Fact 2), the average saving for each controller can be calculated at £136 per year per controller.  This is about £2.60 per week per controller  (or the cost of a single cup of coffee in Barnsley – not London).

The conclusion one reaches is that the savings are really insignificant.  Even a small business in Tier 1 is not going to go bust because it did not save £2.60 per week.  It also follows that these touted financial savings are not a motivator for the proposed changes to the data protection regime.

So, suppose the UK_GDPR were unaltered; what would be the cost of maintaining protection for each data subject at the current UK_GDPR standards?  As there are 67.1 million data subjects in the UK (Fact 5), the savings of £145 million per year infer an cost of maintaining current UK_GDPR standards is £2.16 per year per data subject.  This equates to 4.2p per data subject per week, or 0.6 pence per day.

In other words, the DCMS are prepared to weaken the privacy protection for all data subjects order to save less than a penny per day on each data subject.  Remember this penny stretches over all controllers; hence the blog’s headline:  “DCMS fails to spend a penny”.

Remember all these numbers (£2.47 per week; 0.6p per day) are, according to the DCMS figures, upper limits;  the true number could be much less

Even if the £145 million yearly savings were all allocated to large controllers in Tier 3, the average annual saving is £21,520 per large controller which is an amount that would not even appear in the balance sheet of a controller having revenues in excess of £36 million per year.

If the £145 million were allocated all to Tier 2, the savings would be £1,550 per controller. There again pifflingly small for companies with turnover up to £36 million.

Concluding comment – data protection

I have to admit that whilst writing the above,  a song from the Mary Poppins film somehow entered my mind: “Feed the Birds for tuppence a bag”.

There are two reasons for this: first, 0.6 pence (in pre-decimalisation currency) is just under tuppence, and secondly, DCMS have definitely generated numbers “for the birds“.

Human Rights: the Key Fact

I don’t want to spend too much time on this so I will be brief. But it is important to always discuss the DP changes with the A.8/A.10 Human Rights proposed changes;  this is because the Government has failed to do so and perhaps, does not want to do so.

There are two Key Facts presented in the Lobby Pack; one Key Fact  reads:

“Between 2005 and 2011 [six years] the Prison Service in England and Wales faced successful legal challenges from over 600 prisoners on human rights grounds. This has cost the taxpayer £7 million, including compensation paid out and legal costs”.

The missing facts, not presented by the MoJ, is that the prison population is about 79,000 per year and that the annual cost of running the Prison Service is about £3.82 billion per year (both figures from Government website).

So 600 prisoner complaints costing £7 million  over 6 years represents about 100 prisoner complaints per year, costing £1.17 million. 100 prisoners represents 0.13% of the annual prison poulation whilst the legal fees and compensation of £1.17 million per year represents 0.03% of the prison annual budget.

It can be seen that MoJ’s Key Fact, used to argue for comprehensive changes to the human rights regime, is very small beer in terms of the Prison Service.  Indeed, if a company had 79,000 customers, I suspect that receiving 100 complaints per year would show that not much was wrong with customer processes.

However, the true picture underpinning this Key Fact is revealed in the MoJ Consultation itself.  Under a heading “Prisons’ provision of drugs treatments”, the Consultation says:

“Between 2005 and 2011, the Prison Service in England and Wales faced successful  claims from over 600 prisoners who claimed that their human rights were breached by  the failure to provide them with methadone, Valium or other particular forms of treatment  for their drug addictions.

The Prison Service has settled claims alleging a combination of negligence, inhuman  and degrading treatment (under Article 3), the violation of the right to a privacy (under  Article 8) and discrimination (under Article 14). This has cost the taxpayer around £7  million, including compensation paid out and legal costs”.(page 40)

So the the MoJ want to justify the change to the human rights regime for everyone because 0.13% of prisoners have claimed to have experienced “negligence”, “discrimination” etc.

I understood the current prison policy was that the guilty are sent to prison “AS punishment” (e.g. the loss of liberty); the MoJ’s “Key Fact” is more consistent with a policy where the guilty are sent to prison  “FOR punishment” (e.g. for “inhuman  and degrading treatment etc”).

Shameful.

Summer Data Protection Courses

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection PRACTITIONER Courses is in London on Tuesday July 5-7; July 19-21 (6 days); full details by emailing info AT amberhawk.com
• The next Data Protection FOUNDATION Course is in London on Tuesday, July 12-14 (3 days); full details by emailing info AT amberhawk.com

References

“Data: a new direction: Analysis of expected impact” from : https://www.gov.uk/government/consultations/data-a-new-direction

The Full “Lobby Pack” can be found on: https://www.gov.uk/government/publications/queens-speech-2022-background-briefing-notes  but you can download the relevant extract here

Mathematical diversion:  if I say that savings over a decade are above £1.1 billion (lower limit), then it hints at the savings could be far more (e.g. £7 billion): this allows a Minister to say “the savings are at the very least £1.1 billion but could be more”.  If we have an upper limit, our Minister is unlikely to  say:  “the savings are at the very most are £1.49 billion but could be less”.

ICO confirms Human Rights changes undermine UK_GDPR

According to press leaks, tomorrow’s Queen’s Speech is likely to contain two pieces of legislation that impacts on the current UK’s data protection regime.  Evidently they will form part of the Great Brexit Dividend which, surprisingly, has yet to reveal itself to the general public.

According to the leaks, there is to be a Data Reform Bill, which is intended to implement the DCMS proposals, post its consultation (“Data: a new direction”). There will also be legislation intended to implement the MoJ proposals outlined in its consultation (“Human Rights Act Reform: a Modern Bill of Rights”).

This blog covers the ICO submission to the latter consultation; it was published last Friday and is limited to ICO responsibilities relating to the processing of personal data in the context of A.8 and A.10 ECHR.

The ICO’s 18 page submission explains, on each page, how the UK’s data protection regime is likely to be severely impaired by the MoJ proposals. This contrasts with the 123 page MoJ consultation document which is devoid of any data protection content.

This probably explains why the ICO has devoted a whole section of his response to the history of “The relationship between ECHR and UK data protection law”.  There is now no excuse for the ignorance displayed by the MoJ (and the DCMS) in relation to the omission of this important relationship in their respective consultation documents.

