Hawktalk

Facial recognition CCTV excluded from new data protection law by definition of “personal data”

I have come to the conclusion that the new definition of personal data in the Data Protection and Digital Information No.2 Bill (“No.2 Bill”) only applies to facial recognition CCTV if the data subject is on a watch-list.

If the individual is not on a watch-list, and the camera images are deleted immediately after checking the watch-list, then personal data are not processed and there are no data protection obligations (e.g. no transparency)

It then follows that if the watch-list, for example, involves details of criminals wanted by the police, many facial recognition systems will process personal data in total secrecy (i.e. no transparency).

This blog explains how the No.2 Bill’s definition of personal data moves such facial recognition CCTV systems into the twilight zone.

Suppose a facial recognition CCTV system is linked to a watch-list of suspects whose facial features have already been digitised (perhaps using the digitised biometric images derived from passport photographs).

Obvious examples of such watch-lists are: (a) a list of those who are of interest for law enforcement purposes or (b) those who commit a crime if they enter a specific area (e.g. those who have been excluded from entering a specific shop).

Suppose further, such a CCTV system is set up in a shopping centre and performs facial recognition on everybody who passes any of the system’s cameras.  The system sends a warning message to the camera operator if someone, on the watch-list, passes the camera; the system also retains the relevant images and other details of the encounter.  Only personal data of those on the watch list are retained.

The system is so designed that the details of those who are NOT on the watch list are not retained (i.e. deleted instantaneously) after the check against the watch-list is complete.

Bridges v South Wales Police

The system described above is the one that featured in the Court of Appeal judgement (Bridges v South Wales Police: paragraph 9, see references).  In this case, the data protection regime (in the DPA1998 and the pre-Brexit GDPR/DPA2018) was fully engaged because the Court determined that “personal data” were being processed about every individual whose image was captured by a Facial Recognition CCTV camera.

In the Bridges case, the Court’s interpretation of the definition of personal data was crucial.  This was derived by reference to Recital 26 of the pre-Brexit GDPR (or to Recital 26 of Directive 95/46/EC when the DPA1998 applied). These Recitals specified that if the information processed related to a living individual who was being singled out, then “personal data” were being processed.

Paragraph 46 of the Bridges judgment makes this point clear.  It states:

46. The primary point of dispute before the Divisional Court under the DPA 1998 was the extent to which using AFR Locate [the name used for the Facial Recognition CCTV system] entails processing personal data, SWP [South Wales Police] contending that the only personal data processed is the data of persons on the watchlist on the ground that it is only those persons that SWP can identify by name.

Having referred to the judgment of the Court of Appeal in Vidal-Hall v Google Inc [2015] EWCA Civ 311, [2016] QB 1003, and to the decision of the CJEU in Case C-212/13 Rynes v Urad [2015] 1 WLR 2607, the Divisional Court concluded (at [122]) that the processing of the Appellant’s image by the AFR Locate equipment was processing his personal data because the information recorded by AFR Locate individuated him from all others, that is to say it singled him out and distinguished him from all others.  (My emphasis).

As we shall see, “singling out” is NOT found in the new statutory definition of “personal data” in the No.2 Bill, and it is this omission that has significant consequences (i.e. SWP’s arguments in the first part of paragraph 46 as quoted above become correct).

Recitals are not law

The definition of personal data in the No.2 Bill is at first sight unchanged: “Personal data” means any information relating to an identified or identifiable living individual.  However, the No.2 Bill introduces the concept of direct or indirect identification of the individual into the statutory definition.

This new statutory definition, which also does not meet the standard of the Council of Europe Convention No 108 set in 1981 (see references), makes sure that the interpretation in Recital 26, as used in Bridges), is largely redundant.

This is because the Recitals themselves have no legal effect in the UK.  This was established in the case of Sanso Rondon v LexisNexis (see references), when the Court invalidated a requirement in Recital 80 (namely “the designated representative [of a controller or processor established outside the UK (or EU)] should be subject to enforcement proceedings in the event of non-compliance by the controller or processor”).

The Court came to this conclusion because the requirement was found only in Recital 80 and was not explicitly linked in any obligation in any Article of the GDPR.  That is why the Court concluded that, in relation to the liability of the representative for non-compliance (e.g. by a controller):

“…if the GDPR had intended to achieve 'representative liability' [for non-compliance as specified in Recital 80] then it would necessarily have said so more clearly in its operative provisions [i.e. the Articles of the GDPR]…(paragraph 101).

In other words, the Recitals are there to help interpret the legislation if there is doubt as to what the statutory requirements in an Article mean.  If a provision described in a Recital is not echoed in a relevant Article, then the interpretation in the Recital can be invalid.

In summary, the requirement for “singling out”, although it remains in Recital 26, it is not supported by any “operative provisions” found in the new statutory definition of “personal data”.  To the contrary, the new “operative provisions” of the definition work to exclude any prospect for “singling out”.

DPDI definition of “personal data”

The No.2 Bill additionally requires that to be “personal data”, there has to be a living individual who is directly or indirectly identifiable; in the latter case, indirect identification has to be at the time of the processing and by using reasonable means.

This raises three additional questions to be answered before the processing of “personal data” by a CCTV system, similar to that under discussion, can be confirmed.

The first question is:  ‘Are individuals identified “directly”?’.  The No 2 Bill requires that “An individual is identifiable from information “directly” if the individual can be identified without the use of additional information”.

Clearly, in the case of facial recognition CCTV, the answer is NO.  This is because additional information has to be used to perform the identification of those images captured by a facial recognition CCTV system (e.g. the pre-recorded details of those on the watch-list).

In other words,  direct identification, is not relevant because identification of a living individual (on or off the watch list) requires "the use of additional information" (contrary to the definition of direct identification).

The next question is: ‘Are individuals identified “indirectly” as defined?’.  The No.2 Bill states that “An individual is identifiable from information “indirectly” if the individual can be identified only with the use of additional information”.

Clearly, the answer is YES as additional information is available as part of the CCTV system to identify those individuals on the watch-list.

But what about those NOT on the watch-list?

This question is answered by the third question in the series: “Is indirect identification easy to do “at the time of the processing” and by “using reasonable means”  (Clause 3A(2) requires “the living individual is identifiable .… by the controller or processor by reasonable means at the time of the processing”).

In this case, for those not on the watch-list, there are no reasonable means of achieving identification available at the time of the processing (e.g. from the time of collection by a camera, checking the watch list, and then its instantaneous deletion).

There are three main reasons for this conclusion:

• first, there is no “additional information” that is available by “reasonable means… at the time of the processing” in the CCTV system itself (or held by some other person);
• second, the image of the individual and related biometrics have been deleted almost instantaneously, so there is no need for additional information to perform the unwanted indirect identification;
• finally it would be unreasonable to ensure the Facial Recognition system retained details of individuals not on the watch-list. The far more reasonable proposition is to protect the interests of such individuals is by deleting their personal details instantaneously, as such deletion guarantees their privacy.  In addition,  the captured details cannot be further processed for purposes other than the original check of “is this individual on the watch-list?”.

In addition, Article 11 of the UK_GDPR specifically states that additional information is not required to be collected.  It says:

A.11(1) “If the purposes for which a controller processes personal data do not … require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation. (My emphasis to show that this is the case when an individual is not on the watch-list).

Hence, there are no data protection obligations placed on those data that concern those whose images are collected and then instantaneously deleted because the individual is  NOT on the watch list.  Quite simply, such a CCTV system does not process personal data (as newly defined) in these circumstances.

The data protection regime of the No.2 Bill only applies to those on the watch list.

Why secret CCTV facial recognition systems?

As a facial recognition system is not processing personal data if an individual is NOT on the watch list,  then there is no need to be transparent as the UK_GDPR does not apply.  There is no need for a lawful basis nor a condition to overcome the processing of Special Category of Personal Data as the information processed is not personal data.

Transparency is only needed for data subjects on a watch list.  However,  there are a number of exemptions in the DPA2018 that provide the controller relief from the need to be transparent if being transparent would prejudice the crime, taxation, immigration or law enforcement purposes etc (e.g. Schedule 2, paragraphs 2 or 4; Section 44 of the DPA2018).  Hence there is no need to be transparent in these cases also.

It follows that many facial recognition CCTV systems can be installed without any transparency obligations and used more or less in secret.  As stated at the beginning of the blog, they enter the data protection twilight zone.

As this is the case, expect the number of Facial Recognition systems to mushroom exponentially after the enactment of the No 2 Bill.

References

Edward Bridges and -the Chief Constable of South Wales Police: Neutral Citation Number: [2020] EWCA Civ 1058

Sanso Rondon v LexisNexis; Neutral Citation Number: [2021] EWHC 1427 (QB)

Definition of “personal data” in DPDI No 2 Bill results in non-compliance with CoE Convention No.108: https://amberhawk.typepad.com/amberhawk/2023/04/definition-of-personal-data-in-dpdi-no-2-bill-results-in-non-compliance-with-coe-convention-no108.html

Data Protection Courses (Summer 2023)

An all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill. Will be held on Thursday 13 July  2023 hopefully to include changes made during the Committee stage of the Bill.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection FOUNDATION Course is on Zoom only (June 20-22, 2023 (Tuesday to Thursday, 3 days: 45am to 5.00pm).
• The next Data Protection PRACTITIONER Course is in London on Monday, 24 July 2023 to Friday, 28 July 2023 (5 days: 9.30am to 5.30pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing [email protected].

Serious questions arising from ICO v Clearview Tribunal Decision

I was surprised by the recent Tribunal Decision (the “Decision”) which quashed Clearview’s £7.5 million fine on the grounds the UK_GDPR did not apply.   My puzzlement has given rise to several important questions about the Decision. These questions need an urgent answer; hence this blog.

Clearview is a USA company which has scraped billions of photos and personal data from the Internet and used them to sell services to law enforcement/national security agencies and similar agencies in other countries (e.g. notably in USA and in South America) but not the EU or UK (wonder why?).

Clearview’s idea is that if, for example, a USA law enforcement agency is looking for a suspect or witness and have a blurry photograph, then they can scour Clearview’s databases to identify possible matches for that suspect or witness and/or their location.

Facial recognition and AI techniques are used in such matches. Clearview do not initiate a search but provide the personal data and the processing means by which a match is undertaken.  Note that Clearview retains much personal data that will NOT be used by, or disclosed to, its law enforcement clients (as such law enforcement bodies are unlikely to be searching for individuals unconnected with a police inquiry).

The more personal data Clearview scrapes from the Internet, the better chance that their clients score a “hit”. Equally, however, the more personal data Clearview will store on data subjects who are of NO interest to their clients.  The Decision reports that there are three billion images on Clearview’s databases.

GDPR did not apply; ICO powerless

The Decision concluded (at para 157) that the UK_GDPR “can apply where the monitoring of behaviour is carried out by a third party rather than the data controller” (i.e. the UK_GDPR applied even though Clearview’s law enforcement clients were performing the monitoring).

However, “the processing is outside material scope of the Regulation as provided for in Article 2 of the GDPR [as] it is not "relevant processing” for the purposes of Article 3 UK GDPR, as defined in Article 3(2A) [of the UK_GDPR] thereby removing the processing from the scope of UK” (para 157).

I have read this paragraph zillions of times but it is difficult to follow (mainly because the Decision says so little about how it came to its critical conclusions about relevant processing. See “Actions of a Foreign Government” below).

However, it is clear from para 157 that Article 3(2A) and its definition of "relevant processing” caused the ICO to lose the argument.  This gives rise to four important questions which are:

1. Does the UK_GDPR’s lack of jurisdiction also apply to the unadulterated EU_GDPR? If the answer to Q1 is “yes”, then there is a pan-European problem that should be considered by the European Data Protection Board.
2. If “no” to Q1, does the lack of jurisdiction issue apply just to the UK_GDPR because of a drafting issue?
3. If “yes” to Q2, was this drafting problem accidental (i.e. “stuff happened” because of the haste associated with UK’s wonderful “oven ready Brexit deal”). If so, will the Government commit to correcting this drafting error in the DPDI No 2 Bill or will it prefer to do nothing in order to curry favour with USA high tech involved with AI?
4. If “no” to Q2, was the drafting problem a deliberate In which case: “Why was Parliament not informed by DCMS Ministers of this important change?”.

