Hawktalk

Facial recognition CCTV excluded from new data protection law by definition of “personal data”

I have come to the conclusion that the new definition of personal data in the Data Protection and Digital Information No.2 Bill (“No.2 Bill”) only applies to facial recognition CCTV if the data subject is on a watch-list.

If the individual is not on a watch-list, and the camera images are deleted immediately after checking the watch-list, then personal data are not processed and there are no data protection obligations (e.g. no transparency)

It then follows that if the watch-list, for example, involves details of criminals wanted by the police, many facial recognition systems will process personal data in total secrecy (i.e. no transparency).

This blog explains how the No.2 Bill’s definition of personal data moves such facial recognition CCTV systems into the twilight zone.

Suppose a facial recognition CCTV system is linked to a watch-list of suspects whose facial features have already been digitised (perhaps using the digitised biometric images derived from passport photographs).

Obvious examples of such watch-lists are: (a) a list of those who are of interest for law enforcement purposes or (b) those who commit a crime if they enter a specific area (e.g. those who have been excluded from entering a specific shop).

Suppose further, such a CCTV system is set up in a shopping centre and performs facial recognition on everybody who passes any of the system’s cameras.  The system sends a warning message to the camera operator if someone, on the watch-list, passes the camera; the system also retains the relevant images and other details of the encounter.  Only personal data of those on the watch list are retained.

The system is so designed that the details of those who are NOT on the watch list are not retained (i.e. deleted instantaneously) after the check against the watch-list is complete.

Bridges v South Wales Police

The system described above is the one that featured in the Court of Appeal judgement (Bridges v South Wales Police: paragraph 9, see references).  In this case, the data protection regime (in the DPA1998 and the pre-Brexit GDPR/DPA2018) was fully engaged because the Court determined that “personal data” were being processed about every individual whose image was captured by a Facial Recognition CCTV camera.

In the Bridges case, the Court’s interpretation of the definition of personal data was crucial.  This was derived by reference to Recital 26 of the pre-Brexit GDPR (or to Recital 26 of Directive 95/46/EC when the DPA1998 applied). These Recitals specified that if the information processed related to a living individual who was being singled out, then “personal data” were being processed.

Paragraph 46 of the Bridges judgment makes this point clear.  It states:

46. The primary point of dispute before the Divisional Court under the DPA 1998 was the extent to which using AFR Locate [the name used for the Facial Recognition CCTV system] entails processing personal data, SWP [South Wales Police] contending that the only personal data processed is the data of persons on the watchlist on the ground that it is only those persons that SWP can identify by name.

Having referred to the judgment of the Court of Appeal in Vidal-Hall v Google Inc [2015] EWCA Civ 311, [2016] QB 1003, and to the decision of the CJEU in Case C-212/13 Rynes v Urad [2015] 1 WLR 2607, the Divisional Court concluded (at [122]) that the processing of the Appellant’s image by the AFR Locate equipment was processing his personal data because the information recorded by AFR Locate individuated him from all others, that is to say it singled him out and distinguished him from all others.  (My emphasis).

As we shall see, “singling out” is NOT found in the new statutory definition of “personal data” in the No.2 Bill, and it is this omission that has significant consequences (i.e. SWP’s arguments in the first part of paragraph 46 as quoted above become correct).

Recitals are not law

The definition of personal data in the No.2 Bill is at first sight unchanged: “Personal data” means any information relating to an identified or identifiable living individual.  However, the No.2 Bill introduces the concept of direct or indirect identification of the individual into the statutory definition.

This new statutory definition, which also does not meet the standard of the Council of Europe Convention No 108 set in 1981 (see references), makes sure that the interpretation in Recital 26, as used in Bridges), is largely redundant.

This is because the Recitals themselves have no legal effect in the UK.  This was established in the case of Sanso Rondon v LexisNexis (see references), when the Court invalidated a requirement in Recital 80 (namely “the designated representative [of a controller or processor established outside the UK (or EU)] should be subject to enforcement proceedings in the event of non-compliance by the controller or processor”).

The Court came to this conclusion because the requirement was found only in Recital 80 and was not explicitly linked in any obligation in any Article of the GDPR.  That is why the Court concluded that, in relation to the liability of the representative for non-compliance (e.g. by a controller):

“…if the GDPR had intended to achieve 'representative liability' [for non-compliance as specified in Recital 80] then it would necessarily have said so more clearly in its operative provisions [i.e. the Articles of the GDPR]…(paragraph 101).

