Hawktalk

UK’s “world class” data protection regime had 20 faults

Since the Brexit Vote in 2016, the Government has described the UK’s data protection regime (e.g. the DPA1998) as “world class”.  This description has stuck in my craw because, since 2005,  I have unsuccessfully tried to “liberate” official information, held by Government, concerning several deficiencies in this “world class” regime.

Nearly two decades of Freedom of Information (FOI) requests later, last month (March 31^st), I “ZOOMed” into another “Groundhog Day” FOI Tribunal to make the latest round of arguments.  This blog updates readers as to what transpired.

The FOI request under discussion was made on the day after the commencement of the Data Protection Act 2018/GDPR in the UK (i.e. at the end of May 2018).  I asked for details of the infraction proceedings relating to the repealed DPA1998 (which was the UK’s implementation of the repealed Directive 95/46/EC);  note my emphasis on “repealed”; I naively thought there would not be a problem.

However,  this time I also decided to make an identical FOI request for the same information to the European Commission via Regulation 1049/2001.  So did the same request, for the same information, made at the same time under different FOI regimes, result in the same outcome?  Of course not  - and thereby hangs a tale.

The UK Government, supported by the Information Commissioner (Decision Notice FS50812647) opposed disclosure of the requested information on the grounds that the European Commission vehemently opposed disclosure.  The European Commission told the UK Government that releasing any of the requested information to me would be so damaging that it could undermine adequacy negotiations between the UK Government and Commission.  The UK Government took this prospect seriously so it refused to provide the information; the ICO following in agreement.

By contrast, the European Ombudsman decided that since all but one of the problem areas associated with the DPA1998 were resolved, the European Commission could provide access to the requested information without any detriment to anything (apart from one issue that was unresolved).  The Commission refused to countenance the Ombudsman’s recommendation to disclose, with the result that the Ombudsman made an official finding of maladministration against the Commission (reference 1632/2018/THH).

This divergence of view between European Ombudsman and ICO about the same FOI request has allowed me to draw two general conclusions:

• since 2005, various Information Commissioners have repeatedly made significant errors of judgement by maintaining absolute silence about the defects in the DPA1998; and
• the Freedom of Information regime that applies to the European Commission (Regulation 1049/2001) is not fit for purpose.

In this blog, I will briefly substantiate each of these conclusions.

Before going further, it would be helpful to outline the totality of what I know about the problems with the “world class” DPA1998.   There were 20 issues of concern identified by the Commission before 2010; these covered 15 Articles (or nearly half of Directive 95/46/EC).  Issues identified included: definitions (personal data and relevant filing systems), data subject consent, enforcement powers of ICO, the treatment of criminal offence personal data, subject access rights, transfers outside the EEA, exemptions from rights, and judicial remedies for data subjects.

Can we agree that this is not a trivial list of problems.

Why the ICO has made errors of judgment?

Can you cast your mind back to the surveillance society debates that surrounded the voluntary Identity (ID) Card in 2006?

There was to be a comprehensive National Identity Register that recorded privacy-intrusive details on every ID card transaction (e.g. the Register captured personal data as to when and where each individual produced their ID Card for inspection in order to obtain a particular public or private sector service).

Additionally, personal data stored on the Register could be shared to improve the efficiency of public service delivery and initially, individuals would consent voluntarily into showing their ID Card. The DPA1998 was touted by Home Office Ministers as offering sufficient privacy protection for data subjects.

So, should all the Parliamentary Committees scrutinising ID Cards and related surveillance issues surrounding the Register, have been informed that the European Commission thought the definition of “personal data” used in the DPA1998 was defective?  Should they also have known that the UK’s concept of “consent”, as defined in Directive 96/46/EC, was also considered by the Commission to be defective?

Indeed, should all these Committees have access to the detail surrounding all of the 20 or so defects in the DPA1998, in order to assess their relevance to the surveillance issues before each Committee?  I think the answer is “yes”.

Move forward a decade to the adequacy arrangements themselves post Brexit. Should all the Parliamentary Committees considering post-Brexit data transfers with the European Union have known that the European Commission had concluded that the DPA1998 transfer arrangements were defective?

Should these Committees also have known that the Commission was concerned that the 20 or so defects might resurface in the UK_GDPR or DPA2018 and that this could impact on the UK’s adequacy determination? (The European Commission made this point before the European Ombudsman and ICO).

There again my answer is “yes”.

Hence, my conclusion that each of the various Information Commissioners made a serious error of judgement when each failed to make public the alleged defects in the DPA1998.

By keeping silent, each Commissioner facilitated a lack of Parliamentary scrutiny. Without Parliament knowing the detail (or relevance) of the European Commission’s concerns, I cannot see how any Parliamentary scrutiny of legislation that relied on the processing of personal data can be regarded as being complete.

Indeed, there is little point having an independent Regulator (or even a single corporate mission statement about protecting data subject rights), if the relevant corporate body keeps stum for a decade and a half, about 20 potentially serious defects in the Data Protection regime which has impacted on 60,000,000 UK citizens.

Regulation 1049/2001 is not fit for purpose

Continuing this theme, there is little point of having an FOI regime that cannot be enforced if the Regulator’s decision goes against the public authority.  Equally there is little point having an independent regulator if that regulator’s decisions can be ignored by the public body that holds the requested information.

This was the position I found myself with the Ombudsman’s decision in my favour; it is unrealistic to expect citizens in my position to commence legal proceedings against the European Commission before the CJEU.

In my case, the Ombudsman proposed that “in the interests of transparency and accountability, the Commission should reconsider granting access to those documents that related to the issues already resolved in the (formally still ongoing) infringement procedure. The Commission refused to do so”.

The Ombudsman added that the Commission’s “approach clearly places unnecessary obstacles in the path of citizens wishing to exercise their fundamental right of public access to documents. Similarly, it undermines the trust of citizens in the work of the EU institutions.”

At the Tribunal hearing, I added that I thought “the Commission had scored an own goal”.  For “if the Commission had released limited information or engaged with the British Public concerning some of the deficiencies in the UK’s Data Protection Regime between 2004 and 2018,  it would have been seen as a protector of UK data subjects”.

“Perhaps then, fewer UK data subjects would have voted to leave the EU”.

Independent FOI regulators?

In relation to my FOI request, the evidence shows that the Information Commissioner initially followed the “reasonable” suggestion of the European Ombudsman and moved in the direction of only withholding information pertaining to the one outstanding issue identified by the Ombudsman.  The ICO then wanted to know what the relevant Government Department (DCMS) thought of this idea.

The DCMS contacted the European Commission which came back with an abrupt two line instruction on the lines of:  “The European Commission has maintained its requirement that the UK continues to treat the material or information as confidential”.

Whilst this bold assertion did not work on the European Ombudsman (who rejected the Commission’s use of any exemption from its FOI regime), it did work on the DCMS who applied an exemption in the FOI regime (S.27 of FOIA).  The ICO sadly reversed her view mentioned in the previous paragraph and obediently fell into line.

In summary, what was prejudicial to international relations in the UK (the exemption used by DCMS), was not prejudicial to international relations on the other side of the English Channel (even though the exemption appears in A.4(1) of the Regulation). So what was going on?

First, the adequacy agreement would assist an estimated £120 billions of trade per year.  Is it credible to believe that this adequacy arrangement would be put in jeopardy by the release of information, nearly two decade olds,  relating to repealed legislation, and concerning data protection issues that have been resolved?  I don’t think so.

Secondly, could the ICO be sacrificing her FOI independence in favour of a quiet life with her funding Department for FOI purposes?  Well, I am sure many might consider this as a plausible explanation but there is no evidence that this is the position.  However,  it is clear that the Government is moving towards installing a more “understanding” Commissioner (see references) for data protection reasons.

In conclusion, I think the refusal is all about maintaining secrecy.  The two protagonists are setting the scene just in case there is disagreement concerning the adequacy agreement itself.  If there is a disagreement, then another set of infraction provisions will kick in and nobody external to the European Commission or UK Government will be any the wiser.

Like the defects in the DPA1998, the whole area of dispute will be smothered in a protective blanket of perfect darkness.

However, my duplicate FOI request has drawn attention to two important questions: “is the UK ICO truly independent as an FOI regulator?” and “has the European Ombudsman got sufficient powers to enforce its FOI regime”.  My experience shows that it is difficult to answer “YES” to both.

References

Ombudsman reference 1632/2018/THH: https://www.ombudsman.europa.eu/en/decision/en/115947

ICO Decision Notice reference FS50812647  (Google the Decision Notice)

An amiable ICO? see https://amberhawk.typepad.com/amberhawk/2021/03/the-next-information-commissioner-likely-to-dance-to-the-governments-tune-and-thereby-lack-credibili.html

I don’t want to repeat the ins and outs of a saga that started in 2004. However, the following blog reference gives the grim detail (at the end of the blog) with references to all the relevant material, extracted with pain, from a reluctant European Commission: https://amberhawk.typepad.com/amberhawk/2017/03/uks-gdpr-law-will-not-be-judged-adequate-if-it-contains-provisions-that-made-the-dpa-inadequate.html

Upcoming Data Protection Courses

All courses lead to the relevant BCS qualification:

• Data Protection Foundation: London, Starts April 27-29 (3 days)
• Data Protection Practitioner: London, Starts May 11 (6 days)
• Data Protection Upgrade Practitioner: London, May 25-26 (2 days)<LAST ONE

Full details on www.amberhawk.com of by emailing in[email protected]

Upper Tribunal undermines data breach reporting under the UK_GDPR?

The Upper Tribunal (UT) appeal [DSG Retail Limited -v- ICO; see references] is important even though it relates to the DPA1998; the judgement has the potential to undermine the data breach reporting requirements of the UK_GDPR/DPA2018. This blog explains why this is the case, why legislative changes might prove to be necessary and, for good measure, provides details of two errors in the UT’s analysis.

The appeal concerns the meaning of “personal data” in the context of the security obligations of the DPA1998.  In summary, the ICO’s position was as follows:  DSG Retail had poor security and it reported the loss of 5.6 million credit card numbers and expiry dates.  As a result the ICO levied a large Monetary Penalty Notice, originally £500K but later reduced to £250K.

DSG’s successful counter argument was as follows: although the data lost by DSG Retail were personal data, the data were not personal data in the hands of the hackers. This was because data subjects could not be identified using “reasonable means” (the test described in Recital 26 of both Directive 95/46/EC and UK_GDPR).

Because there were no personal data in the hands of the hackers, there could be no “substantial damage or distress” caused by the data breach (the threshold for a Monetary Penalty Notice under the DPA1998). So it followed, that there should be no fine at all.

To cut to the chase, this latter view was preferred.

Why an impact on the UK_GDPR?

First, the UT stressed that the parties to this appeal accepted (i.e. the ICO accepted) “… that the relevant provisions of the ‘new’ regime under the Data Protection Act 2018 (DPA 2018) and the UK General Data Protection Regulation (UK GDPR) are materially the same”.