The MoJ consultation also ignored the impact of the Human Rights changes on the UK’s Adequacy Agreement with the European Commission.  The ICO comments that “..the UK’s domestic and international commitments to human rights were particularly important elements for its adequacy decisions in respect of the UK” adding that “The Human Rights Act 1998 and the European Convention on Human Rights (ECHR) are referenced extensively”  (para 4.21).

Indeed, I counted about 80 references to “human rights” in this Agreement.  That is why, I think that if the UK’s Adequacy Agreement were to collapse, it would be the proposed changes to the UK’s human rights regime that would be the root cause.

A lack of trust

The first point to make is that the ICO complains about the insufficient clarity or detail with respect to the MoJ proposals.  He writes that “It is difficult to accurately foresee the full practical implications of any changes” as they are presented to the public “in the abstract” (para 3.01).  The ICO adds that further engagement is needed in “understanding the impacts”.

So if the ICO cannot clearly see what the MoJ is proposing, what hope is there for us “lesser mortals”?  I should also add the previous ICO made exactly the same criticism of the DCMS proposals (see references).

The second point is that (as is well known) the ICO supports the “government’s ambitious National Data Strategy with its first two key missions being ‘to unlock the value of data held across the economy’ and ‘securing a pro-growth and trusted data regime’ ”.

However, before economic nirvana is attained, the ICO states that UK citizens have to be convinced that there is “A trusted data regime [that] relies on having comprehensive and robust data protection law and regulation” (paras 1.23 and 1.24).

Having posited the need for “trust”, the ICO then puts the boot in.  He writes that “implementing some of the government’s proposals risks weakening this [A.8] right as it applies in practice” and that “This in turn could affect individuals’ and wider society’s trust and confidence in the data regime, ultimately affecting the UK’s data driven economy”.

In other words, the MoJ proposals create a significant risk of adding further to the loss of public trust in this Government.

ICO explains the lack of trust

The ICO states that he “has significant concerns about the potential impact of these (proposed) changes” and that the “…practical repercussions of this [potential impact] could be significant for the application of the data protection regime“

For instance, “Changes in how the concepts of necessity and the public interest are assessed in human rights law will inevitably have an knock on effect on their assessment in data protection  law”.

In further detail, “The concept of necessity is fundamental across the DPA/UK_GDPR (Article 5 principles, Article 6 lawful bases, Article 9 conditions for processing special category data, Article 23 exemptions, and Schedule 1)”.

The ICO’s conclusion is that the “…likely impact could make it more difficult for the ICO to protect individuals data” (e.g. “if public authorities are be able to rely on public interest grounds in a presumptive way”: para 3.27).

Finally,  the ICO points to a circular irrationality in the MoJ’s arguments. If “’necessity’ and ‘the public interest’ are given ‘great weight’ as per Parliament’s intention then “any legal duty or permission” placed on a controller “will pre-empt any assessment by the regulator and make it very difficult to argue that a measure was either not necessary or not in the public interest”.

In other words, the enforcement of data protection in the above circumstances could well become almost impossible especially against a public sector controller that claims its processing is “necessary” for its public task or in “the public interest”(i.e. A.6(1)(e)).

Balancing Articles 8&10 ECHR

The ICO states that “Cases involving both Article 8 and 10 are often unique in their nature and have wide and deep implications for both individuals and wider society. Tipping the balance too far in the favour of freedom of expression could reduce protection given by public authorities, including the ICO, to privacy rights” (para 3.43).

The ICO continues “The right to private and family life is a condition precedent to the enjoyment of other rights including freedom of expression, freedom of assembly and freedom of religion. In addition to fully extrapolating the direct impacts on privacy (related to data protection) set out above, the government should carefully consider how the impacts on privacy and data protection will have causal effects on other fundamental rights”.

For example, the proposal would make it easier for the tabloid press to publish salacious personal details prior to a trial or where the press decide someone is a target for innuendo or derision (e.g. the Bristol landlord wrongly linked by the tabloids to the murder of Joanna Yeates).

In addition, the “…move away from balancing the qualified rights against each other to place constraints or to weight one interest more heavily than another” could also have “a significant impact in relation to the principle of proportionality" (para 3.24).

At this point, it is worth repeating a similar warning from the Report of the Joint Parliamentary Committee on Human Rights (see previous blog).  It stated: “Giving undue priority to freedom of expression in primary legislation could undermine the ability of individuals to enforce their rights to privacy, a fair trial and freedom of assembly and upset the balancing exercise the courts currently undertake when competing rights are engaged” (para 210 of the Report).

Concluding comment

As stated in previous blogs, both the MoJ and DCMS consultations are seriously defective (see references for chapter and verse).  In both cases, the ICO response has called for a further round of “engagement” prior to any legislation being enacted (e.g. to clarify the omissions and errors).  This call for further consultation, I suspect, will fall on deaf ears.

Indeed, I have yet to see any proposal, in either the DCMS of MoJ consultation, that is well argued, supported by evidence and which improves the data protection lot of controllers or data subjects. Indeed, the DCMS requested respondents to provide the evidence it needed, whereas the MoJ consultation justified its arguments by wholly misrepresenting the relevant case law.

However, the political fact is that Government has a majority and is intent on pushing changes through, irrespective of the arguments, evidence or dissent.

So, at the end of this legislative process each of us will be faced a simple question: “Do you trust a Boris Johnson Government to protect your personal data to  high ethical and legal standards, especially your medical records or your electronic identity details?”.

I confess, I already know my answer to this question.