Finally consider the consequences of a private USA company, scraping the Internet for billions of photographs and other personal data to be used by foreign law enforcement agencies,  where millions of EU/UK citizens have no DP rights.  Does this set of circumstances influence the answer to question: “Does the USA offer an adequate level of protection?”.

In short, from the UK perspective alone, the Decision appears to provide evidence that the USA does not offer an adequate level of protection for personal data transfers from the UK/EU to the USA.

Actions of a Foreign Government

I was struck by the following when reading the Decision:

“14.  In oral submissions it was accepted by the Commissioner that processing by a foreign government would not be within the scope of the Regulations due to the principles of international law that mean that one state cannot seek to bind another. The actions of a foreign state are out of scope, by application of Article 2(2)(a) GDPR and Article 3(2A) UK GDPR” (para 14)

So, the foreign government issue, which is crucial to the outcome of the Decision, was settled orally (i.e. possibly not written down).

The importance of this issue was repeated at the end of the judgement:

"153.  Therefore, the question for us remains the same. It is foremost a question of fact as neither party contends that the acts of foreign governments would be within the material/territorial scope of the Regulations because the activities of foreign governments fall outside the scope of Union law. It is not for one government to seek to bind or control the activities of another sovereign state". (para 153)

The police service in the USA comprises 18,000 organisations at federal, state, municipal and sheriff level; there are also policing oddities as there is in the UK (e.g. park or transport police).  These organisations may be funded by government but are not an executive arm of the government in the sense that politicians in power arbitrarily choose who to arrest or who to prosecute.  This is unlike, for example, law enforcement in Putin’s Russia or other autocratic states.

I wonder therefore whether the use of Clearview’s services by USA law enforcement agencies comprise “actions of a foreign state” given the sheer number of independent policing agencies in the USA?  If the use was by say, the Department for Homeland Security, then one could argue this foreign government point.

However, the actions in question are not of one Department of State; the actions are of a devolved policing service involving thousands of bodies.  In other words, I am unsure whether these thousands of bodies can be viewed as “actions of a foreign state”.

Clearview is monitoring

In addition, unlike the Decision, I think that Clearview itself is monitoring behaviour of data subjects residing in the UK/EU.

Most personal data are NOT used by foreign police forces etc because they relate to data subjects who are NOT of interest to the police, and never shall be.  Such personal data are “retained” by Clearview (for a long time, one assumes) and retention is a processing operation, undertaken by Clearview, where there is no prospect of “actions of a foreign state”. The personal data are retained by Clearview until their deletion.

The Decision asserts that there is monitoring of behaviour by Clearview’s clients but not by Clearview itself.  I think this is an error.

To facilitate monitoring, Clearview retains bulk personal data in case some of these data become of later interest to the police.  Note that the personal data do not change when they are actually used or disclosed to the police.

If there is monitoring by the police (as the Decision states) when they initiate a search, it follows that the personal data must be organised in a structure that permits such monitoring, prior to that search.  As this structure is arranged by Clearview (“organisation and structuring” being two processing operations as defined), it follows that Clearview is also monitoring by pre-structuring the data in anticipation of a search by one of its law enforcement clients.

In my humble view, even if the foreign state point is lost, Clearview is retaining scraped personal data of those NOT of interest to the police for law enforcement and national security purposes as a controller, and is also monitoring behaviour as described in the Decision.

Conclusion

In other words, I need to be convinced that the Decision is correct.

Hence the interesting question: “does the current ICO have the stomach for an Appeal?”.  It is this final question that has to be answered soon.

References

Clearview AI Inc v The Information Commissioner [2023] UKFTT 819 (GRC) https://caselaw.nationalarchives.gov.uk/ukftt/grc/2023/819

Forthcoming Data Protection Courses

Our well received, all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill will be held on Thursday 7 December  2023.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London on Monday, 20 November 2023 to Friday, 24 November 2023 (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (December 12-14, 2023: Tuesday to Thursday, 3 days: 9.45am to 5.00pm) or

Full details on Amberhawk’s website (www.amberhawk.com) or  obtained by emailing info@amberhawk.com.

Cronyism at the Information Commission can undermine its regulatory independence

I have atoned for not delivering a blog for two months by reading Schedule 13 of the Data Protection and Digital Information No 2 Bill (the “Bill”).  As readers know, the Information Commissioner (ICO) is to be replaced by an Information Commission, and Schedule 13 outlines the procedural arrangements for the operation of the Commission.

Schedule 13 is not “a gripping read”.  With all its provisions about voting, quorums, Committees, Board Members, Chairs and Chief Executives, the text can be described in two words: one is a swear word and the other is “boring”.

However, this Schedule has the potential to transfer data protection power to the Secretary of State (“S.o.S”) through the appointment of (“trusted”) Non-Executive Members to the Commission.  The proposed Commission’s voting structure, from the direction of data protection policy to the appointment of the Chief Executive and other Committee Members, are all subject to the approval of these Ministerial appointees.

For example, new Clause 120B to the DPA2018 says the Commission (once established) has to have regard to a number of factors (e.g. innovation, competition, crime reduction, national security) as well as protecting personal data. The S.o.S can influence which of these factors prevail through the ability to appoint Non-Executive Members to the Commission.

In this Blog, I give several examples to highlight the risks to data subjects. The references relate to the Bill at Second Reading (Commons) if readers want to follow the points being made.

ICO becomes Chair NOT Chief Exec

When the Commission is established in about 2 years’ time, the current ICO becomes the Chair of the Board and not the Chief Executive (see Schedule 13, page 204, para 2(2)(sic)).  This is a surprise since it is usually the Chief Executive who is responsible for all day-to-day executive actions (e.g. detail of enforcement, strategy, policies).

The Chair is not usually involved in such mundane day to day activity and its role is usually limited to a reassuring figurehead role and ensuring the Board runs smoothly.

Just think of your organisation and the roles of Chief Executive and Board Chair.  The Chief Executive has the real day to day power; the Chair stays aloof from the fray and only gets involved when an issue is huge, or the Board fails to operate properly.  And so it will be for this Commission.

As can be appreciated, the current ICO acts more like a Chief Executive and not a Chair (e.g. deciding on whether to enforce, issuing Codes of Practice, deciding on Guidance, making public statements).  In future. such actions are likely become the responsibility of the Chief Executive and  Non-Executive Members of the Commission and not the Chair.

So who becomes Chief Executive becomes very important.  This lucky person is appointed by the Non-Executive Members of the Commission, all of whom are appointed by the S.o.S.  There is no Parliamentary involvement in this selection.

In other words,  the Chief Executive is indirectly chosen by the S.o.S, as the Non-Executive Members of the Commission who appoint the Chief Exec are all appointed by the S.o.S.

In addition, to make sure that the Non-Executive Members of the Commission make the “right” Chief Executive choice, they must consult the S.o.S prior to appointment (so that the S.o.S. can signify approval of their choice: para 3(4)).

The current ICO as Chair

So what will Mr. Edwards do when the Commission comes into being? As the current ICO’s 5 year term is scheduled to end on 3 January 2027, he is likely to become Chair in the last year of his tenure.  It will probably take this last year to embed the new Commission’s governance arrangements.

If one assumes a two-year lead in time from the initial enactment of the Bill (likely in May-July 2024) and for the substantial provisions of a revised DPA2018 to come into effect (e.g. establishment of the Commission), then we are looking at Spring 2026 for the commencement of the Commission.

This two year delay is a reasonable assumption.  Such a delay occurred with the DPA1984 (commenced in 1986), the DPA1998 (commenced in 2000) and GDPR Regulation passed in 2016 (commenced with the DPA2018).  The delay is needed to rewrite the necessary Guidance on the revised DPA2018.

In other words, by 2026, the Government has to wait about 9 months or so before the current ICO rides off into the sunset (suitable gong in hand).

I suspect in practice that the current ICO will try and act in the same way as he does now.  However, it may come as a surprise to him (and future Chairs) that the real power lies with the Chief Executive and the other Non-Executive Members of the Commission chosen by the S.o.S.

There is the potential for conflict; for instance, suppose the Chair wanted to “do something” contrary to the views of the Chief Executive and Non-Executive Members of the Commission.  If this happens, any conflict is likely to be resolved by the votes of other Non-Executive Members of the Commission (all of whom have been chosen by the S.o.S.).  In this way, the Chair easily loses out.

In this management structure, the Chair is not free to develop UK data protection policy as the current ICO has done.  Instead of the Chair being the UK’s data protection leader (the current position), the risk is that the Chair becomes a “prisoner ” of the Commission’s management structures, as controlled by chosen S.o.S. acolytes.

Members of the Commission

The Commission consists of Executive and Non-Executive Members.  The Non-Executive Members of the Commission are only appointed by the S.o.S (Sched 13, para 3(2)(b)).  There is no Parliamentary involvement.

These Non-Executive Members do not get involved in day to day activities which are the responsibility of Executive Members.  Non-Executive Members, however, can be expected to be involved in approving overall policymaking as well as monitoring the activities of Executive Members.

Executive Members of the Commission can be appointed by other Non-Executive Members (para 3(3)) or by the S.o.S. (para 9).

Although there is “fair and open” competition for all Members of the Commission (para 5(2)), it has to be remembered that the S.o.S can influence who is on the shortlist; the risk of only choosing between “trusted potential appointees” is not eliminated.  This risk would be much reduced if, for example, there was a specific requirement to have Members who are mandated to look out for the interests of data subjects.

At any time, Schedule 13, para 4 requires the number of Non-Executive Members to be greater than the number of Executive Members. This means that there are skewed voting arrangements. The Non-Executive appointees (chosen by the S.o.S) have a vote;  all Executive Members (e.g. those chosen by Non-Executive Members) do not have a vote.

The Committees

The Commission is free to establish committees that contain “other persons” who are not Members of the Commission or employees (para 13).  Indeed, the Commission can delegate any of its functions (e.g. enforcement) to that Committee or indeed to those “other persons” (para 14) whoever they may be.

There is no obligation for these “other persons” to possess suitable qualifications, or to apply for advertised positions, or to be subject to Parliamentary scrutiny.

Worst case scenario:  Non Executive Members (i.e. “S.o.S. chosen cronies”) vote for like-minded Executive Members (i.e. more cronies) and “really trusted” members of all important Committees (e.g.perhaps semi-cronies) to generate and approve all “appropriate” data protection policy.

Of course, many may argue that this worst case of cronyism won’t happen.  However, that misses the point.  The fact that this worst case position can be constructed from the comitology specified in this Bill shows that any guarantee that the Commission is 100% independent of S.o.S. influence is demonstrably false.

A set of worst case scenarios

This lack of independence is reinforced by other provisions in the Bill.  I give three examples, but to understand what I am driving at, assume the Commission is controlled by (or contains) a set of S.o.S approved, Non-Executive, “friends”.  All of the examples below give rise to a potential conflict of interest that is likely to be detrimental to the interests of data subjects.

Example 1: Clause 19 of the Bill (Law enforcement Codes of Conduct) specifies that Codes of Conduct can “demonstrate compliance with the requirements of this Part” (i.e. the law enforcement Part 3 of DPA2018).  In other words, the law enforcement provisions of Part 3 are satisfied if the processing meets the requirement of a Code of Conduct.

Sounds reasonable until one considers how a Code of Conduct is produced?

Well, the Commission (via its Non-Executive Members chosen by the S.o.S.) identifies an expert public body to draft a Code of Conduct (e.g. how about the Home Office? What a surprise!) which then submits its text, eventually to the same Non-Executive Members for approval on behalf of the Commission.

In this way, there is a potential conflict of interest if a Code of Conduct permits the Home Office to determine lawful processing for the controllers under its own departmental remit.  This conflict of interest would be reduced if there were Members charged with looking after the interest of data subjects.

Example 2: Clause 25(3) which introduces Section 82A(8) into the DPA2018 which allows Part 3 personal data to be designated as being subject to national security processing rules.  Before issuing a designation notice, the S.o.S. “must consult the Commission”.

In practice, this means the S.o.S. consulting a Commission controlled by Non-Executive Members where the S.o.S. has appointed these Members to the Commission.  This more or less repeats the conflict of interest re law enforcement, as there is unlikely to be much disagreement about a designation notice.