Second UT concluded that if there were to be a hacking incident involving a controller’s personal data and if the data exposed were not personal data in the hands of the hacker, then there would be unlikely to be a risk to data subjects.

It follows that in UK_GDPR terms, a personal data breach involving millions of credit card details (as per DSG Retail)  would not even be reportable under the UK_GDPR terms as a personal data breach, as that breach “is unlikely to result in a risk to the rights and freedoms of natural persons” (the threshold in A.33(2)) assuming the hackers do not know who has what credit card.

Yes, there has been a personal data breach on the part of the controller,  but there is no risk to data subjects as the hackers are unable to reidentify data subjects using reasonable means (see Recital 26, UK_GDPR).

It then follows that such a personal data breach is not reportable to the ICO and it also follows that the ICO will become ignorant of these serious types of mega breaches of security.

This is a consequence of the UT conclusion: “As the risk to be guarded against is the risk of data processing by third parties, the question of whether personal data is involved is to be judged from the perspective of the data that the third parties can access (rather than the entirety of the data held by the data controller)” (my emphasis of para 123).

Of course it could be claimed that the controller has breached other security provisions (e.g. the requirements in A.32).  But if the ICO is unaware of this kind of non-reportable security breach, it is difficult to see how these provisions are enforced.

This explains why a change in the law might be needed (e.g. for the controller to report to the ICO, large personal data breaches involving millions of records irrespective of the risks to data subjects).

The history relates to FOI

Readers steeped in freedom of information legislation (FOI) should recognise the dilemma of whether a third party requestor holds personal data or not.  It arises, for example,  when a FOI requestor asks for statistical data which are derived from personal data; for instance, “how many late abortions were there in the North of England last year”.

Now quite clearly in the hands of the NHS, the information is personal data as they know the identity of the patients having late abortions.  However, in the hands of the FOI requestor, the number of late abortions does not lead to the identification of these patients (using the “reasonable means” available to the requestor).

It then follows that a public authority (e.g. a NHS body) that received this type of FOI question would not be able to apply the FOI exemption associated with the protection of personal data, because in the hands of the requestor, the requested statistics do not lead to the identity of any data subject.

This is different to the FOI request of the form: “how many pupils, attending St. Mary’s School in Putney, were excluded last term?”.  In this case, the highlighting of the particular school, means it’s quite simple to go to the school in the morning and ask the Mums in the playground: “who has been excluded?”.

With this latter type of FOI request, the exemption to protect personal data does apply because in the hands of the requestor, the statistics can lead to the identification of data subjects using “reasonable means”.

As an aside, anyone who wants to explore the current case-law on this dilemma (which gave rise to the ICO’s idea of a “motivated intruder” test) this UT judgement is highly recommended.

So did the UT get it wrong (error 1?)

The first problem is that the UT, to arrive at its conclusions, over-relied on the “motivated intruder” test as formulated by the ICO.  This test permeates the UT’s discussions of “personal data”.

The judgement approvingly quotes the ICO’s motivated intruder” test:

“… assumes that the ‘motivated intruder’ is reasonably competent, has access to resources such as the internet, libraries, and all public documents, and would employ investigative techniques such as making enquiries of people who may have additional knowledge of the identity of the data subject or advertising for anyone with information to come forward.

The ‘motivated intruder’ is not assumed to have any specialist knowledge such as computer hacking skills, or to have access to specialist equipment or to resort to criminality such as burglary, to gain access to data that is kept securely.”  (my emphasis of para 14 of Judgement).

Now please answer the following YES/NO question: do you expect a hacker, who has used unlawful means to exfiltrate DSG’s data, to only use lawful means as a motivated intruder to complete the identification of data subjects?

Or do you think it reasonable to assume that our motivated intruder would also rely on unlawful means (e.g. to complete identification of data subjects by searching the dark web to see if anyone had, for example, lists of credit card numbers linked to credit card holders).  If you agree that this is a reasonable assumption, then the motivated intruder justification, as used by the UT, falls.

Another way of looking at it as follows: what is the point of gaining unlawful access to credit card numbers and expiry dates, if someone does not try and link the credit cards with the data subjects?

This is not the UT’s  conclusion.  It stated that the lower Tribunal (FTT) failed to consider:

“…the risks that shortcomings in security gave rise to, not simply by reference to what actually happened in the attack. This will involve consideration of what a motivated attacker could and could not have obtained data-wise from the DSG estate as a result of the [security] shortcomings. The FTT's decision has not addressed this”. (My emphasis of para 127).

So did the UT get it wrong (error 2?)

You will note that UT reasoning in para 127 (quoted immediately above) -relies on identification details to transform the hacked data into personal data, coming from other DSG Retail’s other personal data holdings and not from other sources (e.g. the dark web).  This assumption dominates the UT’s judgement.

For instance, the UT state that the lower Tribunal did not consider:

whether the data exfiltrated by the hacking attack “could be linked by a motivated attacker to other data put at risk by DSG that would identify the cardholders in question”  (para 173(ii)), or

whether “a motivated attacker could and could not have obtained data-wise from the DSG estate as a result of [security] shortcomings”. (para 127).

The UT’s  standpoint is generalised as follows:

“If a third party can only obtain anonymous data and the key to any pseudonymised material remains behind a [secure] wall [under DSG control] then then, accessing that vanilla data would not amount to an “unauthorised or unlawful processing of personal data”. (para 114). (The term “vanilla data” is used by the UT to describe anonymous data)

Hence the UT’s conclusion:

“Accordingly, the FTT’s decision involved a material error of law in deciding that there had been a contravention of the DPA 1998 ….without determining whether that data would be personal data in the hands of third parties who could access all the data put at risk by DSG’s failings”.

Concluding comment

Fortunately, the UT did not overturn the case entirely as it focused on resolving the “issue of construction” and “a question of law of special difficulty”.  Consequently, it referred the substantive issues back to a newly convened First Tier Tribunal that would use the UT’s case-law determinations as its starting point.

In summary, a fresh Tribunal view of the facts, fettered by the UT’s (dodgy) reasoning.

So will the ICO fight a second case at the FTT using the points raised in this blog which were not considered at the UT?

Given that these legal proceedings relate to the DPA1998 and were commenced by the previous Commissioner, I would not be surprised if the current Commissioner threw in the towel and withdrew the Monetary Penalty Notice.  Afterall, the UT’s judgement will be difficult to set aside.

However, if “towel chucking” is the order of the day, then this judgement because of the similarities of the personal data position in the DPA1998 and in the UK_GDPR (as agreed by the ICO – see above),  has the potential to undermine data breach reporting under the UK_GDPR in the circumstances of a non-reportable mega personal data breach of the kind experienced by DSG Retail.

Fortunately, the Government has just published new data protection related legislation: "The Data (Use and Access) Bill (see references).  What better place to amend the law to ensure that the UT’s view does not prevail.

References

The Upper Tribunal case: DSG Retail Limited -v- Information Commissioner [2024] UKUT 287 (AAC)

The text of the Data (Use and Access) Bill can be found on: https://bills.parliament.uk/bills/3825/publications

Winter Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London on Monday, 18 Nov to Friday, 22 Nov and Monday, 20 Jan to Friday, 24 Jan 20 Sept (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (December 8-10: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].

Omissions in Human Rights proposals degrade privacy and freedom of expression

A brief blog to encourage readers to submit comments to the MoJ's Human Rights consultation that ends today at a minute to midnight.  I also make available a copy of my evidence to the MoJ (see references).

This Consultation has slipped through the net relatively unnoticed as it is aimed at “legal practitioners”, “experts”, “academics” and “advocates of human rights law”. The Consultation is NOT aimed at the 60 million data subjects who are directly affected by the proposed changes.  Although the consultation period closes tonight there is an extended period of 19^th April date for those who need Easy Read or audio versions of the consultation documents.

It is also alarming that the former appeal judge who led a government-commissioned review of the Human Rights Act has told MPs he does not consider that the government’s consultation on reforming the 1998 legislation reflects his report.

The major problems with the Consultation can be summarised by what it does NOT state.  These omissions can be listed as follows:

• Absence of any consideration or analysis of the impact of the human rights proposals on the current UK_GDPR data protection regime in the UK or how they impact on data subjects (60 million in the UK alone them).
• Absence of any consideration or analysis of the impact on the proposals for changing the UK Data Protection Regime as proposed by the DCMS in a separate consultation “Data: a new direction”.
• Absence of any consideration or analysis of the impact of these proposals on the Adequacy Agreement agreed with the European Commission, resulting in the likely cessation of that Agreement.
• The lack of evidence for rebalancing Articles 8 and 10 (private and family life versus freedom of expression and to impart information) as proposed in the Consultation.
• Absence of any consideration or analysis of the impact of these proposals on the provisions that relate to the Special Purposes in the DPA2018.
• Absence of any consideration or analysis of the impact of these provisions on the FOI/FOISA or EIR/EIRSA regimes (e.g. the data protection/FOI interface).
• Misrepresentation of case law that relates to the processing of personal data mentioned in the Consultation (e.g. ML v Slovakia; Ellis v Essex Police) and omission of relevant case law (e.g. Stanley et al v Met. Police and L.B. Brent; Marper v UK)
• The lack of due process in Parliament to ensure changes to the human rights of UK citizens are subject to detailed scrutiny. The proposals include the use of secondary legislation (i.e. via Ministerial powers) to deliver changes to individual human rights with minimal involvement of Parliamentary scrutiny (this use of secondary legislation is wholly unacceptable in my view).

I should add, there is no reference in the Consultation to the proposed changes arising from the Judicial Review and Courts Bill that is intend to restrict Judicial Review and certain decisions of the Upper Tribunal.  Given that with respect to A.8 and data protection, Judicial Review is a major safeguard for data subjects (e.g. in facial recognition CCTV; immigration exemption) this omission is also surprising.

How can you have a public consultation with these gaps?  However, I conclude, in data protection terms that:

• the Consultation, if its proposals are enacted, is likely to result in weaker protection for data subjects whenever a controller’s processing of personal data is “necessary” or “in the public interest”; this weakening can extend to private sector controllers via A.6, A.9 and A.5 Principles.
• The fact that the DCMS Consultation did not discuss the impact of its proposed changes on the Adequacy Agreement (e.g. lack of an independent regulator) nor on the relationship between data protection and human rights is astonishing.
• The fact that the Consultation did not discuss the knock-on effect of the proposed human rights changes on data protection enforcement (e.g. via processing that is “necessary” or “in the public interest”) is also astonishing.
• The Adequacy Agreement is likely to be revoked. This is a subject is also deemed unworthy of mention in the Consultation.

Data Protection Courses (Spring 2022)

Because of continued COVID uncertainty, the course can be attended in person, or via Zoom, or as a mixture if you something untoward happens (e.g. you have to isolate mid-course).