Summer Data Protection Courses

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection PRACTITIONER Courses is in London on Tuesday July 5-7; July 19-21 (6 days); full details by emailing info AT amberhawk.com
• The next Data Protection FOUNDATION Course is in London on Tuesday, July 12-14 (3 days); full details by emailing info AT amberhawk.com

References

Link to ICO’s Human Rights response: https://ico.org.uk/about-the-ico/consultations/ministry-of-justice-consultation-human-rights-act-reform-a-modern-bill-of-rights/

The Joint Committee of Human Rights Report into the MoJ proposals: link available from https://committees.parliament.uk/work/6404/human-rights-act-reform/publications/

My response to the DCMS Consultation (with links to my 7 blogs on different parts of the DCMS Consultation at the end of this blog): https://amberhawk.typepad.com/amberhawk/2021/11/data-a-new-direction-amberhawks-response-to-the-dcms-consultation.html

My response to the MoJ human rights Consultation (with links to my 4 blogs on different parts of the MoJ Consultation at the end of this link): https://amberhawk.typepad.com/amberhawk/2022/03/omissions-in-human-rights-proposals-degrade-privacy-and-freedom-of-expression.html

Government prepares to wave two fingers at UK’s Adequacy Agreement?

I have come to the conclusion that the Government does not care whether or not the UK’s Adequacy Agreement with the European Commission continues after its expiry (latest in mid-2025).

This conclusion is based on the well-publicised deficiencies in the two consultation exercises of the DCMS (on data protection) and MoJ (on human rights) and the recent report of Joint Parliamentary Committee on Human Rights into the MoJ proposals.  This latter Report carries many warnings concerning the Government’s intent to diminish individuals’ rights (see references).

This blog explains how I have arrived at my two fingered conclusion. It is not a deep analysis full of minutiae; the text is more a reflection on the current nature of the UK Government.

The UK’s Adequacy Agreement

In theory, Article 3(4) of the UK’s Adequacy Agreement allows for termination by the European Commission at any time.  However, there can be a long convoluted consultation process and I suspect that if the UK made significant changes to its data protection and human rights regime (as proposed), then the Commission will want to assess the impact of these changes on the rights and freedoms of European data subjects.

Such an assessment will take time (e.g. up to mid 2025).  However, a shorter timescale is more likely to be followed if the UK Government determines its post-Brexit trading partners (e.g. India; Australia) are adequate when the European Commission has made no such determination.  This shortening arises from the risks to European data subjects from onward transfers of personal data, from the UK, to these Third Countries.

Equally, the timescales could shorten if there are changes to the UK Human Rights regime as proposed by the MoJ (as these are more drastic than the DCMS proposals for change).

Important observations

There are four considerations:

• It is the European Commission that really decides on the status of its Adequacy Agreements with Third Countries; Countries like the UK do not apply for adequacy – it is more or less in the gift of the Commission (after a convoluted process). This could explain why the DCMS and MoJ Consultations do not mention the UK’s Adequacy Agreement in their respective consultations as there is nothing the UK could do if the Commission rescinded the UK’s Agreement tomorrow.
• The Adequacy Agreement with the UK contains expectations that the UK’s data protection and human rights regimes have specific characteristics; if the UK no longer wants to attain these expected standards, it is the European Commission that has to decide what to do.  Its choices are essentially limited to three options:  (a) maintain, (b) modify, or (c) rescind the current Agreement with the UK.
• The Government is arguably calling the Commission’s bluff. In effect it is saying: “the UK is going to change its privacy regime; if you Europeans don’t like what we are doing, then you can rescind the UK’s Adequacy Agreement if you want, but that might hurt trade and general co-operation with the UK on matters of mutual interest”.
• The Commission when making any assessment of the Adequacy Agreement will be looking at the protection of European data subjects, under the UK’s new DP/Human Rights regime, when their personal data is processed in the UK. It will NOT be looking at the protection afforded to UK data subjects; these rights and freedoms can be safely degraded, without any risk to Adequacy (e.g. in the way the DCMS and MoJ consultations propose).

Proposals for change: absence of evidence

The DCMS proposals for change in the UK’s data protection regime have been discussed in detail in previous blogs (see references); these proposals are characterised by omission (e.g. from Rosemary Jay), incomplete detail (e.g. from the ICO) and a lack of evidence for the proposed changes (e.g. from the DCMS consultation document itself).  As I have stated before, I am not the only person who is “harping on” about these failings.

Similarly, the DCMS and MoJ consultations ignored the link between data protection and Article 8 of the European Convention on Human Rights.  For what it is worth, the MoJ proposals have just been heavily criticised by the Joint Parliamentary Committee on Human Rights (JPCHR); it concluded that, contrary to the assertions of the MoJ, its proposals would “weaken human rights” and that there was “no real case for changing the HRA …” (see references; paras 25&26 of the JPCHR report).

As an aside,  I reported in the blog on the MoJ’s misrepresentation of ML v Slovakia and Ellis v Essex Police judgements in its consultation document.  The JPCHR Report similarly (politely) trashes most of the cases quoted by the MoJ; this is something I find shocking, especially as MoJ arguments for change depend on its view of these cases.

With respect to all qualified rights (e.g. A.8), the JPCHR have a stark warning which should be heeded by all:

“Giving undue priority to freedom of expression in primary legislation could undermine the ability of individuals to enforce their rights to privacy, a fair trial and freedom of assembly and upset the balancing exercise the courts currently undertake when competing rights are engaged” (para 210).

and

“The Government’s proposals …would limit the ability of individuals seeking to enforce their rights, for example, to private and family life…” (para 212).

Despite the lack of evidence, the Government published a Brexit Paper associated with the ‘Brexit Freedoms’ Bill” which promised legislation to enact major reform to the UK’s data protection regime.  This was followed by the Secretary of State for Brexit Opportunities, Jacob Rees Mogg, in the Sun Newspaper (9 Feb 2022);  he wrote that “….there will be a new approach to data, removing the EU’s cumber-some one-size-fits-all policy..”

Note that these statements promising legislation were made well in advance of the outcome or analysis of the DCMS or MoJ public consultations.

This explains why I think the consultations are largely irrelevant and the changes to the human rights and data protection proposals are being promoted as matters of political dogma.  Both the DCMS and MoJ “consultations” have been exposed as failed attempts to give its proposals a veneer of rationality and respectability.

Refreshing “Operation Save Big Dog”

This dogmatic approach to individual rights has coincided with Operation Save Big Dog (the name given last January to the effort expended to ensure the Prime Minister survived the fallout from several, alcohol-fuelled, “office-gatherings” at 10 Downing Street).