In other words, the Recitals are there to help interpret the legislation if there is doubt as to what the statutory requirements in an Article mean.  If a provision described in a Recital is not echoed in a relevant Article, then the interpretation in the Recital can be invalid.

In summary, the requirement for “singling out”, although it remains in Recital 26, it is not supported by any “operative provisions” found in the new statutory definition of “personal data”.  To the contrary, the new “operative provisions” of the definition work to exclude any prospect for “singling out”.

DPDI definition of “personal data”

The No.2 Bill additionally requires that to be “personal data”, there has to be a living individual who is directly or indirectly identifiable; in the latter case, indirect identification has to be at the time of the processing and by using reasonable means.

This raises three additional questions to be answered before the processing of “personal data” by a CCTV system, similar to that under discussion, can be confirmed.

The first question is:  ‘Are individuals identified “directly”?’.  The No 2 Bill requires that “An individual is identifiable from information “directly” if the individual can be identified without the use of additional information”.

Clearly, in the case of facial recognition CCTV, the answer is NO.  This is because additional information has to be used to perform the identification of those images captured by a facial recognition CCTV system (e.g. the pre-recorded details of those on the watch-list).

In other words,  direct identification, is not relevant because identification of a living individual (on or off the watch list) requires "the use of additional information" (contrary to the definition of direct identification).

The next question is: ‘Are individuals identified “indirectly” as defined?’.  The No.2 Bill states that “An individual is identifiable from information “indirectly” if the individual can be identified only with the use of additional information”.

Clearly, the answer is YES as additional information is available as part of the CCTV system to identify those individuals on the watch-list.

But what about those NOT on the watch-list?

This question is answered by the third question in the series: “Is indirect identification easy to do “at the time of the processing” and by “using reasonable means”  (Clause 3A(2) requires “the living individual is identifiable .… by the controller or processor by reasonable means at the time of the processing”).

In this case, for those not on the watch-list, there are no reasonable means of achieving identification available at the time of the processing (e.g. from the time of collection by a camera, checking the watch list, and then its instantaneous deletion).

There are three main reasons for this conclusion:

• first, there is no “additional information” that is available by “reasonable means… at the time of the processing” in the CCTV system itself (or held by some other person);
• second, the image of the individual and related biometrics have been deleted almost instantaneously, so there is no need for additional information to perform the unwanted indirect identification;
• finally it would be unreasonable to ensure the Facial Recognition system retained details of individuals not on the watch-list. The far more reasonable proposition is to protect the interests of such individuals is by deleting their personal details instantaneously, as such deletion guarantees their privacy.  In addition,  the captured details cannot be further processed for purposes other than the original check of “is this individual on the watch-list?”.

In addition, Article 11 of the UK_GDPR specifically states that additional information is not required to be collected.  It says:

A.11(1) “If the purposes for which a controller processes personal data do not … require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation. (My emphasis to show that this is the case when an individual is not on the watch-list).

Hence, there are no data protection obligations placed on those data that concern those whose images are collected and then instantaneously deleted because the individual is  NOT on the watch list.  Quite simply, such a CCTV system does not process personal data (as newly defined) in these circumstances.

The data protection regime of the No.2 Bill only applies to those on the watch list.

Why secret CCTV facial recognition systems?

As a facial recognition system is not processing personal data if an individual is NOT on the watch list,  then there is no need to be transparent as the UK_GDPR does not apply.  There is no need for a lawful basis nor a condition to overcome the processing of Special Category of Personal Data as the information processed is not personal data.

Transparency is only needed for data subjects on a watch list.  However,  there are a number of exemptions in the DPA2018 that provide the controller relief from the need to be transparent if being transparent would prejudice the crime, taxation, immigration or law enforcement purposes etc (e.g. Schedule 2, paragraphs 2 or 4; Section 44 of the DPA2018).  Hence there is no need to be transparent in these cases also.

It follows that many facial recognition CCTV systems can be installed without any transparency obligations and used more or less in secret.  As stated at the beginning of the blog, they enter the data protection twilight zone.

As this is the case, expect the number of Facial Recognition systems to mushroom exponentially after the enactment of the No 2 Bill.