• The Data Protection Practitioner Course is in London, and starts Tuesday, March 22-25; March 29-31 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]
• The Data Protection Foundation Course is in London, and starts Tuesday, May 9-11 (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]

References

Appeal Court judge's comment on MoJ proposals: https://www.lawgazette.co.uk/news/human-rights-act-consultation-not-a-response-to-my-report-gross/5111359.article

MoJ Consultation details on: https://www.gov.uk/government/consultations/human-rights-act-reform-a-modern-bill-of-rights

Link to Hawktalk's evidence to the MoJ: Download Response to MoJ HRA changes

That evidence is based on the text of my blogs:

• 18 Jan 2022: UK’s human rights proposals significantly weaken protection for all data subjects https://amberhawk.typepad.com/amberhawk/2022/01/uks-human-rights-proposals-significantly-weaken-protection-for-all-data-subjects.html
• 26 Jan 2022: Human Rights proposals undermine Data Protection and Adequacy https://amberhawk.typepad.com/amberhawk/2022/01/human-rights-proposals-undermine-data-protection-and-adequacy.html
• 28 Feb 2022: Proposals to strengthen journalists’ freedom to report is based on a fundamental misreading of ECHR judgment https://amberhawk.typepad.com/amberhawk/2022/02/proposals-to-strengthen-journalists-freedom-to-report-is-based-on-a-fundamental-misreading-of-echr-j.html

Human Rights proposals undermine Data Protection and Adequacy

The proposals to change the human rights regime outlined in Ministry of Justice (MoJ) Consultation,  “Human Rights Act Reform: A modern Bill of Rights”, are truly awful.  This is especially the case when combined with the proposed restrictions on Judicial Review that helps ensure that public authorities process personal data lawfully in accordance with Article 8 (A.8) of the Human Rights Convention.

As will be seen in the next few blogs, the human rights legislation that protects us all and underpins the data protection regime is in serious jeopardy.  I therefore encourage readers to enter the fray and make their views clear. 

It goes without saying that these changes, if implemented, would significantly jeopardise the Adequacy Agreement with the European Commission.  Does the Ministry of Justice (MoJ) consultation mention the impact on the Adequacy Agreement? Of course not; like the DCMS consultation “Data: a new direction”, it remains silent on this important issue.

In addition, the MoJ’s case for changing the UK’s human rights regime with respect to A.8 is wholly misleading.  To use a topical idiom: the MoJ Consultation “is as truthful as a BoJo”.

In summary, the proposals are unacceptable and, in the next few blogs, I will explain why this is the case.

Summary of the changes

The text of the human rights listed in Schedule 1 of the Human Rights Act 1998 is not being changed; however, its interpretation and application is.

In summary, the MoJ proposed changes relevant to this blog (I.e. A.8) include:

• empowering domestic courts to apply human rights in the UK context. Comment: the UK Courts are not required to follow European Court of Human Rights judgments.
• changing the ability of individuals to protect their A.8 rights by requiring the UK courts to give “great weight” to the views of Parliament (e.g. the “public interest” or “necessity” is essentially determined by Parliament).  Comment: public bodies will be presumed to be working in “the public interest” when they act in a way that is authorised by legislation enacted by Parliament.
• changing the balance between A.10 (freedom of expression) and A.8 (respect to private and family life); there will be a presumption that the former should prevail over the latter. Comment:  this can be seen as a “thank you for your continued support”, from the Conservative Party,  to its friends in the largely Brexit supporting media.
• making it harder for individuals to take human rights cases by “ensuring that spurious cases do not undermine public confidence in human rights”. Comment: the individual could be required to exhaust other remedies first, then obtain leave of the court in order to pursue an A.8 case and then show prior “significant disadvantage” or demonstrating an “overriding public importance”.

Note that the above constitute a subtle change to our human rights.  The text of the actual rights has not changed but exercise of these rights, or an interpretation that favours the individual complainant, becomes very much harder to establish.

In summary, Government can claim “nothing has changed” (e.g. to the text of A.8 right), but a great deal will change when individuals attempt to exercise the A.8 right.

Adequacy down the tubes?

The threat to Adequacy Agreement arises because the European Commission thought that..:

• there was “… United Kingdom’s adherence to the ECHR … as well as its submission to the jurisdiction of the European Court of Human Rights”. (para 19; my emphasis). Comment: as explained above, the UK is no longer “submitting” to the jurisdiction of the European Court. The MoJ  Consultation spells this out “…that the judgments and decisions of the European Court  of Human Rights … are not part of the law of any part of the United Kingdom” (page 100 of MoJ)
• “….any person that considers that his or her rights, including rights to privacy and data protection, have been violated by public authorities, can obtain redress before the UK courts under the Human Rights Act 1998”. Comment: the MoJ proposals put considerable hurdles in the way of any person seeking such redress (e.g.  show prior “significant disadvantage” etc;  para 109).
• there was “continued adherence to such instruments” (i.e. “submission to the jurisdiction of the European Court of Human Rights”; para 120). ”. Comment: “continued adherence”  is no longer the case.

I now move on to the misrepresentation of A.8 position as expressed in the MoJ Consultation.

The case of Marper v UK

Marper v the UK is an important example of an A.8 case that the MoJ Consultation ignores (see references).

The case surrounds a simple question: “should the DNA sample and the numerical representation of that DNA sample,  be deleted if a suspect, charged of a crime, is acquitted?”.  So should the police be able to retain DNA of people found innocent?  Before reading on, what’s your answer: YES or NO?

As an aside, I explained in a blog 13 years ago that the current retention policy relating to DNA will eventually produce a DNA database that spans the population (see references).

Marper is interesting in that, when before the House of Lords (now called the Supreme Court), a panel of five law Lords (all senior judges) found unanimously in favour of retention of DNA by the police.  By contrast, a full panel of ECHR Court judges found 17-0 in favour of Mr. Marper (i.e. unanimously the other way).

If the Government’s proposals were to become law, DNA of the innocent would have been lawfully retained by the police as the highest Court in the UK would have made an unanimous determination.  Such retention would be very different for European police forces.

In addition, I suspect all the surveillance A.8 cases where the national security agencies and the police have overstepped the mark (e.g. bulk personal data collection; use of CCTV facial recognition) would have been lost if the MoJ’s proposals were law.

One obvious reason for this is that the claimant would not be able to overcome the “significant disadvantage” threshold.  For instance, how do you know that you are subject to secret covert surveillance?  Answer:  you don’t know.   So how can you establish “significant disadvantage” before taking action.  Answer: you can’t. 

In general therefore many actions on human rights grounds are likely to fall at first base.  There will be limited leeway for a judge to allow a case to go to trial if a "highly compelling reason" of "public importance" can be established pre-trial, but this pathway is designed to be exceptional-use only.

Should the MoJ Consultation have given examples like Marper that illustrate the complex human rights issues involved  (e.g. what happens if the UK is out of step with the rest of Europe) so that respondents can make an informed and balanced response? The MoJ answer is: “of course not”; the subject is not even raised.

The case of Ellis

Does the MoJ give examples where it thinks individuals have won A.8 cases without merit? Answer: YES (in spades), especially in the area of prisoner voting and deporting immigrants.

However,  this “evidence” is presented in a very misleading way and this is illustrated by the case of R (Ellis) v the Chief Constable of Essex Police as used in the MoJ Consultation.

At the heart of Ellis is a simple question?  Should the police be able to deter crimes by printing posters or leaflets that identify known criminals who have been arrested or put behind bars?  So before reading on, what’s your answer: “YES”, “IT DEPENDS” or “NO”?

The MoJ consultation explains that the Ellis case:

“…has led to the situation where police forces face a real risk of legal challenge, where they wish to publicise the results of criminal activity or deter others by issuing posters identifying offenders who have been convicted for very serious crimes” (para 137).

Does the MoJ Consultation explain how the Court come to its conclusions in favour of Ellis? Of course not.  So I will provide the missing links.

In its evidence, the Probation Service provided the following explanation to the Court:

"If Gary Ellis were to be made subject to the Essex police naming scheme, this is likely to make worse the risk of homelessness, drug misuse, reoffending, non-compliance on licence and is likely to increase the risk of harm to the public. If named there is also the distinct possibility of some collateral harm to the parents of Gary Ellis, his ex-partner and his daughter."  (para 10-12 of the Ellis judgement).

So what’s your answer now: “YES” or “NO”?

In a later A.8 case, involving the London Borough of Brent (see references), the Ellis arguments resurfaced to prevent the distribution of a leaflet that identified youths who were excluded from a geographic area (e.g. a shopping centre).  The youths were subject to an Anti-Social Behaviour Order (ASBO) which specifically excluded named individuals from that area and the police wanted to enforce the ASBO by distributing a leaflet that identified those who were subject to the ASBO.

So should the leaflet be circulated by the police (e.g. to shopkeepers)? YES” or “NO”?

In this case, the A.8 argument used in Ellis was rejected by the Judge in the following terms:

“It is clear to me that whether publicity is intended to inform, to reassure, to assist in enforcing the existing orders by policing, to inhibit the behaviour of those against whom the orders have been made, or to deter others, it is unlikely to be effective unless it includes photographs, names and at least partial addresses.”  (para 40; my emphasis)

It is interesting to note that both the Met Police and L.B. Brent argued that the A.8 right was not engaged; the Judge rejected that view but concluded that “Article 8 could be involved if the publicity was found to be unnecessary or disproportionate”.

So these are the criteria that resolves the problem raised by the MoJ’s consultation in Ellis.  If the publication of personal data is necessary and proportionate then there is no A.8 breach, if publication is unnecessary or disproportionate there is an A.8 breach. 

In my view, all that is required is a proper assessment of necessity and proportionality; not a change in the law.   Is this explained by the MoJ Consultation? Of course not.  It wants to tip the scales in favour of Government.

Hence my conclusion that the arguments presented by the MoJ Consultation in support of the changes to the A.8 regime do not stand up to scrutiny.

Concluding comment

I have found one paragraph from the MoJ Consultation deeply unsettling and I wonder whether you read it the same way as I am.  This paragraph reads as follows:

“The Prison Service has settled claims alleging a combination of negligence, inhuman and degrading treatment (under Article 3), the violation of the right to a privacy (under  Article 8) and discrimination (under Article 14). This has cost the taxpayer around £7 million, including compensation paid out and legal costs” (bottom page 40).

Do you think the MoJ Consultation is suggesting that these settled claims are unfounded and should not have been settled?  Does this then imply that a small amount of “negligence, inhuman, degrading treatment, violation of the right to a privacy and discrimination” is somehow acceptable to the Prison Service?

As the MoJ Consultation wants to change the law, the answer is an inferred “YES”; hence my alarm. Note that the Consultation is promoting the “Prince Andrew” defence:  “No inhuman and degrading treatment occurred but we are paying compensation anyway (AND please sign our Non-Disclosure Agreement)”.

In other words,  the worrying reason why the Government is wanting to change the human rights regime to “make the law difficult to use so we can get away with it”.