The result of this conflict of interest is that national security compliance with the DPA2018 becomes even weaker; again an argument for the existence of Members charged with looking after the interest of data subjects.

Example 3: Clause 30 which includes reference to the panel that is formed to consider any draft Code of Practice (e.g. on data sharing).  If this panel were to become a Committee of the Commission, this in turn means that the members of that Committee and the draft of a Code of Practice would be signed off by Non-Executive Members chosen by the S.o.S.  This mechanism risks skewing Code of Practice content in favour of a text that is favourable to the S.o.S.

Note I have not mentioned a role for the Chair in any of the above. By a miracle of Comintern comitology, devised by this Bill, the Chair has no defining role.

Conclusion

The ICO often states that he is satisfied that regulatory independence is guaranteed under the DPDI No 2 Bill.  In evidence to the Bill’s Standing Committee he said: “I do not believe it [the Bill] will undermine our independence at all. What I think it will do is to further enhance and promote our accountability”.

I hope the ICO now appreciates that he risks being profoundly wrong.

Forthcoming Data Protection Courses

Our well received, all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill will be held on Thursday 7 December  2023.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London on Monday, 20 November 2023 to Friday, 24 November 2023 (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (December 12-14, 2023: Tuesday to Thursday, 3 days: 9.45am to 5.00pm) or

Full details on Amberhawk’s website (www.amberhawk.com) or  obtained by emailing [email protected].

If “guard-rails” are needed to control Artificial Intelligence, why does the DPDI No.2 Bill remove them?

Last week, the Prime Minister was quoted concerning the need to ensure Artificial Intelligence (AI)  is “introduced safely and securely with guard-rails in place”.  Strange to find that he appears to be unaware that several of these urgently needed guard-rails are being dismantled by the DPDI No.2 Bill (the “Bill”).

On June 6^th, I delivered a presentation to the Data Protection Forum where there was lively discussion concerning the weakening of data protection within several identified issues of the Bill.

I have decided to repeat that lecture, this time as a video so readers can follow the detail of those discussions.  The video (if interested see URL at the end) lasts 51 minutes (171 MB).

For those who do not have the time to hear my dulcet tones, the rest of the blog summarises the points I was making.

Bogus savings for MPs

First (slide 4), the saving figures produced by Government are suspect; indeed, they are “put them on the side of a Brexit Bus” dishonest.  The Minister, for example, in the Commons boasted that £90 million per year can be used by SME’s for “higher investment, faster growth and better jobs”.

Well if you do the maths, there are 1 million SMEs notified with the ICO; this works out at £1.73 per SME per week.  I could be wrong, but I don’t think one obtains much “higher investment, faster growth and better jobs” for £1.73 per week per SME.

No Brexit Dividend

The next point is that, contrary to Government claims, (mindlessly repeated by others,  I hasten to add), there is no “Brexit dividend” arising from the UK departing from GDPR rules.

In slides 5 to 10,  I show how the GDPR does not put barriers in the way of innovation and proof of concept processing and that this mechanism is open to all of the UK’s Euro-competitors.  If they follow the recipe I outline, they are unlikely to be hindered by the GDPR until they are satisfied that the proof of concept works and an implementation phase begins.

Operational systems exposed

Large differences between the Bill and the unamended UK_GDPR arise when one goes from “proof of concept” processing of personal data to the implementation phase (this comparison is made in slides 11 and 12).

Here I show that a high risk implementation (e.g. of AI) might now not get a DPIA, or expert DP advice from a DPO, or even reported to the ICO if there is a residual high risk to data subjects that cannot be mitigated.  In other words, the Government’s changes mean that high risk AI processing could be exposed to a lack of data protection input (especially if that processing is undertaken by a start-up company).

Not only that. The fact that Ministers have powers in the Bill to determine lawful processing, compatible processing, the ICO statutory priorities, content of Codes of Practice, the right not to be subject to automated decision taking, and ensure the ICO has to consider non-DP factors prior to enforcement all collectively weaken the hands on the privacy protection tiller.

There is talk of a 6 month moratorium on AI and conferences in the Autumn to decide what to do.  Perhaps this Bill should be held-in limbo for that time,  because if these discussions conclude that legal protection is needed by society, this Bill would be well placed to put them quickly into effect.

Defective definition

In slides 13 to 16, I return to the definition of “personal data” as it risks weakening protection.  I present my analysis which shows that Facial Recognition Cameras, as used by South Wales Police, might not be processing personal data according to the revised definitions.

I also show that the definition of “personal data” falls below the standard set forty years ago by the DPA1984.

Datashare? Rhymes with nightmare

Finally I touch on the expansive voluntary data sharing regime (slides 17-22) and explain how Ministerial powers enable them to make their pet projects process personal data lawfully (by adding lawful basis to Annex 1 of the Bill) and also ensure they are compatible with the processing (by adding to Annex 2).

I show the balancing tests between the interests of data subjects and the interests of the controller that protect the public from unlawful disclosure have been abandoned. These protections arise because there is either a “public interest” test associated with the disclosure to a public body, or the disclosing controller performs “legitimate interest test” prior to disclosure to that public body.

Either way, the Bill’s legislative changes provide a prime example of how the Bill eases the burden of data sharing for controllers at the expense of privacy protection for data subjects.

I also note that there is little the data subject can do if the data sharing goes pear-shaped.  The underlying assumption is that data sharing is a “good thing”; no thought has been given as to what happens if that assumption is wrong.

Finally, I pose a question: “what is the point of Parliament providing, for example, HMRC statutory powers to demand personal data, subject to detailed statutory safeguards, if both statutory requirements & safeguards can be avoided by using a voluntary approach towards data sharing pursued in this Bill?”.

Further weakening

Other weaknesses are mentioned in slide 3.  I had no time to develop them into my talk so I list them as follows:

• Third party marketing is a “legitimate interest”; this overturns four decades of “third party marketing requires consent”.
• Policy towards ECHR jeopardises Adequacy Agreement. The Illegal Immigration Bill provides an example of powers that allow Ministers to ignore Strasburg Human Rights rulings. The Agreement states that the UK Government will follow these rulings.
• The right not to be subject to automated decision/profiling (likely to be important for AI) is diminished in importance as Ministerial powers can dictate when such decisions/profiling can occur.
• The risks from onward transfers remain (e.g. France to UK to Gibraltar). Gibraltar is adequate as far as the UK is concerned; it is not adequate as far as the European Commission is concerned.  I am expecting many large controllers will have to deal with this situation as the Bill’s transfer arrangements are very generous.

As an aside, I am expecting, for Rwanda to be determined as offering an adequate level of protection. After all, if the UK is dispatching illegal immigrants to that country, it would be embarrassing if Rwanda failed the tests presented by the ICO in his “Transfer Risk Assessment” documentation.

I wonder if DSIT, Home Office, FCO or any one of the ICO’s thousand staff have done this TRA?

Concluding comment

The Government has truncated debate in the Committee stage and pushed through its legislative program through in six sittings in less than 10 days in May; such is the disdain held for privacy protection.  Even then, the debates have been lamentable and it appears that there has been little input from NGOs working in the privacy space.

I suspect that either the Opposition does not understand the nuances of the situation or that it supports the Government’s motives behind the Bill.  I have not worked what their position is, yet.

Hopefully, the video will help redress that shortfall for the House of Lords Debates. The Video (51 mins) is accessible at: https://www.dropbox.com/s/9s424y1r13v9dv9/DP%20forum%202023%20june%20%20v2%20lowq.mp4?dl=0

Data Protection Courses (Summer 2023)

An all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill. Will be held on Thursday 13 July  2023 hopefully to include changes made during the Committee stage of the Bill.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection FOUNDATION Course is on (September 19-21 2023 (Tuesday to Thursday, 3 days: 45am to 5.00pm) or
• The next Data Protection PRACTITIONER Course is in London on Monday, 24 July 2023 to Friday, 28 July 2023 (5 days: 9.30am to 5.30pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing [email protected].

DPDI No.2 Bill dumps all data subject consent requirements for Third Party marketing

The DPDI No.2 Bill (the “Bill”) overturns the Third Party direct marketing rules in relation to data subject’s consent that have applied for 40 years, ever since the DPA1984.  This blog illustrates how Third Party marketeers will be able to lawfully rely on legitimate interest for such marketing.

For the purposes of this blog, the old ICO DPA1988 Guidance on the processing of personal data for a direct marketing purpose had a useful summary concerning the use of data subject’s consent.  This summary is unchanged by the UK_GDPR except consent has to be obtained by “opt-in”.

“Consent is central to the rules on direct marketing. Organisations will generally need an individual’s consent before they can send marketing texts, emails or faxes, make calls to a number registered with the TPS, or make any automated marketing calls under PECR.

They will also usually need consent to pass customer details on to another organisation under the first data protection principle.  If they cannot demonstrate that they had valid consent, they may be subject to enforcement action.”

For convenience, I have modified this summary to highlight the proposed legislative changes in the Bill:

“Legitimate interests is central to the rules on direct marketing. It is best practice for organisations to provide an opt-out to an individual before they can send marketing texts or emails to their customers, or pass customer details on to another organisation for their marketing purposes.

In many circumstances, especially where personal data is collected from publicly available sources, the information concerning the opt-out can be sent with the first marketing message.  Consent for a marketing purpose will only be required in exceptional circumstances (e.g. when using health personal data for a marketing purpose; sending an unsolicited email marketing message to a domestic email address).

This blog explains how the Bill achieves the above.

Changes to the UK_GDPR

Direct marketeers prefer “opt-outs” for marketing (e.g. “tick the box if you don’t want marketing”); by contrast, European DP regulators insist that consent for the marketing purpose should be an “opt-in” (e.g. “tick the box if you want marketing”).   As the lawful basis of “consent” requires an “opt-in”,  it follows that “legitimate interests” lawful basis, if used, can be satisfied with an “opt-out”.

This impasse has not been helped by the text of Recital 47 of the GDPR which supports claims for using “opt-out”.  The Recital includes the statement that “The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest”.

So what does that “may” mean?  Should that “may” be interpreted as allowing “legitimate interests” to be used only in “exceptional” circumstances (e.g. where obtaining data subject consent is impractical) or can legitimate interests apply in “most” circumstances  (e.g. as an alternative to obtaining data subject consent)?

The data protection regulators prefer the former, the direct marketing lobby prefer the latter.

The Bill has no truck with this divergence of views. It has determined that the legitimate interests lawful basis is satisfied if the processing of personal data is for a marketing purpose. (See the proposed new Article 6(9) of the UK_GDPR).

In further detail,  the lawful basis in Article 6(1)(f)  [..“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data”] is satisfied if specific processing of personal data is designated as being “necessary for the purposes of a legitimate interest”.

Such designated processing includes “processing that is necessary for the purposes of direct marketing” (my emphasis on is).  This “is” also means that no Legitimate Interest Assessment is required to balance the competing interests between controller or third party versus data subject.  The matter has been resolved in favour of processing of personal data for the marketing purpose.

Note that the Bill does not limit the application of legitimate interests to a marketing purpose undertaken by the controller who first collected the personal data directly from the data subject.  The provision is so generously drafted that it allows “necessary for the purposes of a legitimate interest” to apply to any Third Party marketing.

It follows that Third Party marketing can be legitimised by an opt-out.  Thus ending a four decade requirement that a controller indulging in Third Party marketing has to obtain data subject consent for that Third Party marketing.

Recognise that controllers are going use legitimate interest for its marketing wherever possible as this lawful basis is devoid of all the consent baggage which protects data subjects (e.g. it is as easy to provide consent as to withdraw consent;  evidence of consent).

Obtaining personal data from the data subject?

The rights and interests of the data subject as specified in A.6(1)(f) are the right to be informed about the marketing purpose (in A.13 and A.14) and the right to object to marketing (in A.21).  These are taken into account by offering an opt-out in every marketing communication with the data subject.

In addition, if a controller is obtaining personal data directly from the data subject, this opt-out has also to be provided before or at the time of collection.  This now includes any opt-out from any Third Party marketing purpose.

Fairness under the First Principle (of A.5) still requires the opt-out box to be prominently positioned but if the box is missed by a data subject, then the default position is that the data subject will be sent all controller (and any Third Party) marketing as described in the right to be informed/privacy notice, until the data subject reverses this position.