Over time, Saving Big Dog has taken the form of a wall-to-wall publicity concerning the actions of Big Dog himself: headlines and photo ops covering the Ukrainian war; the fuel and cost of living crisis; ending COVID restrictions; parking lorries on the M20 because there is no space in Dover; and the decision to send asylum seekers to Rwanda etc.

Such activity “justifies” the argument that because we are so dependent on the current (highly active) Big Dog making important decisions for all of us; appointing another Big Dog to make such decisions, just because of “a little local difficulty” over a few lockdown parties, is a distraction that the country can ill-afford.

Concluding comment

However, nothing has happened to remind the British public of the brilliance of the UK’s “oven ready” Brexit deal as implemented by our trustworthy Prime Minister.  For instance,  there has been very little of the promise to “take back control of our laws”.

But by pure happenstance, two committed Brexit Ministers (Nadine Dorries, Dominic Raab), who owe their political careers to the Prime Minister, happen to be in charge of the DCMS and MoJ.  They are responsible for their Departments’ defective consultation exercises and it is well known that a lack of evidence does not give such Ministers sleepless nights.

What better opportunity for symbolic action than to throw some red-meat to ardent Brexiters to indicate that the UK has taken back control of its data protection and human rights laws: “Let us show those Europeans how the UK protects its own citizens, and if that means waiving two fingers at that Adequacy Agreement, then so be it”.

Forget the paucity of evidence, the lack of detail, all the omissions and the erroneous analysis; these are unimportant.

And if need be, the Ministers can blame those Europeans for rescinding the UK’s Adequacy Agreement (just as the UK is doing with the fishing paperwork fiasco, lorry queues at Dover and the Northern Ireland protocol).

Summer Data Protection Courses

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next two Data Protection Practitioner Courses are in One starts Monday, May 16 (5 days) and the other on Tuesday July 5-7; July 19-21 (6 days); full details on www.amberhawk.com/StandardDP.asp or by emailing [email protected]
• The next Data Protection Foundation Course is in London, and starts Tuesday, July 12-14 (3 days); full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]

References

The Joint Committee of Human Rights Report into the MoJ proposals (a must read): download available from https://committees.parliament.uk/work/6404/human-rights-act-reform/publications/

The Adequacy Agreement with the UK: https://ec.europa.eu/info/sites/default/files/decision_on_the_adequate_protection_of_personal_data_by_the_united_kingdom_-_general_data_protection_regulation_en.pdf.

The Benefits of Brexit: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1052148/benefits-of-brexit-document.pdf

Rosemary Jay’s Independent evidence that the DCMS data proposals could undermine adequacy (and the like the ICO, where the DCMS Consultation is unclear or wrong-headed) https://amberhawk.typepad.com/amberhawk/2022/01/independent-evidence-that-the-dcms-data-proposals-could-undermine-adequacy.html

My response to the DCMS Consultation (with links to my 7 blogs on different parts of the DCMS Consultation at the end of this link): https://amberhawk.typepad.com/amberhawk/2021/11/data-a-new-direction-amberhawks-response-to-the-dcms-consultation.html

The link to four blogs and details of the MoJ human rights Consultation (see end of): https://amberhawk.typepad.com/amberhawk/2022/03/omissions-in-human-rights-proposals-degrade-privacy-and-freedom-of-expression.html

Does the new Information Commissioner’s speech offer reassurance?

This blog reviews the new Information Commissioner’s speech at the end of March to a group of IAPP data protection specialists.  The speech contained statements that I don’t recognise as being consistent with the DCMS proposals for changing the UK_GDPR.

One passage in the speech related to the general importance of the need for a lawful basis for many actions; whether that lawful basis relates to stop and search by the police, or the processing of personal data by a controller.  The Commissioner also stressed the importance of maintaining strong data subject rights and stated that this is a commitment found in the DCMS proposals.

Sadly, this and other blogs have pointed out (see references), the importance for a lawful basis is likely to be much degraded by the DCMS proposals to change the UK_GDPR; further significant degradation arises from the MoJ’s proposals to change the UK’s human rights regime.

Similarly, rights of data subjects could well be significantly diminished if the DCMS proposals are enacted whilst the MoJ proposals offer diminished respect for private and family life.

I have also come across published information from the Human Rights and Equality Commission, which indicates that the MoJ’s proposals for changes in the UK’s Human Rights Act is very likely to place the Adequacy Agreement with the European Community at considerable risk.

Human Rights and Adequacy

Like most commentators on the DCMS proposals, the Commissioner’s speech does not mention how the MoJ proposals, for changing the UK’s human rights regime, impacts on data protection.  This omission does not surprise as the MoJ itself makes no reference to data protection in its consultation document.

This is despite the fact that data protection is integrally linked to Article 8 of the European Convention on Human Rights (explicitly stated in Recital 1 of the old Directive 95/46/EC) and the fact that UK has signed an international agreement to submit to the judgements of the European Court of Human Rights (ECHR).

By contrast, the MoJ’s consultation document explains that submission to ECHR judgements is NOT on the menu (see references).  However, such submission is assumed by the Adequacy Agreement that guarantees the free flow of personal data from the European Union to the UK.  It follows that the Adequacy Agreement, which mentions the term  “human rights” more than 80 times,  is at risk if this standoff is enacted as part of UK law.

This risk is confirmed by the Equality and Human Rights Commission.  In it its evidence to the MoJ, the Commission states that its proposed changes that impact on data protection also comprise a “likely breach” of international human rights law (see full quote below) including that Adequacy Agreement.

The risk is not only to data subjects. For instance, would your company purchase “GDPR compliant” software or IT services from an organisation, established in the UK, when the UK has had its Adequacy Agreement withdrawn by the European Commission?

I suspect that, like the hedge fund associated with Mr. Jacob Rees-Mogg, such a software or IT services company would relocate to within the EU – thus reducing the attractiveness of the UK as a technology base.

Lawful basis

In his speech, the Commissioner referred to the case of Entick and Carrington from 1765, although the legal principles can be traced back to paragraphs 39 and 40 of Magna Carta 1215.

In Entick and Carrington, bailiffs from the king, without lawful authority, entered the plaintiff’s house looking for seditious material; they conducted a thorough search of private papers,.  The Court found in favour of the plaintiff, finding that for such an intrusion, the King himself, and his agents needed a clear legal authority that was absent in their search.