Data Protection Courses

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection Foundation Course is in London, and starts Tuesday, February 1^st to 3^rd (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]
• The next Data Protection Practitioner Course is in London, and starts Tuesday, March 22 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]

References

The Adequacy Agreement with the UK: https://ec.europa.eu/info/sites/default/files/decision_on_the_adequate_protection_of_personal_data_by_the_united_kingdom_-_general_data_protection_regulation_en.pdf.

Human Rights Consultation Document from the MoJ: https://consult.justice.gov.uk/human-rights/human-rights-act-reform/.

Marper v UK references: Case of S. and Marper  v. The United Kingdom, (Applications nos. 30562/04 and 30566/04; judgement delivered 4 December 2008);  Regina v. Chief , Constable of South Yorkshire Police (Respondent) ex parte LS and Marper [2004] UKHL 39, judgment delivered 22 July 2004).

Blogs relevant to Marper:

• Marper case exposes how Parliament cannot consider human rights issues: https://amberhawk.typepad.com/amberhawk/2010/01/uk-terror-case-judgment-illustrates-a-failed-system-that-cannot-protect-privacy.html.
• Example of divergence between the UK and European approach to A.8 in Marper: https://amberhawk.typepad.com/amberhawk/2009/11/uk-courts-view-any-data-retention-as-human-rights-compliant.html.

2009 blog “Indefinite retention produces a DNA database that spans the population”: https://amberhawk.typepad.com/amberhawk/2009/12/indefinite-retention-produces-a-dna-database-that-spans-the-population.html.

R (Ellis) v the Chief Constable of Essex Police ([2003] EWHC 1321 (Admin)) https://www.bailii.org/ew/cases/EWHC/Admin/2003/1321.html.

R (Stanley et al) v Metropolitan Police and L.B. of Brent ([2004] EWHC 2229 (Admin)): https://www.bailii.org/ew/cases/EWHC/Admin/2004/2229.html.

Ministerial kisses captured on camera raise major surveillance issues for Parliament

Members of Parliament are concerned about last week’s resignation of the Health Secretary and this is not because Mr. Hancock breached his own COVID regulations and was caught canoodling in front of a CCTV camera.  The concern arises because the CCTV images were covertly taken from inside Mr. Hancock’s Ministerial Office and disclosed, without authority, to The Sun newspaper.

If this can happen to a Cabinet Minister, MPs are wondering, what is the level of state surveillance that can be turned on other Ministers and on them?

The Department of Health and Social Care (DoHSC) has launched an internal investigation with input from the Computer Security Group of the Cabinet Office.  As there has been no commitment from Government to make any aspect of the investigation public, the risk of deliberate obfuscation is considerable; this blog lists the questions that investigation needs to answer if it is to have any credibility.

I should add that the Urgent Question recording (see references) on the subject, as debated in Parliament, is very interesting; worth a watch.

FOI and IPSO Editor’s Code

First, however, to other fall-out from the Hancock resignation.

Yesterday the ICO announced she has started an investigation into the use of private emails by Mr. Hancock.  The allegation is that Mr. Hancock used his private email accounts for official business (e.g. to award PPE contracts) in order to avoid releasing information as a result of requests under the Freedom of Information Act.

All I would say, that the practice of using private emails for official business has been going on for at least a decade;  Mr. Gove was one of the first Government Ministers to try and avoid scrutiny via the FOI regime in 2011 (see references for early blogs on this subject).  As an aside, Mr. Gove’s irritation on losing his FOI case, is one reason why Ministerial responsibility for FOI and data protection was moved from the MoJ.  

Secondly The Sun newspaper appears to in breach of the IPSO Editor’s Code of Practice when it published photographs of Mr. Hancock inside a restaurant with his paramour.  Paragraph 2(iii) of this Code states: “It is unacceptable to photograph individuals, without their consent, in public or private places where there is a reasonable expectation of privacy”. 

Clearly, “unacceptable” restrictions do not apply to The Sun.  I do not see how a photograph taken inside of a restaurant of two diners (where there is a reasonable expectation of privacy) adds much in the way of “public interest” given the ‘all embracing’ CCTV footage that was actually published by The Sun (see references).

Data protection issues

I now turn to the Data Protection questions the internal DoHSC investigation needs to cover.

Who is the controller for the CCTV personal data?  Options include: the DoHSC; some other UK organisation that has a role to authorise covert surveillance, and some other person (e.g. rogue employee or contractor).

What was the purpose of installing the cameras?  If the purpose is  “security of a Ministerial Office” what does “security” entail in practice?  What were the objectives associated with the CCTV installation?

What was the coverage of the cameras?  Did the camera just cover the entrance to the Ministerial Office or could the camera cover other parts of the Office away from the entrance?  If CCTV is continuously monitored by staff in real time, CCTV can enhance office security, but if CCTV is not monitored in this way, it acts to record evidence of what has happened (e.g. who was inside an office).  So the purpose of “securing a Ministerial Office” without continuous monitoring by staff is contradictory.

Did the camera have an audio recording functionality?  MPs appear to assume that this functionality was present but this is not confirmed.  It is difficult to see how an audio recording functionality adds to the security purpose(s) normally associated with CCTV.

The irrelevance of the Wilson Doctrine.  MPs in the Parliamentary exchanges raised the issue of the “Wilson Doctrine” (which I think does not apply).

This Doctrine is named after Prime Minister Harold Wilson who, in 1966, suspected that MI5 was involved in tapping his phone calls; he made a statement in the House of Commons saying that MPs phones would not be tapped.  The Doctrine does not apply as the surveillance under investigation does not involve the tapping of phones (e.g. so that both sides of a conversation are recorded).  In this case, any audio capacity would record what the Minister said but not what was said to the Minister by a caller.

Covert surveillance of MPs is covered by other legislation, but the Minister did confirm that the Wilson Doctrine (which is irrelevant in my view) still applied.

I should add, there is an important issue about surveillance of MPs in general other than telephone tapping (e.g. to what extent should Communications Data of MPs be made available to Ministers when the Government is trying to find who is making unauthorised leaks of official information).

Was the surveillance deliberately covert?  Well if Matt Hancock knew the camera was present, he acted in a way that was truly astonishing.  Remember if deliberate covert surveillance has occurred, it is subject to other legislation and data protection law is largely irrelevant.  In any event, the UK’s data protection regime provides for surveillance to be exempt from transparency obligations in certain circumstances (e.g. suspected criminal activity).

To my mind, the surveillance is covert;  the reason for that covertness has to be explained in a credible form.  “Ooops, this was an accident” simply lacks credibility.  Just imagine your work environment where a colleague says: “I have ‘accidently’ placed a secret CCTV audio-camera into the managing director’s office; do you want to look at the recordings?”. Accidents like that do not happen.

Should the processing have been transparent?  Data subjects should know that cameras recording their images for security purposes are in operation and where they are located (especially if cameras are located in offices). So what effort was expended by the DoHSC to provide transparency?

If the security purpose errs on the side of a “national security” purpose then the cameras can be lawfully covert, but this raises questions of compliance with surveillance specific legislation and whether the DoHSC can undertake such surveillance.

Duration of processing? How long has the camera been recording personal data? How long are images and voice recordings (if any) are retained?

Did any official data sharing occur?  (e.g. between other parts of Government). So who are the Recipients and Third Parties (if any) to whom images have been shared.

Who in the DoHSC authorised the location and functionality of the camera? Clearly, it is not Minister.

Will there an attempt to pass the blame to a processor? This “pass the parcel” does not work as the controller gives instructions to a processor who is then supervised by the controller.

Is the Ministerial Office in the DoHSC unique?  It is difficult to see any official justification for placing cameras in a Ministerial Office being unique to the DoHSC, unless there are specific national security or criminality concerns.

Is there an audit trail covering who has access? I am sure that Mr Hancock can recall time and date of these images, so a list of Recipients who have had access to images should be limited.  If there is no reasonable audit trail, then there has been a likely breach of the security obligations in the GDPR.

Has an offence under the Data Protection Act 2018 in the picture.  Yes, it looks as if there has been a disclosure of personal data by someone to The Sun without the consent of the controller (presumably the DoHSC) contrary to Section 170(1)(a) of the DPA2018.

Concluding comment

I suspect that any official report will conclude “It’s all been an almighty cock-up” and “the installation was an error” or something like.  If the explanation is on these lines, and the above questions have not been addressed satisfactorily, then take any conclusion with a shovel-load of salt.

Remember also that it is the DoHSC that is directing the collection of bulk personal data from GP surgeries and is centralising powers under the Health and Care Bill just published.  If the lead Department cannot give a straight answer with its CCTV, why should the public trust the bulk medical personal data collection from GP surgeries and other NHS bodies.

Practitioner Data Protection Course (Sept)

Because of spread of the Indian variant of COVID and possible doubts concerning the justification for ending of the COVID lockdown,  the following course can be attended in person or via Zoom or a mixture (it's up to you).  The Data Protection Practitioner Course is in London, and starts September 7 (6 days).

Full details on www.amberhawk.com/StandardDP.asp or by emailing [email protected]

References

BBC Iplayer Parliamentary report of the above (44 mins; 4:10pm, 28 Jun 2021): https://www.bbc.co.uk/iplayer/episode/m000xvhw/house-of-commons-live-urgent-question-on-security-in-ministerial-offices

The Sun’s CCTV footage including a photo inside a restaurant: https://www.thesun.co.uk/news/15397278/matt-hancock-gina-coladangelo-date/

Parliamentary Debate Hansard (Urgent Notice Question): Commons (28 June): https://hansard.parliament.uk/commons/2021-06-28/debates/39713A34-4F3E-491B-B736-FD7F38658881/SecurityOfMinisters%E2%80%99OfficesAndCommunications

Blogs of 2011 & 2012 reporting on Ministerial use of private emails to avoid FOI requirements:

• Do all Conservative Ministers use personal emails and texts to avoid FOIA? https://amberhawk.typepad.com/amberhawk/2012/06/do-all-conservative-ministers-use-personal-emails-and-texts-to-avoid-foia.html
• Could Mr Gove’s emails breach the Data Protection Act as well as Freedom of Information? https://amberhawk.typepad.com/amberhawk/2011/09/could-mr-goves-emails-breach-the-data-protection-act-as-well-as-freedom-of-information.html

The next Information Commissioner likely to dance to the Government’s tune and thereby lack credibility

A brief blog on two recent publications in the press that herald the appointment of a malleable Information Commissioner to replace Ms. Denham in October.  According to these documents, the replacement Commissioner could well be expected to make decisions that favour Government policy (e.g. in data sharing; with respect to the National Data Strategy).

The first publication is the column that appeared in the Financial Times (FT) on February 27th; it is written by Oliver Dowden,  Secretary of State for Digital, Culture, Media and Sport who is responsible for the UK’s data protection policy.  The second is the job-specification for the next  Information Commissioner (see references for both).

I have reproduced quotes from both (in italics) with an appropriate “comment” or “translation” of what the text means.  Mr Dowden’s FT article is first; the job-spec is second.  You should note that the role of the data subject and the next Commissioner is to accept that, in the brave new Dowden world, personal data are to become widely available.