References

Edward Bridges and -the Chief Constable of South Wales Police: Neutral Citation Number: [2020] EWCA Civ 1058

Sanso Rondon v LexisNexis; Neutral Citation Number: [2021] EWHC 1427 (QB)

Definition of “personal data” in DPDI No 2 Bill results in non-compliance with CoE Convention No.108: https://amberhawk.typepad.com/amberhawk/2023/04/definition-of-personal-data-in-dpdi-no-2-bill-results-in-non-compliance-with-coe-convention-no108.html

Data Protection Courses (Summer 2023)

An all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill. Will be held on Thursday 13 July  2023 hopefully to include changes made during the Committee stage of the Bill.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection FOUNDATION Course is on Zoom only (June 20-22, 2023 (Tuesday to Thursday, 3 days: 45am to 5.00pm).
• The next Data Protection PRACTITIONER Course is in London on Monday, 24 July 2023 to Friday, 28 July 2023 (5 days: 9.30am to 5.30pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing [email protected].

Outcome of DCMS data protection consultation pre-determined; it helps to save “Big Dog”

“Operation Save Big Dog” is the name given to the effort expended to ensure the Prime Minister survives, despite several after-hours, alcohol-fuelled, “office-gatherings” at 10 Downing Street during COVID-lockdown.  This Operation has coincided with the need to remind the British public of the pure brilliance of the Brexit decision.

Hence last week’s announcement of a ‘Brexit Freedoms’ Bill” (with the promise to use Ministerial powers push through major change) and the publication of a policy document entitled “The Benefits of Brexit” (in case you missed them).  The publication also marks the two-year anniversary of “Getting Brexit Done” and the passage of that not-so-ready, “oven ready” Brexit deal.

The policy document also spells out that the outcome of the DCMS Consultation “Data: a new direction”, concerning changes to the UK_GDPR regime, has been pre-determined; it does not matter what the consultees have written.

It follows that further data protection legislation which provides for weakened privacy protection for data subjects, looser data protection obligations for controllers, and a reduction in the independence of the ICO appears to be inevitable.

Coupled with the changes to the Human Rights regime and the new hurdles facing those who seek judicial review, the UK’s data protection regime is being dissembled.

Pre-determination

The pre-determination of outcome is self-evident from the following quotations from the Benefits of Brexit document.  Firstly:

…the “UK Government consulted in the autumn on proposals that seek to create an ambitious, pro-growth and innovation-friendly UK data protection regime that underpins the trustworthy use of data. The Government will be publishing its response in Spring this year ahead of introducing legislation on reforms to the UK’s data protection regime”.  (my emphasis).

Note the UK Government has “consulted”, an outcome will be published and then legislation will be enacted.  There is to be no second round of consultation.

According to The Benefits of Brexit document these reforms:

“… will help to drive growth, innovation and competition across the country and enhance the UK’s global reputation as a hub for responsible data-driven businesses, trusted by consumers to deliver high standards of data protection” (my emphasis).

[will] “…make the UK an innovation-friendly hub for responsible data-driven business that respects high standards of data protection. Removing barriers to those data flows will boost trade, investment and scientific and technological innovation”. (my emphasis).

Note that both paragraphs repeat the DCMS assertion that “trusted” or “high standard” of data protection can be delivered by reducing or removing controller obligations (e.g.in accountability, doing a DPIA before embarking on high risk processing, having a DPO to monitor compliance, in mandatory data breach reporting, charging for subject access, compatibility and transfer requirements, skewing legitimate interest in favour of the controller, diminishing data subject rights).

Note also the Benefits of Brexit describe the controller obligations as “barriers” not understanding that such barriers exist to protect data subjects.

Finally, the Press Release accompanying the Benefits of Brexit adds that new legislation will create a “less burdensome data rights regime compared to the EU’s GDPR”.   Note that the data subject’s right of access, right to be informed, right to correct, right to object, right not to be profiled etc are all viewed as “burdensome” to controllers and not considered to be valuable safeguards for data subjects.

It is clear that the above conclusions have been reached irrespective of any evidence provided by the consultees to the DCMS Consultation.

Introduction to the ICO comments

I don’t want to spend too much time going over (again) the DCMS Consultation.  My blogs explain that in far too many areas, the DCMS proposals were littered with mistakes, omissions and misunderstandings about the data protection regime (see references at end of blog). The quality of the DCMS consultation is, at best, very questionable.

In addition,  as Rosemary Jay points out,  the protection afforded to data subjects is significantly reduced and the risks of breaching the European Adequacy Agreement is high (see references).  Her evidence also points to errors, omissions and difficulties in understanding the DCMS proposals for change.

Finally, there is the ICO’s response to the DCMS Consultation (see references).   There are at least 34 pages where the ICO fails to comment in substance on the DCMS proposals because there is insufficient detail in the DCMS plans.  I am not expecting you to read all of the list below, but you will quickly get the gist with a scan.