Finally in this section, those of you who fondly remember the DPA1984 and DPA1998, will look forward to re-engaging with the game of “Where’s Wally?”.  The “Wally” in question is identifying the location of the opt-out box that one has to tick before completing the rest of the form.

Obtaining personal data from elsewhere

But what happens in other circumstances when the personal data are obtained not from the data subject?  For example, suppose I trawl through an organisation’s public facing website picking up staff names and business email or postal addresses.

Usually, if one has the name of a member of staff  (e.g. Fred Bloggs) and the work place domain (e.g. domain.com) one can usually deduce a likely email address for each employee (e.g. [email protected]).

Such email addresses are personal data but the PECR marketing rules do not apply as the addresses hoovered up (or generated) do not belong to individual subscribers.

As the personal data have been obtained from a source other than the data subject (e.g. from the company website), notification of the marketing purpose can be sent at same the time as the marketing message.

This is because Article 14(3)(b) states the controller can provide the right to be informed/privacy notice  “at the latest at the time of the first communication to that data subject”.  The first communication in this case being the marketing message plus the related opt-out details.

Hopefully the recipient of such an email at work will be diligent enough to find what these opt-out arrangements are.  If the communication is deleted unread, then further legitimate interest marketing emails (including any unticked opt-out Third Party emails) will continue to arrive in the Inbox.  Spam in the work-place is therefore set to increase.

Suppose another company  wants to use home address personal data for a postal marketing purpose.  So long as they do not collect the home addresses directly from the data subjects concerned,  they too can indulge in informing the data subject and provide an opt-out with their first marketing communication.  There again, if one fails to respond to the opt-out invitation then such marketing will continue until you do so.

The Third Party opt-out rules will also apply to your home and work phone numbers, so I would consider putting them both on the Telephone Preference Service.  However, if you sign up for a service, make sure you do not miss any associated opt-out of Third Party telemarketing.

If you miss it and return an unticked opt-out “approving” Third Party marketing, then TPS is unlikely to automatically save you from unsolicited telephone marketing: the missed Third Party opt-out could be enough to make those Third Party marketing calls legitimate.

No longer unfair

The old DPA1998 guidance stated that marketeers “… will also usually need consent to pass customer details on to another organisation under the first data protection principle”.

It is important to explain why this requirement will not apply with the Bill, as the ICO had previously employed an “unfair processing” argument to arrive at the requirement for data subject consent for Third Party marketing.

There are three main reasons why this approach does not work under the Bill:

• First the legitimate interest lawful basis makes the processing for a Third Party marketing purpose unequivocally and explicitly lawful; the statement in new A.6(9)  that the “processing that IS necessary for the purposes of direct marketing” makes sure of that.  If Parliament has determined that processing for a Third Party marketing purpose IS lawful, any unfair processing is not going to make that processing also unlawful.
• Second, the A.14(3)(b) requirement to send the right to be informed/privacy notice at the time of first communication with the data subject is satisfied, and the right to object requirement is offered as an opt-out so all the relevant rights of data subjects are respected. Hence the processing cannot be unfair on these grounds.
• Third, the DPA1998 and DPA1984 had a statutory interpretation of fairness that is absent from the UK_GDPR, and the fairness arguments associated with the previous legislation did not have to deal with the statutory provisions described in the two previous bullets. In other words, the changes made by the Bill will negate or distinguish the relevance of previous Tribunal precedents on data subject consent for Third Party marketing.

In general, I think the issue of “fairness” will be reduced to procedural irregularities and issues such as the opt-out box is not in the correct location, or the opt-out box is not prominent, or the box is a small type-face etc.  Fairness, in my view, will no longer require prior consent unless the legislation itself demands consent (e.g. as in some limited email marketing under PECR).

Concluding comment

It is clear to me the “legitimate interest” changes proposed by Government are a disaster; it risks a spammers charter.  And that is before any consideration of the expansion of the “soft-opt in” (which really is an opt-out) for individual subscriber emails.

The Bill's Third Party marketing proposals are either wholly careless or deliberate.  If it is the former, one wonders what other horrors in the Bill have been carelessly drafted.  If it is the latter, one wonders how much in donations have been promised to the ruling political party.

Data Protection Courses (Summer 2023)

An all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill. Will be held on Thursday 13 July  2023 hopefully to include changes made during the Committee stage of the Bill.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection FOUNDATION Course is on Zoom only (June 20-22 2023 (Tuesday to Thursday, 3 days: 45am to 5.00pm).
• The next Data Protection PRACTITIONER Course is in London on Monday, 24 July 2023 to Friday, 28 July 2023 (5 days: 9.30am to 5.30pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing [email protected].

The “Seven deadly privacy sins” associated with the DPDI No.2 Bill

The blog provides a summary of seven areas where the proposed Data Protection and Digital Information No. 2 Bill (“No.2 Bill”) undermines privacy issues; these should be debated by Parliament. Some area, such as ICO independence and research, are left unexplored in this Blog.

1.   Absence of Keeling Schedules

It is difficult to comment on legislation that significantly modifies existing legislation if the relevant Keeling Schedules, which detail the proposed legislative changes, are unavailable (perhaps deliberately so).  The No.2 Bill makes 100+  pages of changes to the DPA2018 and the UK_GDPR  (as did the No.1 Bill).

Ministers have had over a year from the publication of the No.1 Bill to organise the preparation of Keeling Schedules for the No.2 Bill but have failed to do so.  I cannot see how the Committee (or anybody else) can scrutinise this legislation properly without these Schedules.

Hopefully, the Committee will reprimand the absence of a Keeling Schedules covering the interaction between the No.2 Bill and the DPA2018 or UK_GDPR and demand they are published even at this late stage.

2.   Omission of Human Rights

Although the Information Commissioner (ICO) is welcoming towards the No.2 Bill, this is not the case with respect to the Government’s proposed changes to the UK’s Human Rights Act.  Although Mr. Raab has resigned, his Bill of Rights (BoR) remains ready for its Second Reading, and other Ministers have indulged in tinkering (e.g. the Illegal Immigration Bill allows Ministers to ignore Strasbourg jurisprudence).

If anything is going to impact on the European Commission’s Adequacy Decision it is the UK’s approach to Human Rights; the Adequacy Decision itself mentions “human rights” over 80 times and compliance with Strasbourg jurisprudence is expected by the Agreement.  Such compliance is the exact opposite of Government policy.

The No.2 Bill is integrally linked to the proposed BoR via Articles 8 and 10 of the Human Rights Act 1998.  However, there has been no consideration of the BoR and the related No.2 Bill interaction nor on the impact on the application of lawful processing.

The ICO is on the record as stating that the impact of the BoR is extensive:

• “The concept of necessity is fundamental across the DPA/UK_GDPR (Article 5 principles, Article 6 lawful bases, Article 9 conditions for processing special category data, Article 23 exemptions, and Schedule 1)”.

• “…likely impact could make it more difficult for the ICO to protect individuals data” (e.g. “if public authorities are be able to rely on public interest grounds in a presumptive way”: (para 3.27).

The Government should make a statement about the future of the BoR and appreciate, the more they tinker, the greater the risk to Adequacy. Further detail can be found in my blogs:

“UK Bill of Rights set to undermine UK_GDPR and Adequacy”; https://amberhawk.typepad.com/amberhawk/2022/07/uk-bill-of-rights-set-to-undermine-uk_gdpr-and-adequacy.html  and

 “DPDI No.2 Bill should be paused until the UK Bill of Rights position is resolved”: https://amberhawk.typepad.com/amberhawk/2023/03/dpdi-no-2-bill-should-be-paused-until-the-uk-bill-of-rights-position-is-resolved.html.

3.   Dubious cost savings

The Government’s figures, if analysed properly, show the savings associated with this Bill are insignificant. For instance, as there are 67.1 million data subjects in the UK so the cost of maintaining current UK_GDPR standards is calculated as £7.00 per year per data subject.  This equates to 13.5 pence per data subject per week, or just under 2p per day.

As there are 1.07 million controllers, the average saving for each controller can be calculated at £439 per year per controller.  This is about £8.40 per week per controller; about the price of a bottle of plonk.

The Question has to be asked: “are the proposed cost savings associated with these legislative changes really worth the candle?”.

A full financial analysis can be found on “New DPDI Bill savings inflated by 324%” (from the No. 1 Bill):  https://amberhawk.typepad.com/amberhawk/2023/03/new-dpdi-bill-savings-inflated-by-324-loss-of-adequacy-costs-uk-over-2-billion.html

4.   Defective re-definition of personal data

The definition of “personal data” in the No.2 Bill is defective; it certainly does not comply with data protection standards established in 1981 let alone the definition of “personal data” in the GDPR.  This undermines the substantive provisions in the UK_GDPR/DPA2018 as they are all defined in terms of personal data.

The problem arises as the No.2 Bill definition brings into the statutory definition only a selective part of the interpretation in Recital 26 of the GDPR (e.g. it does not bring into the new definition, the Recital 26 interpretations concerning “anonymous data” or “singling out”).  The latter defect explains why the definition does not fully cover personal data captured by facial recognition cameras; the former allows for the existence of “not quite personal data”.

Further detail of the definition’s defects are discussed in my two blogs.

“DPDI No.2 Bill defines “personal data” below the international standards established in 1981” https://amberhawk.typepad.com/amberhawk/2023/04/definition-of-personal-data-in-dpdi-no-2-bill-results-in-non-compliance-with-coe-convention-no108.html) and

“Facial recognition CCTV is excluded by DPDI No2 Bill’s definition of personal data”: https://amberhawk.typepad.com/amberhawk/2023/04/facial-recognition-cctv-excluded-from-new-data-protection-law-by-definition-of-personal-data.html).

5.   Voluntary data sharing undermining Parliament

The Digital Economy Act 2017 provides Ministerial powers to set up voluntary data sharing arrangements between public bodies; these arrangement are being expanded in the No.2 Bill.

The direction of travel is for more voluntary data sharing, under the assumption is that such data sharing is for a public good.  There is very little in the way of redress if this assumption is wrong and the data sharing goes pear shaped.

For instance, the Bill provides for a lawful basis for voluntary data sharing between pubic bodies, and declares the related processing purposes to be compatible.  Thus, informing the data subject about the sharing is largely irrelevant if the data subject cannot do anything with this transparency information and disagrees with the data sharing. 

The data subject is placed in the same position as being blackmailed in that the data subject is fully informed as to what is going on, but the options for acting on this information are somewhat limited.

Another serious unexplored issue is the conflict between this expanded voluntary disclosure mechanism and the circumstances when Parliament has given powers (e.g. to national security, law enforcement and HMRC) to demand personal data.

For instance, should a voluntary approach for disclosure to a public body be permitted when Parliament has already provided explicit statutory powers to that public body so it can demand the same personal data?

Expansion of the voluntary approach towards data sharing avoids the statutory safeguards insisted by Parliament.  This raises the question of “What is the point of Parliament providing statutory powers to demand personal data to specific bodies, subject to detailed statutory safeguards, if both statutory requirements and safeguards can be avoided by using a voluntary approach towards data sharing?”.

For instance, as explained in relation to voluntary disclosures to HMRC as proposed in this Bill, disclosures to HMRC by-pass statutory powers, by pass the exemption in the DPA2018 that covers such disclosures, and can make data sharing lawful in the absence of any “public interest” test.

See: “DPDI Bill removes “public interest” test in push to legitimise general public sector data sharing”; https://amberhawk.typepad.com/amberhawk/2022/08/dpdi-bill-removes-public-interest-test-in-push-to-legitimise-general-public-sector-data-sharing.html

6.   Excessive Marketing made legal

The proposed use of the “legitimate interests” lawful basis to support marketing activities overturns nearly 40 years of data protection law when applied to Third Party marketing.  Seeking consent for Third Party marketing has been the norm ever since the early Tribunal Decisions under the DPA1984.

Additionally, the Government has not reproduced in the Bill, the safeguards that were associated with consent for Third Party marketing (e.g. it should be as easy to withdraw consent as to give it).

Under the No 2 Bill,  there is no statutory ability for data subjects to change their mind re Third Party marketing in an easy way (e.g. if they miss the opt-out box), if it falls within “legitimate interests” (as it does with B2B email marketing).