Mr Dowden explains to FT readers

Mr Dowden writes in the FT:  “As I launch the competition to find the next Information Commissioner, I want to set a bold new approach that capitalises on all we’ve learnt during the pandemic, which forced us to share data quickly, efficiently and responsibly for the public good”.  Comment: personal data was shared quickly and efficiently in the pandemic because the current Human Rights regime (and data protection regime) allows for data sharing of personal data in a public health emergency (such as a pandemic).  The current data protection/ human rights regime has not hindered any COVID 19 initiative. Quite simply, the issue of flexible data use, raised by Mr. Dowden, has nothing to do with the appointment of an Information Commissioner.

Mr Dowden continues: “Until now, the conversation about data has revolved around privacy — and with good reason.  A person’s digital footprint can tell you not just vital statistics like age and gender, but their personal habits”.  Comment: so what are you expecting next?  Is it that digital footprints therefore need to be protected or is it digital footprints are fair game to be exploited?

Mr Dowden explains that “Our first priority is securing this valuable personal information”.  Comment: so it’s digital footprints are fair game (did you get this wrong?).  Note that the purpose of that retention is left out from Mr. Dowden’s equation and securing the data is seen, in itself, as a beneficial objective.  Usually the purpose of the processing is key to any data protection analysis; in Mr Dowden’s world that purpose of retention is ill-defined and can come much later (whatever that purpose is).

Mr Dowden continues “The UK has a long and proud tradition of defending privacy, and a commitment to maintaining world-class data protection standards now that we’re outside the EU.: Comment: Mr Dowden is clearly ignorant of the fact that the European Commission took active infraction proceedings against the UK because the UK did not implement properly Articles 2, 3, 6, 7, 8, 10, 11, 12, 13, 22, 24, 25, 26 and 28 of Directive 95/46/EC in the DPA1998.  These infraction proceedings, which according to DCMS, are still ongoing and therefore kept secret from Parliament and public, relate to the fact that nearly 50% of the Articles of Directive 95/46/EC were not implemented properly in the so-called “world-class” DPA1998.

Mr Dowden adds: “That was recognised last week in the bloc’s draft decisions on the “adequacy” of our data protection rules — the agreement that data can keep flowing freely between the EU and UK”.  Comment: the main reason for the EC’s adequacy decision was that the UK_GDPR had not deviated significantly from the normal EU_GDPR standards (unlike the DPA1998 – see above).

Mr Dowden continues “But to do so, we do not need to copy and paste the EU’s rule book, the General Data Protection Regulation, word-for-word.  Countries as diverse as Israel and Uruguay have successfully secured adequacy with Brussels despite having their own data regimes.”  Comment: the UK is sending a signal that it is likely to diverge from GDPR norms (and risk the EC’s adequacy decision).  Perhaps we should become acquainted with the Uruguayan data protection standards that have so impressed Mr. Dowden (e.g. extend data protection to legal persons; register every database as with the DPA1984).

Mr Dowden continues “Right now, too many businesses and organisations are reluctant to use data — either because they don’t understand the rules, or are afraid of inadvertently breaking them.”  Translation: Mr Dowden does not understand the rules.  He overlooks the fact that Facebook, Google, Spammers and the Adtech Industry understand these rules perfectly well.  Mr. Dowden ignores a major problem is the UK’s weak enforcement regime (whose weakness has been enhanced by Mr. Dowden’s decision, taken 4 days before his FT article appeared, not to allow NGO’s to take data protection issues to the Courts independently of data subjects and Information Commissioner – see references).

Hence “The next Information Commissioner will not just be asked to focus on privacy, but also be empowered to ensure people can use data to achieve economic and social goals”.  Translation: privacy protection should give way if there well there is a use of personal data for an economic (e.g. more profit) or social goal (e.g. to improve engagement with the disadvantaged or impoverished data subjects).

“I will shortly announce our priority countries for data adequacy agreements”. Translation: those countries who are likely to sign a trade deal with the UK are likely to become adequate.  Remember, the fact that Mr Dowden denotes a country as adequate for UK purposes does not mean it will be adequate from the perspective of the European Commission.

“Appointing a new information commissioner is just the first stage in this process” and the new Commissioner has to understand that there is a “new era in the UK — one where we start asking ourselves not just whether we have the right to use data, but whether, given its potential for good, we have the right not to”.  Translation:  anybody who opposes  “good uses” of personal data should not apply for the job.

Information Commissioner’s job spec

The job-spec states that the Information Commissioner’s has a role in the “Government’s National Data Strategy” which sets out the “ambition for the UK’s pro-growth and trusted data regime, one that helps innovators and entrepreneurs to use data responsibly and securely”.  Translation: data privacy is not the main priority if there is a “good” economic reason for the use of personal data.

The job spec adds “We also want the public to be active agents in a thriving digital economy, who have confidence and trust in how data, including personal data, is used”.  Translation: “active agents” are data subjects who willingly provide their personal data so they can used to meet processing objectives that improve the digital economy.

“This will mean maintaining high standards of data protection without creating unnecessary barriers to data use”.  Translation: we intend to appoint a flexible Information Commissioner who will not be a stickler for the letter of data protection law.

“We are looking for an outstanding individual to become the next Information Commissioner, who understands the importance of striking this balance and delivering on this critical agenda”. Translation: the Commissioner has a role in “delivering the National Data Strategy” and should not be too concerned about privacy when economic benefits are there to be obtained.

“The Information Commissioner has a key role to play to drive the responsible use of data across the economy, to build trust and confidence, and to communicate the wider benefits of data sharing for our society as well as for competition, innovation and growth”.  Comment: the “responsible” Commissioner we shall appoint should be able to deliver data subjects who will believe in the National Data Strategy.

“The Information Commissioner should play an active role to keep the ICO at the forefront of regulatory best practice, continuing to develop governance, key decision-making and other processes to reflect the ICO’s evolving role”.  Comment:  DCMS will encourage the new Commissioner to focus on issuing Guidance and Codes of Practice or engage in conferences that discuss ethics or governance (rather than enforcement).

The selection panel is four people, two of which are unknown. The selection panel chair is the current Director General for Digital and Media Policy, the Departmental Official who is ultimately responsible for delivering the Digital Strategy/National Data Strategy.  Translation: the appointment process is unbiased.

Concluding comments

The Government appear to have abandoned the idea that the Information Commissioner is an independent Umpire between the interests of data subject and the interest of the controller; the new Commissioner is to be a team player tasked with delivering (or not hindering) the National Data Strategy.

Just imagine your football team turns up for a match, only to discover there are twelve players on the opposing team which includes the referee.  That, in summary, is what is likely outcome with this job specification for a new Commissioner.

My gut instinct also, is that the above commentary in the FT and job-spec only make sense if Government are pursuing a weaker data protection regime that is closer to the standards of the DPA1984 (and the APEC/OECD data protection standards rather than the EU_GDPR).

But only time will tell on that one.

Upcoming Data Protection Courses

All courses lead to the relevant BCS qualification:

• Data Protection Foundation: London, Starts April 27-29 (3 days)
• Data Protection Practitioner: London, Starts May 11 (6 days)
• Data Protection Upgrade Practitioner: London, May 25-26 (2 days)<LAST ONE

Full details on www.amberhawk.com of by emailing [email protected]

References

Mr Dowden’s FT article (27 Feb): https://www.ft.com/content/ac1cbaef-d8bf-49b4-b11d-1fcc96dde0e1

ICO JobSpec: https://publicappointments.cabinetoffice.gov.uk/appointment/information-commissioner-2/

Decision by Mr Dowden on 23 February not to allow NGOs to take legal action to defend data subjects: https://www.gov.uk/government/publications/call-for-views-and-evidence-review-of-representative-action-provisions-section-189-data-protection-act-2018/uk-government-response-to-call-for-views-and-evidence-review-of-representative-action-provisions-section-189-data-protection-act-2018

A Framework to undermine the ICO’s ability to enforce the new Data Protection Bill across the public sector

The Government has just inserted clauses into the DPBill that allows the Secretary of State to issue a “Framework for Data Processing”, initially for each Government Department.  This Framework has the status of statutory guidance and “will set out the manner in which government should process (personal) data”.

In effect the Framework is like a statutory Code of Practice; its aim is to “improve the transparency and clarity of existing government data processing”. The Framework, according to the official explanation, “does not allow the government to create any new data processing powers” (but it does describe how the law applies).

Indeed “the Framework should provide reassurance to data subjects about the approach government takes to processing data and the procedures that it follows when doing so. It will also help further strengthen the government’s compliance with the requirements of the GDPR and contribute to the provision of a clear, precise and foreseeable basis for government’s processing of data”.

So apple pie and honey all round? Well I am sure the provisions are well intentioned, but as the proverb goes, “the way to hell is paved with good intentions”. This blog traverses the “pathway to hell”.

In summary, the clauses are defective as the content of the Framework is left to the Secretary of State to determine.  In addition, the ICO cannot easily challenge the Framework text if there is a dispute as to how it describes how personal data should be processed. Finally, the clauses also obstruct enforcement action on the part of the ICO with respect to a controller following the Framework.

Taking the road to nowhere

First, the assertion that the Framework provides improved “transparency and clarity” (i.e. more transparency than the details provided by the “right to be informed” in Article 13 and 14 of the GDPR). Remember the details that have to be issued to each data subject, by each Government controller, in accordance with the ICO’s revamped Privacy Notices code of Practice. They include: details of retention times, recipients, purposes of the processing, legal basis for the processing, use of public sources etc etc.  In short, I have difficulty in identifying what is more transparent than that?

However, the real problems arise when the Framework contains details of how a Government controller processes personal data which runs counter to the Information Commissioner’s view of how the data protection law should work.

For instance, if there were to be a disputed view on data protection procedure, it is surprising to discover that the Government can ignore the Information Commissioner’s view. This is because clause 175(5) states that before preparing a Framework, the “Secretary of State must consult the (Information) Commissioner” (my emphasis).

Note the operative word is “consult” as in “Mrs Thatcher consulted widely about the superb brilliance of the Poll Tax prior to implementation”. In other words, the Secretary of State having consulted the ICO, is free to ignore the ICO’s concerns (which history shows has often occurred; e.g. in relation to the custodial element of the section 55 offence).

Clause 176 sets out how Parliament approves a Framework; it is a negative resolution procedure which means Parliament has to vote the Framework down. A House of Commons Library report states that the last occasion that the House of Commons used a negative resolution procedure to vote down a Statutory Instrument was on 24th October 1979 – forty years ago. (Older readers may recall that this involved the notorious, evil and dastardly “Paraffin (Maximum Retail Prices) (Revocation) Order 1979”).

In other words, Parliament is unlikely to object to a Framework produced by the Secretary of State even if the ICO has objections; this is especially the case if the ruling Party has a Parliamentary majority.

So, could the ICO enforce her view of the legislation, when a Government Department is processing the personal data in accordance with a Framework that the ICO has a problem with?