The Commissioner concluded: “…These concepts, that form the basis of our law, that you must have a lawful basis for rifling through my papers and information, that an individual is entitled to assert and exercise agency, and autonomy over his or her domain and personal affairs …”.

The MoJ’s human rights proposals (if enacted) would undermine the lawful basis for processing personal data.  They require the Courts to give “great weight” to the fact that Parliament enacts legislation that states that the processing is “necessary” or that the processing is in the “public interest”.  This requirement (e.g. to give great weight), will also applies to the Commissioner when enforcing relevant parts of the DPA2018 or the UK_GDPR.

As these words (especially necessary) are used in three Principles in A.5, A.6, A.9, A.23 (of the UK_GDPR) and Schedules 1 to 4 (of the DPA2018), it follows that enforcement of those provisions (e.g. the lawful bases in A.6) becomes far more difficult for the ICO.  A regulator whose enforcement (e.g. of lawful basis) which is fettered in this way has to be in a weaker position to protect data subject rights or interests.

The Equality and Human Rights Commission, in its evidence to the MoJ (see references), criticises this fettering in the following way. It states (my emphasis):

• “The proposed reform would require the courts to accept that the existence of the law is “determinative of Parliament’s view that the legislation is necessary in a democratic society” (as in Option 1) or “give great weight to the fact that Parliament was acting in the public interest in passing the legislation” (as in Option 2). “…We do not consider it necessary or appropriate to bind the courts in these ways…” and “….Courts are best placed to make such considerations on a case-by-case basis”.
• “We do not support Options 1 or 2 of the proposed clauses, and recommend that the Government avoid legislating in this area. An attempt to prescribe how UK courts should balance competing interests across different situations is likely to breach Article 1 and/or Article 13 of the ECHR and therefore fail to comply with the UK’s international legal obligations. Balancing human rights requires careful consideration of various factors”. (Answer to Q23 of the MoJ Consultation).

Note the Equality and Human Rights Commission strongly infer that the MoJ proposals would also comprise a “likely breach” of the Adequacy Agreement which is dependent on UK “submission” to the ECHR judgements.

In addition, the Commission infer that provisions that “bind” the Courts will also “bind” the ICO enforcement of provisions that depend on “necessary” or “in the public interest”  (e.g. enforcement of three Principles in A.5, A.6, A.9, A.23 and Schedules 1 to 4 of the DPA2018).

I should add, that under the DCMS proposals, there is something similar: certain processing will be deemed to be necessary in the public interest,  or certain processing can be designated to be necessary in the legitimate interests of the controller without consideration of any overriding legitimate interests of the data subject.  In other words, the processing is pre-ordained for the lawful basis in A.6(1)(e) or A.6(1)(f) and this position might have to be given “great weight” by the ICO.

In summary, the Commissioner’s comments in support of legal basis are most welcome; however, they do not reflect the Government’s proposals as described above and in the DCMS and MoJ consultation documents.

Weakened data subject rights?

The Commissioner, in his speech, states “If anything, I can see a clear intention to reduce regulatory burdens, in order to create a streamlined law that more effectively protects people’s rights”.

I can see how a streamlined law reduces the regulatory burdens; I have great difficulty seeing how this reduction “effectively protects peoples’ rights”.  If anything, with respect to data subject rights, the DCMS (and MoJ) proposals are likely to do the precise opposite.

For example, looking at both consultations together only in relation to data subject rights, they:

• do not consider the chilling effect on the right of subject access (A.15) if an access fee is introduced (e.g. the DCMS consider impoverished data subjects could use the services of unspecified Third Parties); the introduction of a fee is also a clear breach of A.12(5).
• do not consider the how the “right to object” (A.21) works in practice (e.g. when the DCMS Consultation proposes Ministerial powers to determine that processing that was “in the public interest“, “necessary for a public task” or always “necessary” in the controller’s legitimate interest).  The right to object is also negated if there were to be a “research lawful basis”; the DCMS fail to consider this link to rights in their consultation.
• do not consider the impact on the right not to be profiled in A.22 (e.g. where the DCMS consultation refers to legislation allowing more profiling and automated decision taking to be undertaken); instead the DCMS refers to the prospect of removing the right not to be profiled.
• do not consider the impact on the right to erasure, as expressed in A.17(3)(a), when there is a need to balance of interests between individual privacy and the freedom of expression and to impart information.   In fact the MoJ proposals intend to tilt the current balance in favour of the latter.
• do not consider the impact of the introduction of new exemptions from rights from any UK_GDPR right as being “necessary” or “in the public interest” merely because the exemption has been approved by Parliament in secondary legislation (e.g. an example is provided by “The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022”).
• do not consider the impact of the introduction of new justifications for processing health records, other special category of personal data and criminal offence personal data on the right to respect for private and family life (e.g. any law that states the processing is “in the public interest” (or “necessary”) merely because these terms are found in a law that has been determined by Parliament.
• do not consider the impact of the enforcement of data subject rights in a revised data protection regime, if the Commissioner has to consider issues that have nothing to do with data protection (e.g. the requirement for the Commissioner to consider economic matters or public safety issues on the ability to enforce the rights of data subjects).

By contrast the Commissioner believes that the DCMS proposals, if enacted, would allow a EU data subject to enjoy “the same level of protection in Manchester as it does in Munich” ; he struggles “to see how the legal protections will be less in Cardiff than is afforded to those in Copenhagen”.  Given the above, I find it hard to justify such statements.

Concluding comments

In her evidence to the DCMS,  Elizabeth Denham pointed out she could not comment in detail on many of the DCMS proposals, because she did not know the detail of what was being proposed.  Indeed, I have documented 30+ incidences where the previous Commissioner effectively said – “no comment; I don’t know what the DCMS intend” (see references).

In other words, the previous Commissioner was not in a position to make the claims made by the new incumbent.  For instance, when the new Commissioner asserts that “… DCMS have committed to maintaining high standards of protection….”, I have to point out there is a dearth of evidence to support this assertion.