The result is that the marketing arrangements could be open to considerable abuse, especially in relation to email addresses of employees,  unless

• legitimate interest is limited to the controller’s lawful basis (and not expanded to include Third Party marketing) and
• controllers who rely on legitimate interests for their own marketing have to provide an easy and simple way for those who did not see the “opt-out” to change their mind (which includes any Third Party marketing).

This will be the subject of a future blog, so readers can appreciated how this Government “really cares”.

7.   Omission of Identity Assurance Principles

As background to the Digital Identity parts of the Bill, I refer to the “Nine Identity Assurance Principles” that were published in 2015 by Government for inclusion in any future digital identity projects.  The Nine Identity Assurance Principles can be found on the Government website at: https://www.gov.uk/government/publications/govuk-verify-identity-assurance-principles/identity-assurance-principles). 

The objective was to avoid a repeat of the ID Card debacle a decade earlier. The Government asked a number of privacy experts (including the ICO) to debate and draft a set of objectives for a safe ID system.  As a result, these Identity Assurance Principles emerged to provide a benchmark for a privacy compliant digital identity scheme.

In summary, consideration of the Identity Assurance Principles allows the identification of which Principle is not being incorporated and assess the consequences of that lack of consideration.

In the No.2 Bill none of the Identity Assurance Principles have been considered, even though the Secretary of State has to produce something called a “DVS Trust Framework”.

It is difficult to see how such a Trust Framework that excludes these Principles, is indeed to be trusted.

Further detail on: https://amberhawk.typepad.com/amberhawk/2023/02/governments-digital-identity-proposals-ignore-obvious-privacy-concerns.html

 

Data Protection Courses (Summer 2023)

An all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill. Will be held on Thursday 13 July  2023 hopefully to include changes made during the Committee stage of the Bill.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection FOUNDATION Course is on Zoom only (June 20-22, 2023 (Tuesday to Thursday, 3 days: 45am to 5.00pm).
• The next Data Protection PRACTITIONER Course is in London on Monday, 24 July 2023 to Friday, 28 July 2023 (5 days: 9.30am to 5.30pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing [email protected].

Definition of “personal data” in DPDI No 2 Bill results in non-compliance with CoE Convention No.108

The press release associated with the DPDI No.2 Bill proudly states that the Bill ensures “that the new regime [is] built on the UK’s high standards for data protection and privacy”.

These new “high standards”, evidently, includes adopting a definition of “personal data” that fails to meet the data protection standards established by the text of the Council of Europe (CoE) Convention No. 108, as published in January 1981.

In other words, the most enduring international binding agreement on data protection is likely to be breached by the enactment of the No.2 Bill’s definition of personal data, some 42 years later.

Because this definition of personal data is deficient (see below), it follows all the substantive provisions (e.g. data subject’s rights, Principles, obligations) changed by the No.2 Bill also breach CoE No.108 requirements (as they are all couched in terms of this defective definition).

Additionally, as the No.2 Bill is at odds with CoE No.108, it follows that the No.2 Bill definition of personal data is also inconsistent with the GDPR (and perhaps has a knock-on impact with the Adequacy Agreement – not discussed here).

Note that meddling with the definition of personal data (in the way the No.2 Bill does) creates fundamental changes across ALL of the DP regime.  Quite simply, if the information is not personal data, then none of the UK_GDPR obligations apply.

Changes to “personal data” definition

The new definition of personal data distinguishes between two types of personal data depending on whether identification of a living individual is “direct” or “indirect” at “the time of the processing”.

With indirect identification, there is an additional “reasonable means” test to be passed before the information is treated as personal data (e.g. “the living individual is identifiable … by the controller or processor by reasonable means at the time of the processing”).

The two types of personal data, involving direct and indirect identification, mentioned above are:

• Direct “personal data” which relates to a living individual where, at the time of the processing, identification of the individual is by a controller or a processor without the use of any other information (e.g. the identification is directly contained in a database).

If you think about it, there is no need for a “reasonable means” test if there is direct identification of the data subject (as the identification information is sitting in the database!).

• Indirect “personal data” which relates to an identifiable living individual where the identification of the individual is by a controller or a processor but requires other information to be available to the controller or processor, using “reasonable means”, at the time of the processing.

In this case, the identification is indirect as other additional information is needed to complete any identification of a living individual (e.g. pseudonymisation of personal data creates an example of indirect identification).

By implication there are two types of information are not personal data.  These are:

• “not quite-personal data” which is my term for information which concerns a living individual but where identification of that individual at the time of the processing cannot be undertaken by a controller or by a processor without the expenditure of unreasonable effort to obtain the other additional information to complete the identification.
• anonymous data which is data or information that cannot be attributed to any specific living individual.

For anonymous data, the UK_GDPR recognises that because the living individual is not identifiable (i.e. attributable) in anyway, there are no obligations arising from the UK_GDPR, apart from the limited transparency requirements in Article 11.

The definitional change to personal data extends the “no obligations” approach of anonymous data to “not quite-personal data”.  This is made clear in the Explanatory Notes to the No.2 Bill  “the legislation does not apply to non-personal or anonymous data” (paragraph 101).  The important point here is that the Notes clearly separate anonymous data from non-personal data.

No examples of “non-personal data” (or not quite personal data to use my term for these data) are provided in the Explanatory Notes, nor in the Press Release mentioned above. This kind of omission is unforgivable; the public should not be left guessing what Government means here when its proposals put their privacy at risk.

Hence, my best guess for not quite-personal data is something like the following.  Imagine a set of pseudonymised personal data where the pseudonymising personal data linked to the identification details are removed from the set.

This leaves a set of attributes, each of which is derived from a specific living individual, but where that individual cannot be re-identified without, so the theory goes, the expenditure of unreasonable means. (But of course in my guess example, one can keep details to reverse this process quite easily).

Definition of “anonymous data”

The No.2 Bill definition of personal data overlooks the fact that Recital 26 of the GDPR explicitly contains a definition of  “anonymous information”  (e.g.  “information which does not relate to an identified or identifiable natural person”).

In further detail, Recital 26 states “The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information.”. (My emphasis to bring out the definition of anonymous information).

“Not quite personal data” could be equated with “anonymous data” if, for example, Recital 26 had stated something like: “This Regulation does not apply to data where identification of an individual is only possible by the expenditure of unreasonable effort on the part of the controller or processor at the time of the processing”.

But Recital 26 makes no such statement, so anonymous data and not quite personal data are different species of data (which, importantly, are also not personal data according to the No.2 Bill).

“Reasonable means”

Major problems arise from the definition of “reasonable means” as applied to the definition of personal data.

“Reasonable means” is defined as a non-exhaustive (illustrative) list which includes “among other things: (a) the time, effort and costs involved in identifying the individual by that means, and (b) the technology and other resources available to the person”.

Note that if an organisation (e.g. one that has few resources) assesses that there are no “reasonable means” are available to it, then that organisation can process that information as if it were not personal data (i.e. no UK_GDPR obligations such as transparency, security or rights etc).

However, at the same time, a well-resourced organisation (e.g. perhaps an organisation that has benefited immensely from the obvious Brexit dividends) can come to the opposite conclusion.

Thus a set of not quite personal data in the hands of one organisation could be personal data in the hands of another organisation as a controller or processor, both at the [same] time of the processing.

By contrast, at any particular time, anonymous data by the Recital’s definition remains anonymous irrespective of the nature of the organisation processing the data, because the data cannot be attributed to an identifiable living individual.

So if a “resources poor” organisation and a “resources rich” organisation used the same pool of “not quite personal data”, the latter is likely to be a controller processing personal data whilst the former would not.  This inconsistent position is extolled by the Explanatory Notes as “providing greater clarity” about the definition of personal data.

Also note that if an organisation gets its assessment of reasonable means wrong  (e.g. it assesses that the identification of living individuals needs unreasonable means), the default position is that the organisation is not a controller and the data are not personal data.  This is the position of greatest risk for data subjects because the data are not subject to the UK_GDPR.

This partly explains why the No.2 Bill’s ill-conceived meddling with the definition of personal data is likely to be detrimental to the interests of all data subjects.

The Bill's default position is not the privacy enhancing one (e.g. as espoused in data protection by design and by default); it’s the privacy busting one (e.g. as practiced by Facebook or Clearview AI Inc).

“At the time of the processing”

As already stated, indirect identification of the data subject for the No.2 Bill has to be at “the time of the processing” (e.g. “the living individual is identifiable … by the controller or processor by reasonable means at the time of the processing”).

Suppose personal data are processed at the time of the processing then a controller can inform the data subject of the intended future processing purposes of his/her personal data and the relevant A.6 lawful basis as required by A.13(1)(c) and A.14(1)(c) of the UK_GDPR.  So far, so good.

However, suppose at the time of the processing an organisation is processing not quite personal data.  Then there is no obligation at the time of the processing to be transparent to any data subject as the data are not personal data and the organisation is not a controller.  A.13 and A.14 only apply when actual personal data are processed (e.g. when indirect identification is completed).

So it can be now be seen that sets of not quite personal data can be legitimately processed without any data protection obligation (e.g. perhaps transferred to the USA, or possibly to Russia or China).

Suppose an organisation has obtained not quite personal data and transferred such data to the USA (for example) and re-identification occurs in the USA (perhaps via a number of other organisations dotted around the world to confuse any audit trail).

As such organisations are established well outside the jurisdiction of the UK_GDPR (or any EU version of the GDPR), then data subjects and regulators would be powerless with respect to such personal data once re-identification has occurred.

Such a loophole is only possible by changing the current definition of personal data so that it depends on the time of the processing (and in the case of indirect identification, the reasonable means needed to identify a living individual).

It is interesting to note that the definition of personal data in the GDPR does not contain these qualifications (e.g. “at the time of the processing”) so the definition in the No.2 Bill does not meet GDPR standards.

As stated above, the Government claims that there are “high standards for data protection and privacy”.  In practice, any consideration of the Bill’s new definition of personal data exposes that claim as highly suspect.

Identification by “controller or processor”

Now consider why the definition of personal data specifies that the identification of a living individual has to be  “by the controller or a processor”.  To explain this, consider the processor definition:  “the natural or legal person … which processes personal data on behalf of the controller”.

Note that to be a processor, an organisation has to process personal data (as defined in the No.2 Bill) on behalf of a controller.  Hence the organisation is not a processor when it processes not quite personal data.

It follows that for not quite personal data there are no contractual conditions, security or transfer obligations, no data breach procedures or reporting (even when the risk of re-identification could be potentially high) and minimal risk of effective sanction from the UK’s ICO (not even a Reprimand!).

So if an organisation based in the USA somehow obtains a copy of a set of not quite personal data and then re-identifies the data to become personal data, such an organisation becomes a controller outside the jurisdiction of the GDPR (the No.2 Bill negates the need for a Representative in the UK).

Quite simply, the words “by the controller or a processor”  appear in the definition of personal data is to ensure that not quite personal data can be shared with anybody without interference by the UK’s data protection regime.

Surprisingly, this is left unexplained in the Explanatory Notes that accompanies the No.2 Bill.

Comparison with CoE No 108

The text of the 1981 Council of Europe Convention 108 on data protection states in Article 2(a) that “personal data” means “any information relating to an identified or identifiable individual (“data subject”).   Article 3(1) requires “The Parties [e.g. UK Government) undertake to apply this convention to automated personal data files and automatic processing of personal data in the public and private sectors.”

I contend that the No.2 Bill’s definition of personal data is in clear breach of the text of CoE No. 108 as published in 1981; the same clear breach goes for the definition of personal data in the latest version of 2018 (CoE No. 108+).

This is because there is no concept of “direct” or “indirect” identification of individuals,  “reasonable means of identification” and “at the time of the processing” in the CoE’s definition of personal data.

It follows that the definition of personal data in the No.2 Bill does not meet the CoE requirements and that, if enacted, the UK will “fail to undertake to apply this convention to automated personal data files and automatic processing of personal data in the public and private sectors” (as all the substantive protection for data subjects is couched in terms of CoE’s definition of personal data).

Question: if the above happens, would you advise the transfer of personal data to the UK?

Concluding comment

CoE No. 108 was first published on 28 January 1981, a date now celebrated annually as Data Protection Day. The No.2 Bill, if enacted as described above, would make such celebrations unique for UK data protection people.