Well such enforcement is made difficult by new Clause 178; for instance:

• Clause 178(1): “When carrying out processing of personal data” (which is subject to the Framework) “a person must have regard to the (Framework) document”. Comment: if you were a data protection officer in a Government Department do you follow the ICO or your Secretary of State given the Framework says you must have regard to the Secretary of State’s view of the state of data protection in his Department?
• Clause 178(3): Compliance with a Framework document “is admissible in evidence in legal proceedings”. Comment: processing in accordance with a Secretary of State’s Framework for his own Government Department is evidence that the controller is doing the “right thing”. Worst case scenario is that the ICO has to take enforcement action to counter the Framework.
• Clause 178(4): “In any legal proceedings before a court or tribunal, the court or tribunal must take into account a provision of the (Framework) document...”. Comment: this could reverse the burden of proof on appeal, as any ICO enforcement has to overcome the Framework’s provisions. Normally when the ICO uses enforcement powers, it is the controller that has to show that the ICO enforcement is wrong; the ICO does not have to prove that enforcement was correct.
• Clause 178(5): “In determining a question arising in connection with the carrying out of any of the Commissioner’s functions, the Commissioner must take into account a provision of a (Framework) document”. Comment: this is clearly another additional barrier that the ICO has to consider before using enforcement powers. It is a barrier that places Government controllers in a special position when enforcement is considered.

To be honest, one wonders whether erecting barriers to the ICO enforcement damages the notion that the UK Information Commissioner is independent of Government (with all that means for adequacy).

Finally, the official document explains that “The Government has chosen to draw the application of the Framework as narrowly as possible”. But then Clause 175(1)(b) extends the Framework to “a person with functions of a public nature who is specified or described in regulations made by the Secretary of State” (i.e. to any public body the Secretary of State chooses in future). Yep, it appears the Secretary of State uses a very novel definition of “narrowly”.

In summary, the Secretary of State’s can:

• produce a Framework that applies data protection to his own Department;
• ignore what the Information Commissioner says about the Framework;
• lay his own Framework before Parliament using a procedure that guarantees that it is very unlikely to be scrutinised;
• raise barriers or fetter the ICO’s enforcement mechanism, and
• extend or introduce Frameworks to include any other public-sector body.

Seen I this light, these clauses are not a recipe for “transparency and clarity” as claimed in the official (propaganda) document; they are a recipe for ensuring that a future Secretary of State can subtly modify the impact of the new data protection provisions on his own Department and make it difficult for the ICO to challenge.

If a Secretary of State wanted a Framework, he could produce a Code of Practice for his Department and ask the ICO to approve it; alternatively, he can task the ICO to produce a Statutory Code. Such a Code produced by the ICO, like the Framework, can be laid down before Parliament and can balance any conflicting processing interests in a considered way.

The main difference is that the ICO has control of content of a Code of Practice whereas it is the Secretary of State that controls the text of the Framework.

Public trust in the Framework ultimately depends on who is in control of the text. The fact that these Clauses do not allow the ICO to veto and/or modify the text of the Framework permits it to contain provisions that could skew data protection in favour of a Government controller (in this case, this includes any present or future Secretary of State).

It is the longevity of these Clauses, the ability to ignore the ICO and the ICO’s lack of control over the text combined with the unknown nature of our future political masters which makes them unacceptable; there is, quite simply, no counter-balance.

There appears to be an assumption the Secretary of State will produce a Framework where the ICO is in agreement; history shows that this assumption is false.

Without a change to allow the ICO to have independent control or final say on the content the Framework, the Framework should be seen as dangerous #fakedataprotection.

References

• Official explanation of the powers: https://publications.parliament.uk/pa/bills/lbill/2017-2019/0066/18066-DPMsupplementary.pdf
• The Framework powers themselves: Download Framework for Data Processing by Government

Courses (London)

• We are gearing up to deliver BCS Data Protection Foundation and Practitioner Qualifications in the first quarter of 2018; we have dates so if interested email [email protected]

• Data Protection Bill all day Workshop: London (10 January) http://www.amberhawk.com/bookevents3.asp
• We are also having a day course on the law enforcement elements of the DP Bill in March; if interested email [email protected]

Conservative manifesto hints at gradual ECHR withdrawal and the establishment of a national population register?

As is usual, this is my summary of the extract of all the main Party Manifestos that relate to data protection and human rights (Article 8 and 10) issues.

The main controversy relates to the Conservative manifesto which hints at leaving the ECHR after the next General Election in 2022 and raises the prospect of the establishment of a national population register.

I explain any controversy in comments associated with the relevant parts of the manifestos below. However, in summary:

1. All Parties, except the Conservatives and UKIP, are wholly committed to the European Convention of Human Rights; Conservatives are lukewarm on Human Rights and its commitment to the Human Rights Act is just for the next Parliament.
2. All Parties are in favour of Leveson II, except for the Conservative Party; this means that custodial sentences via Section 55 of the Data Protection Act will not be commenced if Mrs May is returned as Prime Minister and are unlikely to appear as part of the UK’s implementation of the GDPR. UKIP are silent on Leveson.
3. The Conservative Party wants to establish a Data Use and Ethics Commission that risks a clash with the role of the Information Commissioner; the Commission has been set up to advise on the wider (but ethical) use of personal data.
4. The Conservative Party also want “Health and Social care guardians” to be placed on a statutory footing; this overlaps with the statutory role of data protection officers (a requirement for public bodies under the GDPR) who also have such care guardians.

Anyway here goes; happy reading. Whatever your views: vote not veto.

CONSERVATIVE

“We will not bring the European Union’s Charter of Fundamental Rights into UK law. We will not repeal or replace the Human Rights Act while the process of Brexit is underway but we will consider our human rights legal framework when the process of leaving the EU concludes. We will remain signatories to the European Convention on Human Rights for the duration of the next parliament.” Comment: I think the commitment to ignore the Charter is unsustainable for data protection as non-adherence to CJEU rulings on the data protection elements of the Charter will jeopardise any post-Brexit adequacy determination (assuming there is one). It is also unsustainable for any data controller want to offer services into the EU irrespective of Brexit outcome, as the GDPR is directly applicable to such controllers; such controllers cannot ignore the CJEU.

“Protections for people’s data online, backed by a new data protection law. Safety for children online, and new rights to require social media companies to delete information about young people as they turn eighteen.” Comment: there is no mention that these objectives are a requirement of the GDPR.

“To create a sound ethical framework for how data is used, we will institute an expert Data Use and Ethics Commission to advise regulators and parliament on the nature of data use and how best to prevent its abuse. The Commission will help us to develop the principles and rules that will give people confidence that their data is being handled properly.” Comment: there is a hint here that if the Commission finds something “ethical” it will become “lawful” through legislation (such as the wider data sharing elements of the Digital Economy Act which authorises data sharing which is “not necessary” for the functions of public bodies; the standard established by Schedule 2, paragraph 5 of the DPA). There is also no mention that the GDPR is intended to put data subjects in control of the processing of their personal data via the stronger consent requirements.

“Alongside this commission, we will bring forward a new data protection law, fit for our new data age, to ensure the very best standards for the safe, flexible and dynamic use of data and enshrining our global leadership in the ethical and proportionate regulation of data.” Comment: there is no mention that the UK has to implement the GDPR; this commitment is not a Conservative initiative, it is a European one.

“We will put the National Data Guardian for Health and Social Care on a statutory footing to ensure data security standards are properly enforced.” Comment: Implicitly, this infers that data security standards are not properly enforced by the Data Protection Act (and I agree with this implication).  As security standards can be reinforced by the enhanced enforcement powers in the GDPR, this commitment in the manifesto is otiose.

That is why we shall roll out Verify, so that people can identify themselves on all government online services by 2020, using their own secure data that is not held by government. We will also make this platform more widely available, so that people can safely Verify their identify to access non-government services such as banking”. Comment: the Government’s Verify identity scheme was under pressure; it appears that the pressure is off.

“We will set out a strategy to rationalise the use of personal data within government, reducing data duplication across all systems, so that we automatically comply with the ’Once-Only’ principle in central government services by 2022 and wider public services by 2025.”. Comment: : this “once-only” objective infers the establishment of a national population register using the wide data sharing powers in the Digital Economy Act 2017; big databases such as the one associated with the discarded National Identity Card could well be back on the agenda.

“We will not proceed with the second stage of the Leveson Inquiry into the culture, practices and ethics of the press.” Comment: this should not be understood as a “quid pro quo” for the Party’s support in the Brexit supporting tabloid press; the abandonment of Leveson II is unique to the Conservatives.

LABOUR

“The Conservatives threaten our Human Rights Act and may withdraw us from the European Convention of Human Rights. Labour will retain the Human Rights Act”.

“Labour is committed to growing the digital economy and ensuring that trade agreements do not impede cross-border data flows, whilst maintaining strong data protection rules to protect personal privacy.”

“We will implement the recommendations of part one of the Leveson Inquiry and commence part two which will look into the corporate governance failures that allowed the hacking scandal to occur.”

LIB DEM

“We will vote against any attempts to scrap the Human Rights Act or withdraw from the European Convention on Human Rights and we will strengthen the UK’s commitment to international human rights law.”

“Introduce a digital bill of rights that protects people’s powers over their own information, supports individuals over large corporations, and preserves the neutrality of the internet.”

“In light of the press’s failure to engage in effective self-regulation, seek to ensure delivery of independent self-regulation, and commence part two of Leveson.”

“Roll back state surveillance powers by ending the indiscriminate bulk collection of communications data, bulk hacking, and the collection of internet connection records.” Comment: this commitment is unique to the Lib Dems.

“End the ministerial veto on release of information under the Freedom of Information Act, and take steps to reduce the proportion of FOI requests where information is withheld by government departments.” Comment: this commitment is unique to the Lib Dems.

SNP

“The European Convention on Human Rights (ECHR) is enshrined in the Scotland Act 1998, ensuring that human rights are protected by the Scottish Government and all Scottish legislation. The SNP re-affirms its commitment to the Council of Europe, the ECHR and their institutions. We will fight to protect human rights across the UK. SNP MPs will oppose any attempts by the UK government to scrap the Human Rights Act and withdraw the UK from the ECHR." Comment I did not find anything on data protection.

UKIP

“Repeal Labour’s Human Rights legislation and remove the UK from the jurisdiction of the European Court of Human Rights and introduce a new UK Bill of Rights.”  Comment I did not find anything on data protection.

GREEN

“Defend the Human Rights Act and UK membership of the European Convention on Human Rights, and reinstate funding for the Equality and Human Rights Commission.” Comment I did not find anything on data protection.

WELSH NATIONALIST, DUP, SINN FEIN etc

Could not find anything on the topics; I will add it if someone provides a URL.

Other Publicity

Forthcoming  Amberhawk’s courses in early summer

• DP Practitioner Course: starts 6 June (Leeds)and 11 July (London)
• DP Foundation Course: starts 4 July (London)
• Next GDPR Workshop: 20 July (London)

References:

Happy reading: just Google “xxxxx Party Manifesto 2017” where xxxx is the name of the Party.