Finally, I should state that is not the position of the Commissioner to campaign against or overtly criticise DCMS and MoJ proposals to change the law; that is the role of Parliament unless there is an invitation to comment as in a public consultation.

Equally, it is not the role of the Commissioner to open himself to the accusation that he is supporting official proposals for change when they are palpably characterised by omission (e.g. Ms. Denham’s evidence), incompleteness (e.g. omitting concerns over A.8 and A.10 human rights) and defective analysis (e.g. see Rosemary Jay’s evidence to the DCMS).

See, you don’t have to take it from me (see references).

BCS Qualification Courses in DP (May/July 2022)

Because of continued COVID uncertainty, the courses below,  leading to the relevant BCS qualification in data protection, can be attended in person, or via Zoom, or as a mixture if you something untoward happens (e.g. you have to isolate mid-course).

• The Data Protection Foundation Course is in London, and starts Tuesday, May 9-11 (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]
• The Data Protection Practitioner Course is in London, and starts Monday, May 16-20 (5 days each 9.30-5.30); Same syllabus as 6 day course but longer days; details on amberhawk.com/StandardDP.asp or by emailing [email protected]. The next 6 day Data Protection Practitioner Course is in London on 5-7 July and 19-21 July.  Details from the links already given.

References

1. Entick v Carrington [1765] EWHC KB J98.
2. ICO’s speech to the IAPP, 24 March 2022: https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2022/03/iapp-data-protection-intensive-uk/
3. The Equality and Human Rights Commission evidence to the MoJ on Human Rights in the UK (click 2022): https://www.equalityhumanrights.com/en/legal-responses/consultation-responses
4. My MoJ views are based on the text of my blogs:

18 Jan 2022: UK’s human rights proposals significantly weaken protection for all data subjects https://amberhawk.typepad.com/amberhawk/2022/01/uks-human-rights-proposals-significantly-weaken-protection-for-all-data-subjects.html

26 Jan 2022: Human Rights proposals undermine Data Protection and Adequacy https://amberhawk.typepad.com/amberhawk/2022/01/human-rights-proposals-undermine-data-protection-and-adequacy.html

28 Feb 2022: Proposals to strengthen journalists’ freedom to report is based on a fundamental misreading of ECHR judgment https://amberhawk.typepad.com/amberhawk/2022/02/proposals-to-strengthen-journalists-freedom-to-report-is-based-on-a-fundamental-misreading-of-echr-j.html

8 March 2022: Omissions in Human Rights proposals degrade privacy and freedom of expression https://amberhawk.typepad.com/amberhawk/2022/03/omissions-in-human-rights-proposals-degrade-privacy-and-freedom-of-expression.html

5. The blog where I identify 30+ proposals where the previous ICO said she did not know what the DCMS was proposing. https://amberhawk.typepad.com/amberhawk/2022/02/outcome-of-dcms-data-protection-consultation-pre-determined-it-helps-to-save-big-dog.html
6. My blogs on the DCMS proposals themselves that show many of the DCMS proposals are defective or make serious omissions: see the list of 7 blogs at the end of: https://amberhawk.typepad.com/amberhawk/2021/11/data-a-new-direction-amberhawks-response-to-the-dcms-consultation.html
7. Rosemary Jay’s evidence to the DCMS (download at end of): https://amberhawk.typepad.com/amberhawk/2022/01/independent-evidence-that-the-dcms-data-proposals-could-undermine-adequacy.html
8. Unlike the Equality and Human Rights Commission, the ICO has yet to publish its response to the MoJ.  I will put a URL here when it is published.

Omissions in Human Rights proposals degrade privacy and freedom of expression

A brief blog to encourage readers to submit comments to the MoJ's Human Rights consultation that ends today at a minute to midnight.  I also make available a copy of my evidence to the MoJ (see references).

This Consultation has slipped through the net relatively unnoticed as it is aimed at “legal practitioners”, “experts”, “academics” and “advocates of human rights law”. The Consultation is NOT aimed at the 60 million data subjects who are directly affected by the proposed changes.  Although the consultation period closes tonight there is an extended period of 19^th April date for those who need Easy Read or audio versions of the consultation documents.

It is also alarming that the former appeal judge who led a government-commissioned review of the Human Rights Act has told MPs he does not consider that the government’s consultation on reforming the 1998 legislation reflects his report.

The major problems with the Consultation can be summarised by what it does NOT state.  These omissions can be listed as follows:

• Absence of any consideration or analysis of the impact of the human rights proposals on the current UK_GDPR data protection regime in the UK or how they impact on data subjects (60 million in the UK alone them).
• Absence of any consideration or analysis of the impact on the proposals for changing the UK Data Protection Regime as proposed by the DCMS in a separate consultation “Data: a new direction”.
• Absence of any consideration or analysis of the impact of these proposals on the Adequacy Agreement agreed with the European Commission, resulting in the likely cessation of that Agreement.
• The lack of evidence for rebalancing Articles 8 and 10 (private and family life versus freedom of expression and to impart information) as proposed in the Consultation.
• Absence of any consideration or analysis of the impact of these proposals on the provisions that relate to the Special Purposes in the DPA2018.
• Absence of any consideration or analysis of the impact of these provisions on the FOI/FOISA or EIR/EIRSA regimes (e.g. the data protection/FOI interface).
• Misrepresentation of case law that relates to the processing of personal data mentioned in the Consultation (e.g. ML v Slovakia; Ellis v Essex Police) and omission of relevant case law (e.g. Stanley et al v Met. Police and L.B. Brent; Marper v UK)
• The lack of due process in Parliament to ensure changes to the human rights of UK citizens are subject to detailed scrutiny. The proposals include the use of secondary legislation (i.e. via Ministerial powers) to deliver changes to individual human rights with minimal involvement of Parliamentary scrutiny (this use of secondary legislation is wholly unacceptable in my view).

I should add, there is no reference in the Consultation to the proposed changes arising from the Judicial Review and Courts Bill that is intend to restrict Judicial Review and certain decisions of the Upper Tribunal.  Given that with respect to A.8 and data protection, Judicial Review is a major safeguard for data subjects (e.g. in facial recognition CCTV; immigration exemption) this omission is also surprising.