Together the responses identified above demonstrate that the DCMS Consultation cannot be trusted to substantiate the changes to the data protection regime that is to be imposed on the UK’s data subjects (probably using Ministerial powers to minimise public and Parliamentary debate).

ICO seeks clarity on DCMS proposals

1. “As the proposals are developed, the devil will be in the detail we believe there remains more work for Government to demonstrate in sufficient detail how the remainder of the proposals achieve these objectives. (Page 2; ICO consultation)
2. “We believe there remains more work for Government to demonstrate in sufficient detail how the remainder of the proposals achieve these objectives”…. (Page 12)
3. “In order for Government and Parliament to have the required confidence, the nature, context and detail of the processing would need to be set out clearly”… (Page 13)
4. “We would also welcome more detail on how this proposal will interact with the exercise of people’s rights.” (Page 13)
5. “We think Government still needs to provide more detail on the proposals to allow organisations to use data more freely “….(Page 20)
6. “More detail is needed on these and on the proposed role of the ICO”. (Page 20)
7. “We look forward to seeing more detail, particularly on those areas where the policy proposals are more high level”. (Page 24)
8. “We look forward to seeing more detail on the impact on people’s data protection rights …as the Government’s impact assessment and analysis is further developed.” (Page 24).
9. “We would like to see more explanation of the proposals and detailed analysis of the collective impact on the types and volumes of personal data being processed” (Page 28)
10. “We would also like more detail of how the Government plans to make sure this information is protected and that transparency is ensured”. (Page 28)
11. “We would also welcome more detail on how this proposal will interact with the exercise of people’s rights” (Page 30)
12. “We will be looking for Government to set out the nature of the specific types of processing in more detail and how it has assured itself that those included in the list would not have a disproportionate impact on people”.(Page 30).
13. “[The proposal] would need to set out the nature, context and detail of the processing, given that this is all relevant to assessing where the balance lies.” (Page 31)
14. “It is important that Government clearly sets out more detail about how such an approach would work and what safeguards would be in place” (Page 33).
15. “We would like to see more detailed analysis of the thinking Government has done as part of its assessment that the legitimate interests of the organisation undertaking this kind of processing would always outweigh the potential risks to people's rights and freedoms…” (Page 34)
16. “This [proposed change] should be based on detailed analysis and evidence”. (Page 35)
17. “It is also important to understand in more detail from Government how the PMP proposal would ensure a risk based approach”. (Page 42)
18. “This includes how it [the proposed change] would ensure that those organisations with the highest volumes, greatest complexity or most privacy intrusive data have the most robust approaches to accountability and risk identification, mitigation and management”.(Page 42)
19. “We would also welcome more detail from Government about how these proposals would enable businesses to assess the risks of harm to people that arise from new or novel processing, particularly where these involve new technology”.(Page 43)
20. “We would like to see further detailed consideration about how safeguards will work in practice, including how any rights of appeal may need to be amended and how potential equality issues will be addressed”. (Page 49)
21. “we are concerned about the lack of consideration of the impact on people and the potential for these changes to reduce people’s ability to access their fundamental rights” (Page 49)
22. “We are interested in understanding more detail about how this would work in practice.”(Page 49)
23. “The consultation does not go into detail about which elements of these rules would be relaxed.” (Page 55)
24. “While we recognise that these proposals are still in development more detail is needed for respondents to fully understand how a risk-based approach would work in practice”. (Page 60)
25. “We look forward to Government providing more detail on ….”(Page 61)
26. “As above, we look forward to seeing more details or examples of how these proposals would work in practice.”(Page 61)
27. “It would be helpful to have more detail about how the Government proposes to deploy this approach to fully understand the risks and benefits involved.” (Page 61)
28. “It is important that the Government provides more detail on how they would assess whether redress mechanisms are effective.” (Page 61)
29. “More detail on the proposed approach would be helpful in exploring where this might be the case.” (Page 65)
30. “We therefore look forward to seeing further detail on how the Government would ensure the right balance is found between flexibility and assurance to create the appropriate regulatory oversight of this proposal…” (Page 65)
31. “We look forward to seeing further detail on this proposal as it develops. In any more detailed proposals, we would want to guard against weakening the data protection regimes for policing and the intelligence services” (Page 77)
32. “In these areas, more detail on the specific checks and balances in place to ensure the ICO’s continued effective delivery of this role would be helpful”. (Page 79)
33. “We are open to this expansion of our regulatory remit, subject to appropriate funding, and await further detail on how any transfer of functions would work in practice”. (Page 88)
34. “We would welcome a more detailed impact assessment on the overall cost to the ICO, and therefore fee payers, of any changes to the services the ICO is required to deliver (Page 89)

Concluding comment

It is important to understand that the paucity of evidence, the lack of detail, all the omissions and the erroneous analysis in data protection are unimportant to this Government.