UK’s GDPR law will not be judged “adequate” if it contains provisions that made the DPA inadequate

Many readers know that, since 2005, I have tried to use Freedom of Information legislation to find out what is behind the “on-going” infraction proceedings, commenced by the European Commission against the UK. This is because the UK’s Data Protection Act (DPA) is, according to the Commission, a defective implementation of Directive 95/46/EC.

So what are these defects? Should data protection practitioners know what they are?

Readers also know the answer to both questions is a resounding “NO” as publishing the requested data protection detail would cause irreparable damage to international relations between the UK and the European Union (re-confirmed in ICO Decision Notice FS50577377, dated March 2016)!

So, after the Brexit referendum vote, I tried the European Union’s Access to Documents regime (Regulation (EC) No 1049/2001), and received another refusal to add to my collection. The refusal letter, dated mid-November last year, confirms that there are still major problems with the DPA; of the 20+ problems with the DPA identified by the European Commission in 2005, four of them are serious and remain unresolved in 2017 (in the run up to GDPR implementation).

Surprisingly, even information about the 16+ resolved issues remain a state secret. For instance, paragraph 33 of the 2016 Decision Notice confirms that the release of these details would cause “prejudice to international relations”. The ICO concluded that “…having viewed the withheld information, the Commissioner is satisfied that there would be a real and significant risk of prejudice …to the relationship between the UK and the European Commission”.

Indeed, someone who said he was “close to GCHQ/MI6” took me to one side at this month’s ICO conference. He told me that if I were to be given the top-secret list of data protection indiscretions on the part of the UK, (none of which relate to national security, crime and taxation etc I should add) then the damage to EU-UK relations would be so high that the European Commission’s mission in London would have to close, and the UK Ambassador to Brussels would become persona non grata.   I was advised to "back-off" whatever that means.

A score of problems

In this blog, I update readers with the latest chapter in this saga. I report the contents of a six page refusal letter, dated 14/11/2016, which contains comments relevant to a UK adequacy decision under GDPR (see references: Document 0-6 where each is a single page)

The important comments are:

• the first complete paragraph at the top of Document 3 shows that the alleged defects in the UK’s DPA will be assessed in the context of the UK’s GDPR implementation and “could possibly lead to a complementary reasoned opinion”. In other words, if the identified DPA defects remain when the UK implements the GDPR, that implementation is likely to be judged defective.
• the bottom of Document 4 and top of Document 5 where the Commission confirm that “investigations are active and ongoing”; this means the DPA is still deemed to be defective. In other words, if the current DPA is defective in terms of Directive 95/46/EC it will also defective in terms of the GDPR (i.e. the status quo cannot remain as a basis for an adequacy determination by the Commission).

Where is the DPA defective?

The main areas of concern about the DPA in the context of the GDPR that I have identified in this decade long FOI process are as follows:

1. The definition of “personal data” takes no account of Recital 26 of Directive 95/46/EC.  The definition of “personal data” in the DPA requires personal data to relate to an identifiable data subject where that identification is undertaken by only the data controller. By contrast, Recital 26 suggests identification can be undertaken by the controller and, within reason, persons other than the controller. The UK Act definition of personal data is therefore unduly restrictive and has been so since 1998. The same problem is in the GDPR definition of “personal data”.
2. The definition of “Relevant Filing System” of the DPA is not the definition of “Filing System” in the Directive 95/46/EC. Whilst the Directive allowed Member States to go their own way with manual filing systems this flexibility is not in the GDPR (which maintains the Directive definition). I have included it in my list as this could be a major headache for controllers preparing for the GDPR; personal information in manual filing systems that are excluded from the definition of “data” in the DPA (and therefore are excluded from any DP obligation as the information is not personal data) become fully subject to the GDPR in May 2018.
3. The Information Commissioner in the DPA has limited role in assessing whether third countries offer an adequate level of protection (e.g. she does not authorise or approve transfers in a way other European data protection authorities do). The DPA is unique in that data controllers can assess adequacy (something removed in the GDPR unless very exceptional circumstances arise).
4. The Information Commissioner cannot perform random audit checks on any data controller/data processor under the DPA.  There is a limited ability to audit Government Departments, NHS and Telcos but this came after the Commission commenced its “on-going” infraction proceedings in 2005.
5. The Monetary Penalty regime is too restrictive (e.g. it requires serious breach that causes real or likely substantial damage/distress). I suspect the Commission would prefer penalty fines for many lesser infringements, and that if the UK maintains the current enforcement regime in the GDPR, it risks being judged as being inadequate.
6. There is no ability (except for judicial review) for the data subject to challenge the Information Commissioner’s failure to enforce the DPA against a data controller. Whereas a data controller can appeal to the Tribunal against the ICO’s enforcement action in general, there is no equivalent appeal mechanism available to data subjects. The main enforcement regime is therefore unbalanced and comprise last resort powers that are designed only to be used (e.g. Enforcement Notices; Information Notices) when a data controllers does not “co-operate” with the ICO’s wishes. That is why there are very few Information Notices, for example.
7. The Courts in the UK have unfettered powers to exempt personal data from subject access in circumstances when the exemption is not grounded in the exemptions found in Directive 95/46/EC (this arises from the use of “may” in Section 7(9) of the DPA).  In addition, the Courts could even refuse to order inaccurate personal data to be corrected or erased (the use of “may” in Section 14).  I should add that I find both problems to be hypothetical and I am not aware of any case where these Sections have proved to be a problem but I do know the Commission is concerned about this.

Note that the last five in the above list relate to enforcement issues and improperly implemented data subject rights. They serve to reinforce the widely-held perception in Europe that the UK enforcement regime is weak.

Some of the issues raised by the Commission have been resolved by the UK Courts over time.  For instance, the right to compensation in the DPA was limited to damage that could be assessed on monetary grounds. In the case of Johnson v Medical Defence Union, the Court of Appeal stated that compensation for distress would only be available where a claimant could also show pecuniary loss.

This was overturned in the Court of Appeal in Google Inc. v Vidal-Hall & Ors which ruled that section 13(2) of the Data Protection Act should be ignored as it was a deficient implementation of Article 23 of Directive 95/46/EC. Note that it took 14 years, and a long march through the legal institutions, to fix this “bug”.

Other issues have been resolved by CJEU Judgements which do not apply in a post-Brexit UK.  For instance, I am sure that the domestic purpose exemption (Section 36 of the DPA) was criticised by the Commission as being too broad; this was subject to a landmark ruling in Lindqvist which narrowed its scope to processing of personal data for “purely personal” matters.

I do not know what the missing 10+ issues are; they have to be kept secret so not to “prejudice international relations”.  However, one of my FOI requests did require the UK Government to publish a list of which Articles of the Directive (all 17 of them) where there was an issue (see references).

Commentary

The fact that a score of issues was identified as potential defects suggests that the DPA was, from the European perspective, implemented well below the minimum standard required (and deliberately so).   Quite simply the UK has applied a “minimal implementation” policy to the implementation of Directive 95/46/EC.

If this policy continues with GDPR implementation (e.g. all the indications are that Government intend to take maximum advantage of the flexibility that the GDPR gives to Member States in 50+ Articles), then a minimal implementation policy is likely to jeopardise any adequacy determination by the European Commission.

The conclusion that I have reached is that the risk of a “GDPR-lite” implementation is significant; it follows that the risk of the UK not getting an adequacy determination is therefore high. That is why my blog on “a hard-Brexit a gonna fall” could be very relevant to readers with Third Country transfer issues (see references).

This conclusion is not helped by stated Government policy that, in a post-Brexit UK, it can ignore CJEU judgements (and by implication European Data Protection Board determinations concerning harmonising the GDPR across European Union). Such a policy, if implemented, is also likely to jeopardise any adequacy determination from the Commission.

In summary, 60,000,000 UK data subjects, 500,000 data controllers and a host of Parliamentary Committees have been kept ignorant, for over a decade, about the alleged defects in the UK’s DPA by successive governments. From the ID Card database in 2004 to the widespread data sharing policies of the Digital Economy Bill of 2017, Ministers down the ages have reassured Parliament that privacy is preserved: “Don’t worry, the personal data are protected by the DPA”.

All these statements are wholly misleading, and in many circumstances, Ministers or their Civil Servants knew they were misleading. Any evidence lies in these infraction documents which, for reasons I cannot fathom, are being kept secret.

This state of affairs now risks carrying over to the GDPR. If so, then this could torpedo any hopes of an adequacy determination by the Commission.

Other Publicity

Forthcoming  Amberhawk’s courses in April/May

• Next GDPR Workshop: 19 April (London)
• DP Practitioner Course: Starts 28 March (BCS syllabus; London)
• DP Practitioner Course: Starts 8 May (BCS syllabus; Edinburgh)
• FOI Practitioner Course: Starts 18 May (BCS syllabus; London)

UPDATE: we have devoted the next UPDATE day-long session on 3^rd April 2017 to the GDPR. We have an impressive array of speakers lined up including from ICO, Hunton & Williams, DMA and Grant Thornton as well as the usual suspects from Amberhawk http://www.amberhawk.com/bookevents.asp

References

If a hard Brexit a-gonna fall what then happens to overseas transfers of personal data? http://amberhawk.typepad.com/amberhawk/2017/01/if-a-hard-brexit-a-gonna-fall-what-then-happens-to-overseas-transfers-of-personal-data.html

List of Articles of Directive 95/46/EC where there was an issue: Download Uk-deficiency-details_may-2011

Please download the letter here: Download Document 1  Download Document 2  Download Document 3  Download Document 4  Download Document 5  Download Document 6

A DOZEN YEARS OF SECRECY: INFRACTION BLOGS (AND YEAR OF BLOG)

(2014) European Commission raises infraction threat to UK on failing to implement Directive 95/46/EC properly via the Data Protection Act http://amberhawk.typepad.com/amberhawk/2014/10/european-commission-raises-infraction-threat-to-uk-on-failing-to-implement-directive-9546ec-properly.html

(2011) What is wrong with the Data Protection Act? FOI Infraction saga hits the buffers. http://amberhawk.typepad.com/amberhawk/2011/10/what-is-wrong-with-the-data-protection-act-foi-infraction-saga-hits-the-buffers.html

(2011) Privacy: new Government revelations amplify concerns surrounding deficiencies in UK’s Data Protection Act http://amberhawk.typepad.com/amberhawk/2011/05/privacy-new-government-revelations-amplify-concerns-surrounding-deficiencies-in-uks-data-protection-.html

(2009) Data Protection Act fails to implement 50% of the Directive? http://amberhawk.typepad.com/amberhawk/2009/11/data-protection-act-fails-to-implement-50-of-the-directive.html

(2007) Europe claims UK botched one third of Data Protection Directive: https://www.out-law.com/page-8472

(2004) European Commission suggests UK’s Data Protection Act is deficient; https://www.out-law.com/page-4717

(2004) UK’s Data Protection Act might not meet European Union standards: https://www.out-law.com/page-4549 

 

Party promises on Data Protection, FOI, Digital rights, Human Rights, Leveson and mass surveillance

At great risk to my mental health, I have extracted the relevant parts of the Party Manifestos.  Here they are without comment. URLs for each manifesto is at the end; address of my psychiatrist available on request. 