How can you have a public consultation with these gaps?  However, I conclude, in data protection terms that:

• the Consultation, if its proposals are enacted, is likely to result in weaker protection for data subjects whenever a controller’s processing of personal data is “necessary” or “in the public interest”; this weakening can extend to private sector controllers via A.6, A.9 and A.5 Principles.
• The fact that the DCMS Consultation did not discuss the impact of its proposed changes on the Adequacy Agreement (e.g. lack of an independent regulator) nor on the relationship between data protection and human rights is astonishing.
• The fact that the Consultation did not discuss the knock-on effect of the proposed human rights changes on data protection enforcement (e.g. via processing that is “necessary” or “in the public interest”) is also astonishing.
• The Adequacy Agreement is likely to be revoked. This is a subject is also deemed unworthy of mention in the Consultation.

Data Protection Courses (Spring 2022)

Because of continued COVID uncertainty, the course can be attended in person, or via Zoom, or as a mixture if you something untoward happens (e.g. you have to isolate mid-course).

• The Data Protection Practitioner Course is in London, and starts Tuesday, March 22-25; March 29-31 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]
• The Data Protection Foundation Course is in London, and starts Tuesday, May 9-11 (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]

References

Appeal Court judge's comment on MoJ proposals: https://www.lawgazette.co.uk/news/human-rights-act-consultation-not-a-response-to-my-report-gross/5111359.article

MoJ Consultation details on: https://www.gov.uk/government/consultations/human-rights-act-reform-a-modern-bill-of-rights

Link to Hawktalk's evidence to the MoJ: Download Response to MoJ HRA changes

That evidence is based on the text of my blogs:

• 18 Jan 2022: UK’s human rights proposals significantly weaken protection for all data subjects https://amberhawk.typepad.com/amberhawk/2022/01/uks-human-rights-proposals-significantly-weaken-protection-for-all-data-subjects.html
• 26 Jan 2022: Human Rights proposals undermine Data Protection and Adequacy https://amberhawk.typepad.com/amberhawk/2022/01/human-rights-proposals-undermine-data-protection-and-adequacy.html
• 28 Feb 2022: Proposals to strengthen journalists’ freedom to report is based on a fundamental misreading of ECHR judgment https://amberhawk.typepad.com/amberhawk/2022/02/proposals-to-strengthen-journalists-freedom-to-report-is-based-on-a-fundamental-misreading-of-echr-j.html

Proposals to strengthen journalists’ freedom to report is based on a fundamental misreading of ECHR judgment

The Ministry of Justice (“MoJ”) Consultation,  “Human Rights Act Reform: A modern Bill of Rights” (the “Consultation”), contains proposals that tips the balance between “respect for private and family life.” (A.8) and freedom of expression and to impart information (A.10) in favour of the latter (A.10).

Quoting a single ECHR judgment (ML v Slovakia) as justification for the changes, the Consultation fails to realise the judgment does the precise opposite.   A case which initially appears to be one where the public interest in the information is high, soon dissipates as it is discovered that the tabloid journalists concerned did not even exhibit a basic level of journalistic integrity.

As reported in my previous blogs, the Consultation is ignorant to the impact of its proposals on the parts of the UK_GDPR relevant to the A.8/A.10 balance (e.g. the A.17(3)(a) exemption from the right of erasure; the journalists code of practice being prepared by the ICO; the Special Purpose Exemption in Schedule 2, Part 5).

These omissions undermine the quality of the Consultation’s arguments.

The current balance between A.10 and A.8

The balance between the protection of private and family life and the freedom to impart information is equally balanced and one right does not take precedence over the other.  This position was set out a recent case before the Supreme Court (Bloomberg v ZXC; see references).

“Both [rights] reflect important civilised values, but, as often  happens, neither can be given effect in full measure without restricting the other.  How are they to be reconciled in a particular case?  There is in my view no question of automatic priority. Nor is there a presumption in favour of one rather than the other.  The question is rather the extent to which it is necessary to qualify the one right in order to protect the underlying value which is protected by the other” (para.57).

The Bloomberg case concerned a US citizen who worked for a company which operated overseas that became subject of a criminal investigation.  A confidential Letter of Request from the relevant authorities was sent seeking information and copies of documents; the Letter expressly requested that its existence and contents remain confidential.

Bloomberg obtained a copy of the Letter, and published an article based on the Letter reporting that information had been requested in respect of an individual (ZXC) and detailing the matters in respect of which ZXC was being investigated.  Bloomberg was later sued by ZXC for misuse of private information; Bloomberg lost and eventually their Appeals reached the Supreme Court.

The Supreme Court came down on the side of ZXC stating that “in general, a person under criminal investigation has, prior to being charged, a reasonable expectation of privacy in respect of information relating to that investigation”.

Note that the use of the words  “in general” shows that there is a presumption that persons under criminal investigation have their privacy maintained during that investigation unless there is a good reason for this not to be the case (e.g. as in historic sexual abuse investigations where there may be a need for other victims to come forward).

This position is current public policy, the argument being that there is a negative effect on an innocent person’s reputation if he or she is publicly identified as being investigated for a crime which is not even before the courts (i.e. prior to any charge).  Additionally,  publicity could impact on the investigation (e.g. by alerting the actual criminal to the existence of an investigation).

As can be imagined, the Supreme Court judgement has not gone down well with the media, who prefer the default position should always be in favour of openness rather than secrecy.  Naturally, they are quite happy that there is a presumption that those under investigation can be identified by the press unless there is a good reason for the opposite.

That is why the question of “which view prevails?” (i.e. public disclosure in the press) depends on the facts of the case – which of course is the current balance between A.8 and A.10.

The MoJ proposals

The Consultation argues that the freedom to impart information to the public should prevail in many circumstances.  This is spelt out by the Consultation in the following terms:

“..the Bill of Rights legislation should contain a stronger and more effective provision, making it clear that the right to freedom of expression is of the utmost importance, and that courts should only grant relief impinging on it where there are exceptional reasons”. (para 213; my emphasis)

In justification of this position, the Consultation does not consider any UK judgement where the press have found a problem with A.8.  This is surprising as there are over a 100 such cases and one would have thought that the Consultation would have been spoilt for choice (see references for a list of cases dating from 2010).