Afterall, the political imperative is to “Save Big Dog” by demonstrating that Brexit works.  What better route than by lowering UK data protection standards to the standards adopted by other non-European countries so Ministers can use their powers to state that their data protection law are adequate.

Spring Data Protection Courses

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection Practitioner Course is in London, and starts Tuesday, March 22 (6 days); full details on amberhawk.com/StandardDP.asp or by emailing [email protected]
• The next Data Protection Foundation Course is in London, and starts Tuesday, May 9-11 (3 days); full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]

References

The Adequacy Agreement with the UK: https://ec.europa.eu/info/sites/default/files/decision_on_the_adequate_protection_of_personal_data_by_the_united_kingdom_-_general_data_protection_regulation_en.pdf.

The Benefits of Brexit: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1052148/benefits-of-brexit-document.pdf

Rosemary Jay’s Independent evidence that the DCMS data proposals could undermine adequacy (and the like the ICO, when the DCMS Consultation is unclear or wrong-headed) https://amberhawk.typepad.com/amberhawk/2022/01/independent-evidence-that-the-dcms-data-proposals-could-undermine-adequacy.html

My response to the DCMS Consultation (with links to my 7 blogs on different parts of the DCMS Consultation at the end of this link): https://amberhawk.typepad.com/amberhawk/2021/11/data-a-new-direction-amberhawks-response-to-the-dcms-consultation.html

ICO response to the DCMS Consultation: https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2021/10/response-to-dcms-consultation-foreword/

UK’s human rights proposals significantly weaken protection for all data subjects

The Ministry of Justice (MoJ) Consultation,  “Human Rights Act Reform: A modern Bill of Rights”,  has the potential to significantly undermine the application of UK’s data protection regime.

These MoJ proposals are in addition to the DCMS proposals which also weakened the UK_GDPR (discussed in various blogs last November).  Neither the DCMS nor the MoJ make any reference to the fact that their separate public consultations are connected when data protection is concerned.  One wonders how this fundamental omission was missed?

The MoJ Consultation, in summary, is designed to expurgate any European contamination associated with the words “necessary”, “public interest” and “proportionate”.  For example, MoJ proposes changing the interpretation of the word “necessary” so that “great weight” has to be given to Parliament’s view of what is necessary. The same goes for “public interest”.

This has a knock on to the data protection regime.  For example,  the word “necessary” is used in: three Principles in A.5; most lawful bases in A.6; most conditions for the processing of special category of personal data and criminal offence personal data (A.9, A.10 and Schedule 1 of the DPA2018) and several A.23(1) exemptions.

It can be seen that if that “great weight has to be given to Parliament’s view of "necessary" processing, then any enforcement action by the ICO becomes far more difficult. And if the data protection regime cannot be properly enforced, it follows that the protection for data subjects is weakened.

In addition, the MoJ Consultation uses the term “public interest” over 70 times, without a formal definition.  This is like the DCMS consultation “Data: a new direction” which uses the term “public interest” more than 40 times without defining it.

So when Ministers refer to “the public interest” what they mean?

As will be seen, the answer I derive is not a happy one.

ICO as A.8 ECHR Commissioner?

Both the DPA2018, UK_GDPR & Human Rights Act (HRA) are intertwined mainly through the word “necessary” as used, for example, in A.6 of the UK_GDPR or in A.8(2) of the European Convention on Human Rights (ECHR).

For instance, in the context of interference by a public body into an individual’s private and family life (e.g. by police surveillance), the interference (i.e. surveillance) can be justified if it is necessary to safeguard the functioning of a democratic society for reasons listed in Article 8(2) of the ECHR (e.g. “necessary … for the prevention of crime”).

The European Data Protection Board explained the linkage between the data protection and human rights regimes in the following terms:  “In cases where there is 'interference with privacy' [legitimised in terms of A.8(2) of the ECHR] a legal basis is required [as a result of A.6 of the GDPR] … as a precondition to assess the necessity of the interference”. (quotation from WP217).

In other words, when there is an interference by a public body, A.8(2) of the ECHR sets out a general “necessity” requirement for the processing of personal data to be lawful whilst A.6 of the GDPR additionally sets out why that processing is “necessary” (e.g. “necessary for a legal obligation” etc).