CONSERVATIVE

There is no explicit mention of data protection, freedom of information or privacy.

“The next Conservative Government will scrap the Human Rights Act, and introduce a British Bill of Rights. This will break the formal link between British courts and the European Court of Human Rights, and make our own Supreme Court the ultimate arbiter of human rights matters in the UK”.

The Leveson report noted and no further implementation but “Because the work of the free press is so important we will offer explicit protection for the role of journalists via the British Bill of Rights and we will ban the police from accessing journalists’ phone records to identify whistle-blowers and other sources without prior judicial approval.”

National security : “We will keep up to date the ability of the police and security services to access communications data – the ‘who, where, when and how’ of a communication, but not its content. Our new communications data legislation will strengthen our ability to disrupt terrorist plots, criminal networks and organised child grooming gangs, even as technology develops. We will maintain the ability of the authorities to intercept the content of suspects’ communications, while continuing to strengthen oversight of the use of these powers”.

“We will ensure digital assistance is always available for those who are not online, while rolling out cross-government technology platforms to cut costs and improve productivity – such as GOV.UK”. Labour and Lib Dems say something similar: As the main parties support GOV.UK (come to our Update session on 11th May as its very important for both public and private sectors) I will not say anything further on the topic. 

LABOUR

There is no explicit mention of data protection.

“Thanks to the Human Rights Act, some of our most vulnerable citizens, including disabled people and victims of crime, have been given a powerful means of redress. The Conservatives want to leave the European Convention of Human Rights, and abolish the Human Rights Act. A Labour Government will stand up for citizens’ individual rights, protecting the Human Rights Act and reforming, rather than walking away from, the European Court of Human Rights. And we will make sure that access to legal representation, a cornerstone of our democracy, is not determined by personal wealth, but remains available to those that need it.

“We will further develop digital government to enable better communication, more collaboration, and sharing of data between services”.

“Our Freedom of Information laws have shone a light into the darker corners of government and are a crucial check on the power of the Executive. We will extend their scope so that public services run by large private companies are included”.

“We remain strongly committed to the implementation of the recommendations of the Leveson Inquiry. We expect the industry to establish a mechanism for independent self-regulation, which delivers proper redress for individuals, as set out in the Royal Charter, and agreed by all parties in Parliament. We made a promise to victims of the phone hacking scandal. We stand by that promise and will keep it”. 

“With Labour, the security services will have the powers they need to disrupt and tackle terrorism. …. We will need to update our investigative laws to keep up with changing technology, strengthening both the powers available, and the safeguards that protect people’s privacy. This is why Labour argued for an independent review, currently being undertaken by David Anderson. We will strengthen the oversight of our intelligence agencies to make sure the public can continue to have confidence in the vital work that they do to keep us safe.”

LIB DEMS

“Require the highest standards of data protection by public service providers, including requiring that where data is used for research purposes it must be anonymised wherever possible, and impose a moratorium on the creation of new government databases without Parliamentary authority”.

“Introduce, after consultation on the detail, the changes to the 1998 Data Protection Act recommended by Lord Justice Leveson to provide a fairer balance between personal privacy and the requirements of journalism, ensuring that the position of investigative journalists is safeguarded”

“Give increased powers and resources for the Information Commissioner and introduce custodial sentences for egregious breaches of the Data Protection Act".

" Ensure privacy is protected to the same extent in telecoms and online as in the offline world".

"Public authorities should only invade an individual’s privacy where there is reasonable suspicion of criminal activity or where it is otherwise necessary and proportionate to do so in the public interest, and with appropriate oversight by the courts.”

“The Human Rights Act will remain, with children’s rights protected in law too. The culture of everyday sexism will be declining, with young people taught in school about respect in relationships and sexual consent. Online, people will no longer be worried that the government is monitoring their every keystroke: a Digital Bill of Rights will have enshrined enduring principles of privacy and helped keep the internet open”

“Protect the Human Rights Act and enshrine the UN Convention on the Rights of the Child in UK law. We will take appropriate action to comply with decisions of UK courts and the European Court of Human Rights”

“Pass a new Freedoms Act, to protect citizens from excessive state powers.”

“Extend Freedom of Information laws to cover private companies delivering public services.”

“Oppose the introduction of the so-called Snooper’s Charter. We blocked the draft Communications Data Bill and would do so again. Requiring companies to store a record of everyone’s internet activities for a year or to collect third party communications data for non-business purposes is disproportionate and unacceptable, as is the blanket surveillance of our paper post”.

“We will:

Ensure proper oversight of the security services.

Establish in legislation that the police and intelligence agencies should not obtain data on UK residents from foreign governments that it would not be legal to obtain in the UK under UK law.”

The Lib Dems will introduce a Digital Bill of Rights.

UKIP

No mention of data protection, Freedom of Information or Leveson.

“We will repeal the Human Rights Act and replace it with a new British Bill of Rights. The interests of law-abiding citizens & victims will always take precedence over those of criminals”.

With respect to “Human Rights Legislation” we will be…“Putting responsibility for law and order back into the hands of Parliament is key to UKIP’s approach to law and order, justice and internal security across the British Isles.

We will remove ourselves from the jurisdiction of the European Court of Human Rights: the Strasbourg Court whose interpretation of the European Convention of Human Rights has been known to put the rights of criminals above those of victims.

Our own Supreme Court will act as the final authority on matters of Human Rights. We will also repeal Labour’s Human Rights legislation. It has given European judges far too much power over British law making and law enforcement and prevented us deporting terrorists and career criminals and from implementing whole-life sentences.”

Our human rights will be enshrined in law via the introduction of a new, consolidated UK Bill of Rights. This will complement the UN Declaration of Human Rights and encapsulate all the human and civil rights that UK citizens have acquired under UK law since Magna Carta. This new UK Bill of Rights will apply across England, Wales, Scotland and Northern Ireland."

GREENS

“We live in the information age and we know that information is power. But how should information be controlled? What information should be available, and to whom?  The Green Party supports a world of open, freely flowing information. We don’t want disproportionate or unaccountable surveillance or censorship. We want a transparent state, but we want control over the data that our digital lives create. “

"Support the recommendations of the Leveson Inquiry into press ethics and for the cross-party Royal Charter. But if this is not supported by all the major newspapers we will support legislation to implement the Leveson system of independent press self regulation".

"We would consider combining elements of the policies below into a comprehensive Digital Bill of Rights."

"We will support and protect Internet freedom.

Follow human rights judgments limiting surveillance and data retention in full.

Support the EU’s proposals to strengthen data protection laws against opposition from large US data-driven companies."

"Oppose any case for secret unaccountable mass surveillance of the type exposed by Edward Snowden. We do accept that government law enforcement agencies may occasionally need to intercept communications in specific circumstances. Such specific surveillance should be proportionate, necessary, effective and within the rule of law, with independent judicial approval and genuine parliamentary oversight".

"Replace the Regulation of Investigatory Powers Act 2000, which has failed:

to regulate the deployment of undercover police;

to support the confidentiality of journalistic sources;

to support legal confidentiality; and

to enshrine an open and effective right of redress".

SNP

Protecting personal data:  "We do not support Tory plans for the reintroduction of the so-called ‘snoopers’ charter’, which would see all online activity of every person in the UK stored for a year. Instead, we need a proportionate response to extremism. That is why we will support targeted, and properly overseen, measures to identify suspected extremists and, if necessary, examine their online activity and communications".

Human Rights: "Given the central place of human rights in Scotland’s constitutional settlement, and their importance at the heart of our politics, we will oppose scrapping the Human Rights Act or withdrawal from the European Convention on Human Rights".

Leveson: The Scottish Parliament chose, on a cross party basis, to support the UK Government’s actions to implement Leveson. We will consider carefully the results of the first year review and work with other parties, in Scotland and at Westminster, to ensure effective regulation of the media on a non-political basis.

Nothing on Freedom of Information; this might be because FOI in Scotland (FOISA) is a devolved matter,

References

We have a key UK.GOV speaker at our Update session on May 11 in London: http://www.amberhawk.com/bookevents.asp

Manifestos

Conservative: https://s3-eu-west-1.amazonaws.com/manifesto2015/ConservativeManifesto2015.pdf

Labour: http://b.3cdn.net/labouruk/e1d45da42456423b8c_vwm6brbvb.pdf

Lib Dem: https://d3n8a8pro7vhmx.cloudfront.net/libdems/pages/8907/attachments/original/1429028133/Liberal_Democrat_General_Election_Manifesto_2015.pdf?1429028133

UKIP: https://d3n8a8pro7vhmx.cloudfront.net/ukipdev/pages/1103/attachments/original/1429096952/theukipmanifesto2015.pdf?1429096952

Green: https://www.greenparty.org.uk/assets/files/manifesto/Green_Party_2015_General_Election_Manifesto_Searchable.pdf

SNP: http://votesnp.com/docs/manifesto.pdf

Amberhawk Training Schedule Winter/Spring 2015

 1. DATA PROTECTION BCS PRACTITIONER QUALIFICATION: The next standard DP courses are in London (starts 20 January 2015) and in Leeds (starts 22 April);  the next intensive DP courses are in Edinburgh (starts 9^th March 2015) and London (starts 28th April)

 2. NEW DATA PROTECTION BCS FOUNDATION QUALIFICATION:  we are delivering the new BCS Foundation Course in Data Protection syllabus in London (16, 17 and 18 March). This 3 day course is intended to ensure that the team that supports the data protection function know the relevant details from the Act (e.g. PECR, data sharing, Human resources, Principles, subject access, marketing). The course provides excellent value for money if held on-site training your support staff and can be a staging post to full Practitioner Certificate.

 3. FREEDOM OF INFORMATION PRACTITIONER QUALIFICATION: Our next intensive FOI course is being held in Leeds (starts 23 February 2015) and in London (starts 19 May)

 4. PRIVACY IMPACT ASSESSMENTS and DP AUDIT:  these all-day courses are held in London on PIA (23 March)  and on DP Audit (24 March).

 5. DATA PROTECTION REGULATION: a half day course is being held in London on 30 March (afternoon) focusing in the latest DPAIX leaks and the likely/possible changes from the current DP Act.

 6. DATA PROTECTION UPDATE: our half yearly all-day update on topical data protection issues (e.g. legal precedent, enforcement. etc) in London on 11 May.

 7 INFORMATION SECURITY MANAGEMENT PRINCIPLES BCS CISMP QUALIFICATION: Understanding the principles underpinning ISO27000, HMG Security Framework and the Local Government Data Handling Guidelines (starts in London on 29^th June). Ideal for data protection officers who want to take on security responsibilities.