Instead of organising a party, they will organise a wake.

 

Data Protection Courses (Summer 2023)

An all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill. Will be held on Thursday 13 July  2023 hopefully to include changes made during the Committee stage of the Bill.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection PRACTITIONERCourse is in London on Monday, 22 May 2023 to Friday, 26 May 2023 (5 days: 9.30am to 5.30pm).
• The next Data Protection FOUNDATION Course is on Zoom only (June 20-22, 2023 (Tuesday to Thursday, 3 days: 45am to 5.00pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing [email protected].

New DPDI Bill savings inflated by 324%; loss of Adequacy Agreement would cost UK over £2 billion

Many commentators have remarked how very similar the Data Protection and Digital Information (DPDI) (No.2) Bill is to the original DPDI Bill published last June.  If this is the case, how is it that the No.2 Bill’s projected “Best Estimate” savings is £4.7 billion over a decade, whereas the “Best Estimate” savings for the original DPDI Bill (the “No.1 Bill”) is a mere £1.45 billion over a decade?

Given the fact that there is no official comparison document, explanation or Keeling Schedule to explain these differences, nobody knows.  I know inflation is high, but it is not running at 324%.

As an aside, the Impact Assessment Update also estimates the likely “annual export revenue loss” of the Adequacy Agreement with the EU (if it fails) as between £210 million and £378 million per year. Assessed over a decade (the standard unit of time preferred by the Update), that is between £2.10 billion and £3.78 billion.  In other words, if the changes in the No.2 Bill lead to a discontinuation of the Adequacy Agreement with the EU, about half the “Best Estimate” savings are lost.

Some readers might recall I did a deep delve into the savings associated with the No.1 Bill.  I have reworked these using the new financials reported by Government.

Hence this blog provides an alternative financial analysis, based on verifiable figures which are easy to obtain unlike the Mystic Meg approach adopted in the 230 page “Impact Assessment Update” published to justify the No.2 Bill (see references).

Real numbers used

I am using six additional facts which are missing from the “Impact Assessment Update”.

1. Fact 1: Companies House has over 4 million companies registered in the UK (from Companies House website).
2. Fact 2: The total number of controllers on the ICO’s public register is 1,066,929. The breakdown of registration is: Tier 1: 966,587 (90.6% of the register): Tier 2: 93,604 (8.8%);  and Tier 3: 6,738 (0.6%). (Information from the ICO on 12 May 2022).
3. Fact 3: Approximate registration revenue per year is: Tier 1: £33.8 million; Tier 2: £5.6 million; Tier 3: £19.5 million. The  total ICO revenue collected is £59.0 million per year which is calculated by multiplying the number of controllers in each Tier, by the annual notification fee  for each Tier (Tier 1 (£35); Tier 2 (£60); Tier 3 (£2,900)).
4. Fact 4: The Annual Report (2020/21) indicates the cost of running the ICO is £56.4 million.
5. Fact 5: There are 67.1 million data subjects resident in the UK as per July 2020 (ONS website).
6. Fact 6:  The “Impact Assessment Update” states the true net benefit is between £1.27 billion per decade and £8.53 billion with the “Best Estimate” in the middle at £4.7 billion.  Note that the “best estimate” of the No.1 Bill is more or less the “low estimate” of the No.2 Bill (hmmm – how convenient!).

So what kind of questions do Facts like the above this raise?  Three spring to mind immediately:

• From Facts 1 and 2, it can be seen that only 1 in 4 companies at Companies House is registered with the ICO. So could the ICO garner more in notification fees (e.g. by looking for active companies registered at Companies House but not registered with the ICO)? This improved revenue stream could help the ICO generate more resources to provide clear advice to controllers.  This would be better than changing the law to improve the clarity of the UK_GDPR as claimed by the Government (see para 2 of the Explanatory Notes to the No 2 Bill).
• From Facts 3 and 4, could any future surplus in notification fees be earmarked by the ICO to employ more staff to deal with complaints? This better than the proposal in the No.2 Bill to deal with the ICO’s complaints system by allowing the ICO to dismiss, or not investigate, complaints from data subjects (e.g. in Clause 40).
• Should the notification fee (fixed in 2018) be increased? For example, increasing the notification fee for Tier 2 to £100 and Tier 3 to £3,500 increases ICO resources by over £10 million. An increase in fee that adjusts for inflation since 2018 (about 20%) would do something similar.

It is well known that the ICO has a significant backlog of cases; the last Annual Report (2021/22) shows that 57% of cases often take over 6 months to resolve.  The three options above give the ICO more resources to clear that backlog.  However, increasing ICO resources fails to get a mention in the “Impact Assessment Update”.

Notification – who pays?

Fact 4 shows that notification to the ICO costs £0.6 billion per decade. So, abolishing notification fees would provide significant saving for all controllers; it would also a release a cohort of staff at the ICO to do things other than pen-pushing notification work (e.g. redeployed to reduce any backlog of complaints).  Evidently there are over 900 staff at the ICO!

It is well known that data protection is a balance between the interests of controller and of data subjects.  So why should controllers be faced with 100% of the costs of data protection compliance, when UK data subjects benefit directly from provisions in the UK_GDPR that protect them.  Surely, data subjects should contribute to the costs of data protection?

Historically, notification is a relic from the DPA1984. It was created at a time when most organisations did not have a main-frame computer and those that did have a computer, had only one.  Hence charging the minority of single computer owners (via notification fees) for the cost of regulation is understandable.

Now every citizen processes personal data as a controller (e.g. on social media) and is also a data subject.  So there are stronger arguments that the cost of data protection regulation should be drawn from general taxation with the ICO being a Parliamentary Officer like the Parliamentary Ombudsman (to maintain ICO independence).

Any consideration of the cost of notification or its abolition is missing from the “Impact Assessment Update”.

Savings? The real comparison

I am using the “Best Estimate” of £4.70 billion of savings over 10 years; this represents £470 million of savings per year over all controllers (£1 billion =£1,000 million).   As there are 1.07 million controllers (Fact 2), the average saving for each controller can be calculated at £439 per year per controller.  This is about £8.40 per week per controller; about the price of a bottle of plonk.

The conclusion one reaches is that such savings are insignificant.  Even a small business in Tier 1 (turnover up to £632K) is not going to get into financial difficulty because it does not save £8.40 per week.  The statement in the Press Release announcing the No.2 Bill (“new common-sense-led UK version of the EU’s GDPR will reduce costs and burdens for British businesses and charities”) is exposed to be palpably false and, dare I say it, “rubbish”.

So, suppose the UK_GDPR were unaltered; what would be the cost of maintaining the high level of GDPR protection for each data subject?  As there are 67.1 million data subjects in the UK (Fact 5), the savings of £470 million per year infer an cost of maintaining current UK_GDPR standards is £7.00 per year per data subject.  This equates to 13.5 pence per data subject per week, or just under 2p per day.

In other words, the Government are prepared to abandon the high level of UK_GDPR protection for all data subjects in order to save tuppence per day for each data subject. There is a well-known phrase “to spend a penny”; it appears the Government does not want to spend two.

Even if the £470 million yearly savings were all allocated to the 6,738 large controllers in Tier 3, the average annual saving is £69,753 per large controller.  This is an amount that would be unlikely to be identified in the balance sheet of a such controller as its revenues are in excess of £36 million per year.

The £69,753 figure is also below the cost of employing a DPO (which most large controllers are likely to employ, but not for much longer as the DPO role is being abolished as a savings measure).

Even if the £470 million were allocated to all the larger controllers in Tier 2 and Tier 3, the annual savings would be £4,683 per controller. There again pifflingly small for companies with turnover up to £36 million.  Even if all controllers were on the minimum turnover for Tier 2 (£632K), the savings represents 0.7% of turnover.  Again such comparison shows that the financial savings associated with the “burdensome paperwork” are negligible.

Remember all these numbers (e.g. 2p per day) are, according to the figures a best estimate; they could be much less.

Finally, suitably buried on page 218 of the “Impact Assessment Update”, are the annual costs that arise from the loss of trading with the European Union if the Adequacy Agreement is lost.  Over a decade, this loss is somewhere between £2.1 billion and £3.8 billion; the Update calculates that between 2817 and 9601 firms trading with the EU will also go bust.

Is the loss of Adequacy described in the Press Release or any relevant Ministerial statement about the No.2 Bill?  Of course not;  Brexit is a roaring success as we all know.

Concluding comments

Also missing from the “Impact Assessment Update” is any acknowledgement that large firms trading into Europe have to comply with the EU_GDPR as well as the No.2 Bill.  Such firms have to additionally appoint a Representative and adsorb the cost of EU_GDPR compliance.

Many private sector controllers in Tier 3 are likely to have to comply with twin data protection compliance regime (i.e. guesstimate around 4,000 controllers).

In summary, the press release headlined: “British Businesses to Save Billions Under New UK Version of GDPR” is pure spin.   Of course, that is the point of spin.  This headline figure in the Press Release has been parroted unthinkingly by the press and some DP observers (who really should know better).

However, it is a relief that the Secretary of State has not repeated her non-sensical claim made at the Party Conference last November that the UK_GDPR compliance cost 8% of company profits  - or £23 billion (see references).

In summary, it is difficult to avoid the conclusion that the figures presented in “Impact Assessment Update” and Press Release are of a quality best displayed on the side of a red Brexit bus (as driven by “honest” Boris Johnson).

Data Protection (Courses:Spring/Summer)

An all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill. Will be held on Thursday 18 May 2023.   The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection PRACTITIONER Course is in London on Monday, 22 May 2023 to Friday, 26 May 2023 (5 days: 9.30am to 5.30pm).
• The next Data Protection FOUNDATION Course is in London on June 20-22, 2023 (Tuesday to Thursday, 3 days: 45am to 5.00pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing [email protected].

References

DCMS fails to spend a penny to protect data subjects: https://amberhawk.typepad.com/amberhawk/2022/05/dcms-fails-to-spend-a-penny-to-protect-data-subjects.html   (old financial analysis of the DPDI No.1 Bill)

GDPR cost UK £23 billion says Minister in charge of data protection https://amberhawk.typepad.com/amberhawk/2022/11/gdpr-cost-uk-23-billion-says-minister-in-charge-of-data-protection.htm  (completely bonkers)

The Press Release associated with DPDI No.2 Bill: https://www.gov.uk/government/news/british-businesses-to-save-billions-under-new-uk-version-of-gdpr

DPDI Impact Assessment and other DPDI documents: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1140162/Data_Protection_and_Digital_Information_Bill_Impact_Assessment_-_June_2022.pdf

The DPDI No 2 Bill: https://bills.parliament.uk/bills/3430

DPDI No 2 Bill should be paused until the UK Bill of Rights position is resolved

The new Data Protection and Digital Information (No 2) Bill (“No.2 Bill”) has been published, minus any Keeling Schedule, and minus any indication of how the new Bill has diverged from the old.  The Department for Science, Innovation & Technology (DSIT) has this information to hand; its failure to publish it performs an unnecessary public disservice.

The press release accompanying the No.2 Bill says the legislation has been “Co-designed with business from the start, this new Bill ensures that a vitally important data protection regime is tailored to the UK’s own needs and our customs”.  It does not take an expert to guess that the No.2 Bill is likely to contain provisions tailored to diminish the protection for data subjects.

What about human rights (again)?

However, the first matter is that should be raised is a matter of procedure.  The No.2 Bill should not proceed to any further Parliamentary stage because the UK’s Bill of Rights is still awaiting its Second Reading.

The problem arises because the UK Bill of Rights is likely to have fundamental impact on the UK’s data protection regime (evidence from the ICO – see references) so much so, it is likely undermine completely any Parliamentary consideration of the data protection aspects of the No.2 Bill.

Quite simply, it is a waste of valuable Parliamentary time to consider this No.2 Bill, if the Bill of Rights devastates the data protection landscape to the extent that any Ministerial statement concerning data protection made during No.2 Bill debates (e.g. in relation to the principles or lawful basis) is rendered worthless.

Although the No. 2 Bill is accompanied with a Human Rights Memorandum,  this document is also wholly irrelevant.  It assumes the UK will follow Strasbourg Jurisprudence (e.g. it even quotes from several European cases and explains that voluntary data sharing by public bodies would fall within the UK’s “margin of appreciation”).  In addition, there is a statement on the face of the No.2 Bill saying it is ECHR compliant.