The corollary is also valid: a public authority does not infringe the A.8(1) ECHR right, if it can show that its interference by the processing of personal data is justified (i.e. necessary) and has an A.6 lawful basis (e.g. necessary for its public task).

Note that it is possible for the ICO to enforce A.8 ECHR when personal data are processed by a public authority via its link to A.6 of the GDPR.  For example,  if a public authority controller misapplied its powers to disclose personal data, then it could not rely on the obvious lawful basis as the disclosure of personal data would, for instance, not be necessary for a legal obligation  (as the legal obligation has been misapplied).

In other words, the breach of A.8 would also translate into a breach of the relevant lawful basis, in this example A.6(1)(c).  It is the same for “public task” in A.6(1)(e).

It follows that the ICO (as can any European Data Protection Authority) can make an assessment of necessity or proportionality and could become an A.8 Commissioner whenever personal data were processed by a public body.

Unfortunately all data protection regulators (UK and in Europe) down the ages have steadfastly refused to go down this road except, in the UK, for one notable case (see references which also contains a link to a definitive document on the reach of A.8).

Changes to “necessary” & “public interest”

The MoJ Consultation suggests two possible legislative changes to the human rights regime which have significant interpretive impact across the UK_GDPR.  Namely, those UK_GDPR provisions that rely on the words “necessary” or “in the public interest” for their effect.

Note that the text of the UK_GDPR does NOT change (e.g. the UK_GDPR provision still refers to “necessary”), but the interpretation and consequential impact on application or enforcement of the UK_GDPR does change significantly.

These proposed legislative changes will apply when an A.8 case is heard by a Court; these require the Court to give “great weight”:...

“… to Parliament’s view of what is necessary in a democratic society (and the fact that Parliament has enacted the legislation is for these purposes determinative of Parliament’s view that the legislation is necessary in a democratic society)”;

Or (this “or” could possibly end up being an “and”?)

“… to the fact that Parliament was acting in the public interest in passing the legislation” (page 100; MoJ Consultation;  my emphasis).

“Legislation” as used in the above quotations is defined to be  “primary legislation, and subordinate legislation …. which has been approved by a resolution of either or both Houses of Parliament” (i.e. the affirmative resolution Parliamentary procedure has been followed).

If the MoJ proposals become law, it can be seen that whenever Parliament enacts legislation that relates to (or requires) the processing of personal data, this fact has to be given “great weight” by the Courts when assessing whether the processing is “necessary” or “in the public interest”.

Clearly therefore, the ICO will also have to give them “great weight” prior to enforcing the data protection regime (or indeed in the ICO’s official data protection guidance).

Worked example

Suppose the ICO is enforcing the lawful basis used for the processing of personal data by a public authority and suppose further the processing was authorised by law or related to its public task functions as set in legislation approved by Parliament.

To have a successful enforcement under A.6, the ICO has to establish that the processing was neither “necessary” nor “in the public interest” AND overcome the “great weight” that has to be given to the alternative view (e.g. Parliament’s view that the processing was necessary).

This allows a public authority controller that is facing such ICO enforcement action (e.g. for unlawful processing) to defend the ICO’s action in Court (or Tribunal) arguing that: “The ICO has failed to give  “great weight” to Parliament’s view that the controller’s processing was indeed necessary”.

Similarly, if the “in the public interest” option arises; the argument changes to: “The ICO has failed to understand that “great weight” had to be given to the  “public interest” in the processing especially as the Controller was merely following Parliament’s wishes”.

Remember, in general, A.6(1)(e) provides a lawful basis for the processing if it is “necessary for the performance of a task carried out in the public interest” where the public interest in question is likely to carry automatic “great weight”  (in favour of the controller rather than the data subject).

Wider impact on the UK_GDPR

The question then arises as to whether this kind of knock on effect undermines other data protection provisions where the words “necessary” or “the public interest” are used?  I am afraid to say that I suspect this is the case.

For instance the word “necessary” appears in three Principles in A.5, most lawful bases in A.6, most conditions for the processing of special category of personal data and criminal offence personal data (A.9, A.10; Schedule 1) whereas ”public interest” appears in A.23 exemptions, certain rights (e.g. A.13), Schedules 1 to 5 of the DPA2018 (Special category of personal data and exemptions), transfer arrangements, data breach notification etc (and in a number of other places).

So assume the Government use powers approved by Parliament in the Digital Economy Act 2017 to specify data sharing between two controllers of specified personal data for a specified period.  Suppose further the ICO considers that the controllers were processing excessive personal data for far too long.