Instead the Consultation justifies the need for change by citing the ECHR judgement in ML v Slovakia (see references) as follows:

“But at the same time, the case law of the Strasbourg Court has shown a willingness to give priority to personal privacy, including in a recent judgment finding that media reporting about a deceased priest’s convictions for child sexual abuse and public indecency could interfere with his mother’s right to private life, drawing, in part, on the so-called ‘right to be forgotten’ invented by the Court of Justice of the European Union” (para 206 of Consultation)

I suspect the authors of the Consultation have not read the judgement.  For instance, I don’t think that judicial commentary like:  the journalists concentrated  “on sensational and, at times, lurid news, intended to titillate and entertain” helps the case for more protection of freedom of expression.

I also suspect the reference to the “so-called right to be forgotten” in the above has been included for pejorative effect.  The Consultation omits the fact that this right exists in the UK_GDPR as an exemption from the right to erasure on the grounds that the freedom to impart information to the public should prevail (see A.17(3)(a) of the UK_GDPR).

Finally, the authors of the Consultation failed to realise that the priest is deceased; the “so called right to be forgotten” does not apply and is completely irrelevant.

ML v Slovakia

In practice,  the ML v Slovakia case is really about two questions:

• can personal information about the dead fall within the scope of Article 8 of the Convention out of respect for the feelings of the deceased’s relatives? (The Court’s answer is “yes”).
• If so, to what extent can personal information about the dead be published by the press. (The Court’s answer is “it depends on the facts of the case”).

The press stories under scrutiny related to a Roman Catholic priest who had been cautioned / convicted in relation to sexual abuse and disorderly conduct (consensual oral sex in a public place).  All criminal convictions / cautions had become spent and the priest died in 2006, possibly by suicide.

In 2008, three tabloid newspapers published articles about the priest’s conviction for sexual abuse and a possible link to his supposed suicide. The articles were headlined: “Priest confessed to abuse of minor boys. Secret of priest’s suicide”, “Priest abused Roma boys. He confessed before his suicide”, and “Protected priests. The Church provided a guarantee to get a paedophile priest out of prison”.

The articles asserted that the priest had confessed to the bishop and the Church then offered a the authorities a guarantee of future good behaviour; that explained how the priest avoided prison. Suicide was reported as a fact.

Given recent history of the Church on this subject, there appears to be a strong public interest in this story.

So what went wrong?

As far as the journalists were concerned, their freedom of expression arguments went pear shaped because they could not present any evidence backing up their stories.  For example, the bishop said he wasn’t contacted by the press about the case, evidence of police contacts were lost, and internet allegations about the priest (e.g. suicide) were reported in newspaper stories as facts.

To give a flavour of these issues, the judgement notes:

“The journalist M.K. referred to a very good source who had provided him with a written document, and to a police record concerning the questioning of the applicant’s son; he claimed to have verified the authenticity of the written document but did not remember any details.  M.K. asserted that he had also contacted police spokespersons and had sent an email to the bishop’s office, but he was not sure whether he had saved their exchange”.(para 10 of judgement).

The result was that the Slovakian District Court ordered each of the defendants (i.e. the journalists) to publish a formal apology to the priest’s mother for having published untrue allegations about her late son, but dismissed her financial claims.  This judgment was then subject to a series of appeals before the case eventually ended up at the ECHR.

I give five quotes from the judgement about the journalistic standards the ECHR encountered; they need no further embellishment from me except to emphasise some key words:

• “Although the journalists must be afforded some degree of exaggeration or even provocation, the Court considers that the frivolous and unverified statements about the applicant’s son’s private life must be taken to have gone beyond the limits of responsible journalism” (para 47).
• “... the Court is ready to accept that the distorted facts and the expressions used [by the press] must have been upsetting for the applicant and that they were of such a nature as to be capable of considerably and directly affecting her feelings as a mother of a deceased son”.  (para 48)
• “…the Court reiterates that there is a distinction to be drawn between reporting facts - even if controversial - capable of contributing to a debate of general public interest in a democratic society, and making tawdry allegations about an individual’s private life”.. (para 53)
• [with respect to the public interest] “….the pre-eminent role of the press in a democracy and its duty to act as a “public watchdog” are important considerations in favour of a narrow construction of any limitations on freedom of expression.   However, different considerations apply to press reports concentrating on sensational and, at times, lurid news, intended to titillate and entertain, which are aimed at satisfying the curiosity of a particular readership regarding aspects of a person’s strictly private life”. (para 53)
• “Thus, the Court finds that, as well as being rather provocative and sensationalist, the articles in question could hardly be considered as having made a contribution to a debate of general interest”. (para 54)

Concluding comment

So, given the above, do you think ML v Slovakia supports the Consultation’s position?  Is the journalism identified by the judgement be the kind of journalism that UK law should protect?

I find it astonishing that the Consultation attempts to base its arguments to rebalance A.8/A.10 on a case that is so critical of journalistic ethics and standards when there is a hundred British cases to choose from.  It adds to the general concern expressed in my other blogs: the lack of evidence that supports the proposed changes to the Human Rights Act.

I suspect a main driver for change is the same one that scrapped the second part of the “Leveson Inquiry - Report into the culture, practices and ethics of the press”.   It is a “thank you for your continued support”, aimed at the Brexit supporting tabloid press, from a Government that has serious issues concerning honesty, truth and credibility.

Data Protection Courses (Spring 2022)

Because of continued COVID uncertainty, the course can be attended in person, or via Zoom, or as a mixture if you something untoward happens (e.g. you have to isolate mid-course).

• The Data Protection Practitioner Course is in London, and starts Tuesday, March 22-25; March 29-31 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]
• The Data Protection Foundation Course is in London, and starts Tuesday, May 9-11 (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]

References

Bloomberg LP v ZXC  [2022] UKSC 5

Cases involving A.8 versus A.10 – see Informm’s list on  https://inforrm.org/table-of-cases-2/

ML v Slovakia [2021] ECHR 821.  Just Google the reference

The Times is quoted in the 11KBW blog: https://panopticonblog.com/2022/02/25/bloomberg-v-zxc-the-supreme-court-decides/