In other words, the No.2 Bill gives the impression that the UK follows the ECHR, when DSIT/Government knows that this is completely misleading if the UK Bill of Rights commences its Second Reading.

This can be seen from the Bill of Rights itself.  In clause 1(2) it says “that it is the Supreme Court (and not the European Court of Human Rights) that determines the meaning and effect of Convention rights for the purposes of domestic law”.  Clause 1(3) states “judgments, decisions and interim measures of the European Court of Human Rights (a) are not part of domestic law…..”. In other words,  the basic assumption towards human rights compliance is the complete opposite to that promulgated by the No.2 Bill.

Further evidence for the negation of human rights arises from the aptly named “Illegal Immigration Bill” (IIB);  this explicitly raises the idea that the UK will not follow ECHR.  Indeed, many human rights commentators have suggested that the IIB creates a vast smorgasbord of ECHR non-compliance.  This includes breach of: the right to life;  freedom from torture and from slavery;  the right to a fair trial and the risk of detention without trial;  the lack of respect for family and private life;  the prospect of discrimination, and finally removal of the right to seek a legal remedy.

As an aside, the IIB sets a dangerous precedent in that it is an example of Government enacting legislation that it knows is likely to breach the ECHR.  Just imagine data sharing legislation being enacted (via a large majority Government that has a minority of the popular vote) that included something like: "The minister unable to confirm the data sharing law is compatible with A.8".

In addition, the UK’s  Adequacy Agreement with the European Commission mentions compliance with ECHR judgements and refers to the Human Rights Act over 80 times.  There is no point Ministers saying the Adequacy Agreement “is safe with the No.2 Bill”, if the risk of trashing it arises from the implementation of the UK Bill of Rights.

Finally, look at the Transfer Risk Assessment published by the ICO, in particular Q4 which deals with a human rights assessment.  The expected bonfire of human rights, consequent on the passage of the IIB, would probably mean, using the ICO’s own risk assessment methodology, that the UK would become a dodgy, no-go area for certain transfers from the EU.

The Bill of Rights subjugates the No.2 Bill

The UK Bill of Rights fundamentally changes the interpretation of the word “necessary” which is integral to the application of: any lawful basis (A.6 of the UK_GDPR); the Data Protection Principles (A.5); the Special Category of Personal Data conditions (A.9); the processing of Criminal Offence personal data (A.10); the understanding of Schedule 1 (DPA2018);  the exemptions from rights (A.23), and finally, transfers outside the UK (A.49).

This is confirmed by the ICO’s evidence to the MoJ (see references). For instance, the ICO writes:

• “Changes in how the concepts of necessity and the public interest are assessed in human rights law will inevitably have an knock on effect on their assessment in data protection  law”.
• “The concept of necessity is fundamental across the DPA/UK_GDPR (Article 5 principles, Article 6 lawful bases, Article 9 conditions for processing special category data, Article 23 exemptions, and Schedule 1)”.
• “…likely impact could make it more difficult for the ICO to protect individuals data” (e.g. “if public authorities are be able to rely on public interest grounds in a presumptive way”: (para 3.27).

The human rights challenges arising from the No.2 Bill as explained in the Memorandum are a mere pinprick compared with the privacy wasteland promised by the UK Bill of Rights.

Concluding comment

In short, Parliament needs protecting from a Government that presents one Bill for detailed consideration, when it knows that these considerations are made redundant by other legislation, also before the Parliament at the same time (in this case, the UK Bill of Rights).

An honest Government would progress, or ditch, the UK Bill of Rights first, and then second, move on to the No.2 Bill so the data protection changes can be properly debated.

Data Protection Courses (Spring 2023)

Because of the uncertainty (e.g. transport, strikes etc), the following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection PRACTITIONER Course is in London on Monday, 22 May 2023 to Friday, 26 May 2023 (5 days: 9.30am to 5.30pm).
• The next Data Protection FOUNDATION Course is in London on June 21-23, 2023 (3 days: Wednesday to Friday 9.45am to 5.00pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing info AT amberhawk.com.

References

The ICO’s evidence re the Bill of Rights is summarised/accessible from my blog at:  https://amberhawk.typepad.com/amberhawk/2022/05/ico-confirms-human-rights-changes-undermine-uk_gdpr.html

Blog post: UK Bill of Rights set to undermine UK_GDPR : https://amberhawk.typepad.com/amberhawk/2022/07/uk-bill-of-rights-set-to-undermine-uk_gdpr-and-adequacy.html

Press release and Human Rights commentary is accessible at https://www.gov.uk/government/news/british-businesses-to-save-billions-under-new-uk-version-of-gdpr

Bill of Rights: https://bills.parliament.uk/bills/3227

Government’s digital identity proposals ignore obvious privacy concerns

There is an adage (disputed by Transport for London) that if one waits at a bus-stop for more than half an hour, three or four buses will then turn up, almost in a convoy.  Curiously, this adage appears to apply to the management of digital identity.

There are four recent proposals recent proposals relating to ID which have overlapped. They are:

• the parts of the legislation in the dormant Data Protection and Digital Information (DPDI) Bill that relates to digital information. These parts take the form of a paving Bill where many of the details of how digital identity works in practice is reserved for Ministerial powers.  It is focused on enabling digital identity use in the wider economy.
• Proposed legislation based on the public consultation on “Consultation on draft legislation to support identity verification” which the Government intends to enact by Statutory Instrument (again leaving important detail to Ministers). These proposals are a pre-cursor to a digital identity scheme operating in the public sector and aims to facilitate data sharing within the public sector and thereby establish such a digital identity scheme.
• The proposals from Tony Blair’s Institute for Global Change, co-authored by Lord William Hague (ex leader of the Conservative Party), which require a “single digital-ID system for all residents” (which by implication is a compulsory digital ID scheme).
• The ID requirements for voting in elections. Conspiracy theorists will no doubt claim that these “No specified ID – No Vote” provisions  “soften-up” the public for general acceptance of the idea of presenting some form of ID when dealing with public authorities.

This blog is limited to the public consultation on proposals to support data sharing for the purpose of digital identity verification as specified in the second bullet.

Summary of the problems

The problems with the Consultation’s proposals are as follows:

• There is no detailed information on the protection afforded to data subjects (other than the UK_GDPR provisions). In practice, although data sharing is voluntary and transparent to the data subject, there is no way of returning a data subject to the position prior to that data sharing, should the data subject wish this. The data subject thus loses control of what is supposed to be in that subject’s interests.
• Data sharing is likely to include unexplained and unspecified items of special category of personal data.
• There is no reference the Government’s promised changes to the data protection and human rights legislation (e.g. the DPDI Bill). The Consultation’s assumptions on the level of protection afforded to data subjects by the UK_GDPR are likely to be incorrect.
• There is no reference to the risks associated with data sharing (and the potential to resurrect the equivalent of the National Identity Register which was at the centre of the Identity Card Act 2005).
• There is no reference to Nine Identity Assurance Principles which were officially published to guide Government on a privacy friendly approach to the introduction of a digital identity scheme.

In summary, the Consultation has too much missing for it to be treated as a reliable representation of what is being proposed.

Identity Assurance Principles

As background, I refer to the “Nine Identity Assurance Principles” that were published in 2015 for inclusion in any Governmental future digital identity project (see references).  The objective was to avoid a repeat of the ID Card debacle a decade earlier; the Government asked a number of privacy experts (including the ICO and yours truly) to debate and draft a set of objectives.

As a result, these Principles emerged to provide a benchmark for all digital identity schemes. It allows one to identify which Principle is not being considered and the consequences of that lack of consideration.  In this Consultation, none of the Principles have been considered.

In summary, these Principles are:

• The User Control Principle (Identity assurance activities can only take place if the data subject consents or approves them).
• The Transparency Principle (Identity assurance can only take place in ways a fully informed data subject understands).
• The Multiplicity Principle (The data subject can use and choose as many different identifiers or identity providers).
• The Data Minimisation Principle (Any request from the data subject or identity assurance transaction only uses the minimum personal data that is necessary).
• The Data Quality Principle (The data subject chooses when to update their records).
• The Service-User Access and Portability Principle (The data subject is provided a copy of all personal data on request and can move/remove their personal data on request).
• The Governance/Certification Principle (There is public confidence in any Identity Assurance System because all the participants have to be accredited).
• The Problem Resolution Principle (If there is a problem there is an independent arbiter who can find a solution).
• The Exceptional Circumstances Principle (Any exception to the above Principles has to be approved by Parliament in new legislation to ensure the law is subject to scrutiny in the context of the operation of a digital identity scheme).

Note that together, these Principles set out the circumstances which maintain public confidence in any digital identity proposal.   Such confidence is achieved by placing the data subject in control and at the centre of any processing of their digital identity details.

Although the Principles are ignored with the current Consultation,  some Principles partially arise as a result of the implementation of the UK_GDPR  (e.g. data minimisation, limited transparency).  Other omissions, however, raise matters of concern. For example, there is only to be one identity available, contrary to the Multiplicity Principle.

In addition, an individual whose identity has been established is not fully in control of when public authorities reveal their identity details.   This is because any associated identity database held by a public authority falls foul of the  Exceptional Circumstances Principle  and access to digital identity information could be lawful, when that law allowing access did not have any Parliamentary scrutiny or consideration of its impact on a digital identity scheme.

Attributes for a National Identity Database?

The Consultation states that “Public authorities will process the minimum number of data items, known as attributes, necessary for verifying the identity of an individual”. Remember these data items are then potentially available to any other public body involved within the proposed data sharing scheme, or accessible via any other legislation that allows access to these identity attributes.

Examples of attributes include: “user’s full name; date of birth; home address; email address; photographic images; various identifiers such as passport number or driving licence number; attributes held by government departments necessary for verifying the identity of an individual; the outcome of identity checks previously performed on a user; and transactional data, for example, income”.

It is not obvious to me that “income” and “email address” are attributes that identify an individual.

The Consultation also adds that “other data items may be processed as identity verification services develop. This may include special category data….”.  Obvious examples of special category of personal data, used in the context of identity includes facial recognition, fingerprints and DNA profiles. So are these going to be used?

Sadly, the Consultation dumbs down on the detail here,  when in practice it should have been crystal clear what is intended with the processing of special category of personal data in the context of digital identity. This resultant lack of clarity raises more questions than answers (and is likely to engender mistrust of the proposals themselves).

Finally, just imagine if these personal data items held by each public authority for establishing a digital identity scheme were collated in one database;  this would essentially replicate the National Identity Register (NIR) specified in the ID Card Bill of 2005 (and resurrect all the horrendous privacy issues discussed two decades ago).

The only difference with the Consultation? Each public body now has its own database which it can share with other public bodies.  In effect this is a proposal for new NIR, distributed across participating public bodies.

Data subjects are unprotected

So what protects the data subject? According to the Consultation, protection arises from the fact that data sharing occurs subject to the UK_GDPR (e.g. the data sharing code) and other data ethics guidance.

In practice, the data subject is not in control. There is no way that the data subject, having agreed to data sharing, can recover to the position which applied prior to that data sharing; this is contrary to the Service-User Access and Portability Principle.

Although the data subject is fully informed, there is little the data subject can do with that information because:

• withdrawing consent to the data sharing does not work. Consent is irrelevant as any data sharing is justified in terms of the public task of participating public bodies.
• the right of erasure does not apply as the processing is made lawful by being part of the public task of participating public bodies.
• the right to object to the processing is going to be very difficult as the data subject has to demonstrate grounds in relation to his position and these grounds are likely to contested.

What about DPDI or Human Rights changes?

The Consultation ignores the potential impact of the Government’s proposed changes to the data protection and human rights regimes.

For example, in an earlier blog, I showed that the DPDI Bill allowed HMRC to lawfully obtain personal data for its purposes via voluntary disclosure from any controller even when there is no “public interest” component to a particular disclosure of personal data to HMRC (see references).

Indeed a particular disclosure did not need to be associated with any specific HMRC investigation (i.e. a failure to disclose does not prejudice HMRC’s collection or assessment of tax).   HMRC is specified in the Consultation as a participant in data sharing (but one suspects that data sharing occurs only in one direction).