The controllers can resist any ICO enforcement to by arguing:

• Parliament has determined that the lawful basis for the processing is both “necessary” and “in the public interest” (i.e. A.6(1)(e)) and this fact should carry “great weight”;
• The Data Minimisation Principle is not breached because Parliament has explicitly stated the processing of certain items of personal data; these have been deemed necessary for the purpose and this fact should carry “great weight”;
• The Storage Limitation Principle is not breached because Parliament has explicitly specified the that personal data should be retained in a name linked form for a specific period; Parliament has deemed this retention time as being “necessary” for the purpose, and that this fact carries “great weight”.

It can be seen that there is not much data protection left  (e.g. transparency, security) and the provisions in the MoJ Consultation (as illustrated above) effectively comprise an exemption from the two Principles mentioned above and A.6. 

Note also that the data subject’s right to object also becomes almost exempt as the objection has to overcome the fact that Parliament has judged that the continued processing by the controller has to carry great weight.

With respect to “substantial public interest” (as used in Schedule 1 to legitimise the processing of special category of personal data),  the DCMS has suggested changes where legislation specifies when the substantial public interest is satisfied (para 297 of DCMS Consultation).

If this happens the processing will automatically become “necessary” and this fact will have to be given  “great weight” by the ICO.  The result is that such special category of personal data and criminal offence personal data could be made easier to process by public bodies to the detriment of the protected offered to data subjects.

In the public interest?

With respect to enacting legislation, what Government wants usually is enacted;  there is no separation of powers in the UK as the executive (i.e. Government) sits in the legislature (i.e. Parliament) and is in control of the legislature’s agenda. This is exacerbated by an Electoral System that delivers majority Governments with a minority popular vote (e.g. 58% of the Parliamentary seats with 43.6% of the popular vote).

This means that opposition parties might huff and puff, but with a large majority, a Government should get its legislative way.

The point being made is that Parliament could vote primary legislation down but very rarely does so.  So when the MoJ Consultation refers to  “…Parliament’s view of what is necessary in a democratic society “  it is really referring to what the Government considers as being necessary in a democratic society.

Similarly when Parliament acts in the public interest in passing the legislation it is usually because Government has the view that the proposed legislation is in the public interest.

It’s the same with the secondary legislation subject to affirmative resolution procedures.  Although in theory, secondary legislation can be voted down, it is not.  A House of Commons Research Paper on Statutory Instrument explains that:

“In the House of Commons, the last time a draft Statutory Instrument subject to affirmative procedure was not approved was in July 1978 when the draft Dock Labour Scheme 1978 was defeated by 301 votes to 291. (see references).

So, in summary, what is necessary is what the Government specifies as necessary; what is in the public interest equates to the interests of the Government of the day.

But then it gets worse.  Given the primacy of the (almost Presidential) post of Prime Minister, what is “in the public interest” equates to “in the interests of Boris Johnson”, insofar, at the time of writing, he is the current Prime Minister of the UK.

Now that is a really unpleasant thought to end with.

Data Protection Courses (Winter 2022)

Because of continued COVID uncertainty, fuel crisis, or the results at Barnsley FC the course can be attended in person, or via Zoom, or as a mixture if you something untoward happens: it's up to you.

• The Data Protection Practitioner Course is in London, and starts Tuesday, March 22-25; March 29-31 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]
• The Data Protection Foundation Course is in London, and starts Tuesday, February 1st to 3rd (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]

References

Information Commissioner should enforce Article 8 privacy rights http://amberhawk.typepad.com/amberhawk/2010/04/information-commissioner-should-enforce-article-8-privacy-rights.html

Information Commissioner’s enforcement proceedings links Article 8 to unlawful processing. https://amberhawk.typepad.com/amberhawk/2012/11/information-commissioners-enforcement-proceedings-links-article-8-to-unlawful-processing.html

House of Commons Research Paper on Statutory Instruments: https://researchbriefings.files.parliament.uk/documents/SN06509/SN06509.pdf

Guide to Article 8 prepared by the Registry of the European Court of Human Rights: https://www.echr.coe.int/Documents/Guide_Art_8_ENG.pdf

Example of affirmative SI procedure for the “Economic Growth (Regulatory Functions) Order 2017”:  see middle of Ministers want to pull the strings and rein-in the ICO’s independence; https://amberhawk.typepad.com/amberhawk/2021/11/ministers-want-to-pull-the-strings-and-rein-in-the-icos-independence.html

Human Rights proposals undermine Data Protection and Adequacy

The proposals to change the human rights regime outlined in Ministry of Justice (MoJ) Consultation,  “Human Rights Act Reform: A modern Bill of Rights”, are truly awful.  This is especially the case when combined with the proposed restrictions on Judicial Review that helps ensure that public authorities process personal data lawfully in accordance with Article 8 (A.8) of the Human Rights Convention.