With respect to Human Rights changes, I raised the issue that the British Bill of Rights changes who interprets the meaning of necessity, public interest and proportionality and thereby changes the nature of the link between the UK_GDPR and A.8 of the European Convention of Human Rights (right of respect for private and family life etc).

In general, the Bill of Rights changes the ultimate arbiter of what data sharing is “proportionate”, “necessary” or  “in the public interest”.  These terms are to be specified by Ministers; so if Ministers says certain data sharing with HMRC is “necessary”, then it is necessary and almost impossible to challenge (see references).

For clarity, I am not picking on HMRC.  I am using HMRC to show that the proposed changes in data protection and human rights law fundamentally alters the data protection analysis presented to the public by this Consultation.

Concluding comment

I am convinced the Consultation has little to do with protecting the data subject; it is designed to assist data sharing between public bodies at their convenience.  The omissions in the Consultation  means that it should be reworked, with the Nine Identity Assurance Principles at their heart.

Data Protection Courses (Early Spring 2023)

Because of the uncertainty (e.g. transport, strikes etc), the following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection PRACTITIONER Course is in London on Monday, 27 March 2023 to Friday, 31 March 2023 (5 days: 9.30am to 5.30pm).
• The next Data Protection FOUNDATION Course is in London on Tuesday April 18-20, 2023 (3 days: 30am to 5.30pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing info AT amberhawk.com.

References

Consultation on draft legislation to support identity verification . https://www.gov.uk/government/consultations/draft-legislation-to-help-more-people-prove-their-identity-online/consultation-on-draft-legislation-to-support-identity-verification

Tony Blair’s Institute report which suggests for digital ID for everyone as a consequence of a push for growth:  https://institute.global/policy/new-national-purpose-innovation-can-power-future-britain

The Nine Identity Assurance Principles: https://www.gov.uk/government/publications/govuk-verify-identity-assurance-principles/identity-assurance-principles

Blog post: Voluntary disclosure to HMRC? Always lawful and always compatible: https://amberhawk.typepad.com/amberhawk/2022/08/voluntary-disclosure-to-hmrc-always-lawful-and-always-compatible.htm

Blog post: UK Bill of Rights set to undermine UK_GDPR : https://amberhawk.typepad.com/amberhawk/2022/07/uk-bill-of-rights-set-to-undermine-uk_gdpr-and-adequacy.html

GDPR cost UK £23 billion says Minister in charge of data protection

Three important facts have survived the political psycho-drama of the last two months.

• Despite approaching austerity, the Government remains committed to the removal or modification of all EU Regulations such as the GDPR by the end of 2023.
• The re-appointment of Suella Braverman (Home Office) and Dominic Raab (Ministry of Justice) increases the risks to the UK’s Adequacy Agreement, courtesy of these Ministers’ desire to fundamentally alter the Human Rights Act.
• Michelle Donelan returns to the DCMS as data protection supremo; she made the £23 billion costs-claim during her speech to the Conservative Party faithful (on October 3^rd, see references).

The omens are that the Data Protection and Digital Information (DPDI) Bill will be further modified. During her conference speech, Ms. Donelan told delegates:

“Our new data protection plan [i.e. other than the plan in the DPDI Bill] will focus on growth and common sense, helping to prevent losses from cyber-attacks and data breaches, while protecting data privacy. This will allow us to reduce the needless regulations and business-stifling elements, while taking the best bits from others around the world to form a truly bespoke, British system of data protection”.

Warming to her theme, Ms Donelan added: “We inherited GDPR from the EU, and its bureaucratic nature is still limiting the potential of our businesses. So much so that researchers at Oxford University estimated that it has directly caused businesses to lose over 8% of their profits” (my emphasis).

There are two comments to make:

• Wow!! Over 8% of profits! How much did that cost the economy?  Donelan failed to give the number;  this blog does.
• Donelan has ditched the previous Secretary of State’s inflated claims that the DPDI Bill saved over £1 billion.

In relation to that 8% claim, for companies registered in the UK, all profits are currently subject to 19% corporation tax;  the HMRC website states that for each of the last four years, corporation tax has raised about £55 billion approximately for the Treasury (see references).

It follows that if £55 billion equates to 19%,   the total taxable profits subject to corporation tax (i.e. the 100% of profits) is about £290 billion and the loss of “over 8% of profits” is a loss of over £23 billion.  Hence the headline.

So, the Secretary of State wants us to believe that not implementing the UK_GDPR would have reduced the self-inflicted, Trussian, £40-£50 billion black hole in the UK economy by about half.

It does not take a genius to realise the 8% is an error – yet Ms. Donelan used it as if it were correct.

The Oxford research

The research is the first attempt to calculate the impact on firms’ profitability arising as a result of the implementation of the GDPR; this is a very valid objective.  This objective is completely different to the publication of (bogus) DCMS numbers to justify the savings (about £1.5 billion over a decade) made by the Government’s implementation of the DPDI Bill (see references for my blog post on this false accounting).

To be fair to the Oxford research, it is a “Working Paper” (see references for URL); the research is not a finalised, peer reviewed, academic article.  This alone is reason enough to say that the Secretary of State was very premature to quote a headline result from this Paper  (the 8% loss of profits) without explaining its preliminary status.

One suspects, however, that more selective quotations will emanate from the Secretary of State about this research; hence the reason for this blog.

If this happens, the real problem is not the research (which is discussed below), it is the provenance of the research – Oxford University (see references for URL).  Quite simply, the University’s prestige risks being used to cloak Ms. Donelan’s data protection changes with an aurora of respectability.

Research methodology

In summary, the research methodology looked at 3 million balance sheets, predominantly of companies with more than 500 employees, from 2011 to 2017;  these have been collated by the OECD across 62 countries. This is compared with a second grouping containing the OECD balance sheets for the same companies from 2018 to 2020.  The GDPR was agreed in 2016 and became law in 2018.

As the balance sheets contain information relating to sales, profits and employment, the basic idea is that any significant divergence in profitability from year to year (like an economic shock to the system) can be put down to the costs of implementing the GDPR if, as the researchers claim,  other significant effects/shocks such as COVID can be excluded (e.g. by an extensive data cleaning process).

Because the raw data include sales, the research estimates that the GDPR implementation has also reduced sales by 2%.

However, the important point is this: the approach calculates the financial impact of the GDPR directly from these balance sheets.  There is no data protection input into the econometrics – only the assumptions underpinning the econometrics.

Questions: three assumptions

The research assumes the major difference between the two sets of balance sheets from OECD countries (i.e. from 2011-2017 and from 2018-2020) arises from the implementation of the GDPR.  This assumption is unreliable.

As is well known, many OECD countries have data protection laws with standards that approximate to the GDPR standards.  For example, compliance with Principles (e.g. security, accuracy, transparency) and the data subjects’ rights (e.g. of correction, erasure or access) often form important parts of national legislation based on OECD’s data protection guidelines (e.g. in New Zealand, Australia).  This has been the case since 1980 when the OECD Guidelines were first published.

Therefore, to lay 100% of these costs (e.g. of dealing with security, data subject rights or auditing compliance etc) at the feet of the GDPR, when they also arise in legislation based on OECD Guidelines,  is likely to over emphasise the GDPR implementation costs.

The second assumption relates to the APEC Privacy Framework; these APEC privacy rules follow the OECD Guidelines and were published 2015, and their implementation in the Asian-Pacific region would be at the same time as the GDPR (published in 2016).  As the research makes no reference to APEC, what could have been measured by the research is APEC plus GDPR implementation costs together.

The third assumption is that OECD companies have not implemented the GDPR until it came into effect in 2018.  However, large OECD companies often establish in the European Union; this means they would be required to meet the GDPR obligations (or even perhaps obligations under the earlier data protection Directive 95/46/EC) at a much earlier stage.

One suspects, therefore, the size of the second cohort of balance sheets used in the research to identify divergences is too short a range.  It should also have considered APEC implementation costs.  If these two statements are correct, their combined effect would be to over-emphasise the headline GDPR costs on firms – hence the 8% is an over-estimate of the GDPR costs alone.

Questions: USA high tech companies

The researchers report that USA high tech companies experience no variation in profit or sales as a result of the implementation of the GDPR.

A likely explanation of this is because many of them (e.g. Google, Facebook) are established in Eire and were required to implement the GDPR much earlier.  Indeed,  because of the controversial Google Spain judgement in 2012, processing by Google in the USA was considered by the CJEU to be processing subject to the Data Protection Directive 95/46/EC.

In other words, this zero result recorded in the research could well be as a result that the cost of data protection compliance for USA high tech companies commenced from 2012 (and not in 2018 as assumed by most of the research).

As an aside, a “small” company as defined in the research has less than 500 staff (i.e. twice the size of the European Commission’s definition for a Small to Medium sized Enterprise).  I suspect this point has been missed by Ms. Donelan, whose speech quoted above referred to a small business as one employing a handful of staff.

Questions: GDPR assumptions

Similarly, there is unsatisfactory commentary to explain the 8% figure in terms of GDPR implementation costs.  For example, OECD firms trading with data subjects in the EU have “to appoint a DPO to oversee data management activities” or “are required to encrypt and anonymise any personal data it stores”.

This explanation is incomplete. DPOs are needed by firms but only when their processing presents high risks to data subjects (which is not the case for all firms).  Encryption and anonymisations are not mandatory requirements; they need to be considered for implementation if their use would be both technologically appropriate and cost-effective.

Data breach reporting, picked out in the research, is a common feature of international data protection law, and is not unique to the GDPR.

Questions: consent

Also, the research places 2% of the loss of sales down to GDPR “consent” procedures (e.g. with respect to data sharing and third party marketing),  thus overlooking the data protection implications of this conclusion.

As is well known, “consent” in Directive 95/46/EC was much degraded to such an extent that practices, employed by Cambridge Analytica (and in the UK Referendum) emerged.  This created a scandal that still threatens to undermine or polarise the democratic process.

In the DPDI Bill, Ms Donelan is bent on replacing “data subject consent”  (e.g. where the individual can control marketing and research options) and replacing it with “legitimate interests of the controller” (where the controller is in charge). She has yet to describe how these changes will protect individual privacy from the pervasive internet surveillance practices, which will increasingly depend on “legitimate interest”.

Concluding comment

In her speech to Conservative Conference, Ms Donelan concluded: “I am an evidence-based politician and over the coming months you will see that I am not afraid to make tough decisions”.

By relying on these preliminary research results,  it appears that Ms. Donelan’s evidence for data protection change is of a kind displayed on the side of that red Brexit bus.

Data Protection Courses (Winter 2023)

I am holding a day workshop on the changes arising from the Data Protection and Digital Information Bill on Thursday, January 12^th, 2023 (by Zoom only).  The fee is £250 + VAT per delegate.  Program available from:  info AT amberhawk.com

Because of continued uncertainty (e.g. weather, transport, COVID), the following BCS Partitioner courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance) just in case “stuff happens on the day”.

• The next Data Protection PRACTITIONER Course is in London on Monday 30th January 2023 - 3rd February 2023 (5 days: 9.30am to 5.30pm).
• The next Data Protection FOUNDATION Course is in London on Tuesday February 7-9, 2023 (3 days: 30am to 5.30pm).

Full details (as we are upgrading our Amberhawk website), details of all the above courses can be obtained by emailing info AT amberhawk.com

References

Ms.Donelan’s speech: https://www.conservatives.com/news/2022/our-plan-for-digital-infrastructure--culture--media-and-sport

The Oxford University research: https://www.oxfordmartin.ox.ac.uk/publications/privacy-regulation-and-firm-performance-estimating-the-gdpr-effect-globally/

Government savings from the DPDI Bill: see DCMS fails to spend a penny to protect data subjects on https://amberhawk.typepad.com/amberhawk/2022/05/dcms-fails-to-spend-a-penny-to-protect-data-subjects.html

Google Spain CJEU Case C 131/12.  The important point is that processing by Google USA became subject to Data Protection Directive 95/46/EC in 2012; costs of implementation of data protection can be assumed to start from that date and not from 2018 as the Oxford research assumes.  Hence the zero result reported by the research.

Corporation tax receipts average about £55 billion over the last 4 years: see https://www.gov.uk/government/statistics/corporation-tax-statistics-2022/corporation-tax-statistics-commentary-2022