As will be seen in the next few blogs, the human rights legislation that protects us all and underpins the data protection regime is in serious jeopardy.  I therefore encourage readers to enter the fray and make their views clear. 

It goes without saying that these changes, if implemented, would significantly jeopardise the Adequacy Agreement with the European Commission.  Does the Ministry of Justice (MoJ) consultation mention the impact on the Adequacy Agreement? Of course not; like the DCMS consultation “Data: a new direction”, it remains silent on this important issue.

In addition, the MoJ’s case for changing the UK’s human rights regime with respect to A.8 is wholly misleading.  To use a topical idiom: the MoJ Consultation “is as truthful as a BoJo”.

In summary, the proposals are unacceptable and, in the next few blogs, I will explain why this is the case.

Summary of the changes

The text of the human rights listed in Schedule 1 of the Human Rights Act 1998 is not being changed; however, its interpretation and application is.

In summary, the MoJ proposed changes relevant to this blog (I.e. A.8) include:

• empowering domestic courts to apply human rights in the UK context. Comment: the UK Courts are not required to follow European Court of Human Rights judgments.
• changing the ability of individuals to protect their A.8 rights by requiring the UK courts to give “great weight” to the views of Parliament (e.g. the “public interest” or “necessity” is essentially determined by Parliament).  Comment: public bodies will be presumed to be working in “the public interest” when they act in a way that is authorised by legislation enacted by Parliament.
• changing the balance between A.10 (freedom of expression) and A.8 (respect to private and family life); there will be a presumption that the former should prevail over the latter. Comment:  this can be seen as a “thank you for your continued support”, from the Conservative Party,  to its friends in the largely Brexit supporting media.
• making it harder for individuals to take human rights cases by “ensuring that spurious cases do not undermine public confidence in human rights”. Comment: the individual could be required to exhaust other remedies first, then obtain leave of the court in order to pursue an A.8 case and then show prior “significant disadvantage” or demonstrating an “overriding public importance”.

Note that the above constitute a subtle change to our human rights.  The text of the actual rights has not changed but exercise of these rights, or an interpretation that favours the individual complainant, becomes very much harder to establish.

In summary, Government can claim “nothing has changed” (e.g. to the text of A.8 right), but a great deal will change when individuals attempt to exercise the A.8 right.

Adequacy down the tubes?

The threat to Adequacy Agreement arises because the European Commission thought that..:

• there was “… United Kingdom’s adherence to the ECHR … as well as its submission to the jurisdiction of the European Court of Human Rights”. (para 19; my emphasis). Comment: as explained above, the UK is no longer “submitting” to the jurisdiction of the European Court. The MoJ  Consultation spells this out “…that the judgments and decisions of the European Court  of Human Rights … are not part of the law of any part of the United Kingdom” (page 100 of MoJ)
• “….any person that considers that his or her rights, including rights to privacy and data protection, have been violated by public authorities, can obtain redress before the UK courts under the Human Rights Act 1998”. Comment: the MoJ proposals put considerable hurdles in the way of any person seeking such redress (e.g.  show prior “significant disadvantage” etc;  para 109).
• there was “continued adherence to such instruments” (i.e. “submission to the jurisdiction of the European Court of Human Rights”; para 120). ”. Comment: “continued adherence”  is no longer the case.

I now move on to the misrepresentation of A.8 position as expressed in the MoJ Consultation.

The case of Marper v UK

Marper v the UK is an important example of an A.8 case that the MoJ Consultation ignores (see references).

The case surrounds a simple question: “should the DNA sample and the numerical representation of that DNA sample,  be deleted if a suspect, charged of a crime, is acquitted?”.  So should the police be able to retain DNA of people found innocent?  Before reading on, what’s your answer: YES or NO?

As an aside, I explained in a blog 13 years ago that the current retention policy relating to DNA will eventually produce a DNA database that spans the population (see references).

Marper is interesting in that, when before the House of Lords (now called the Supreme Court), a panel of five law Lords (all senior judges) found unanimously in favour of retention of DNA by the police.  By contrast, a full panel of ECHR Court judges found 17-0 in favour of Mr. Marper (i.e. unanimously the other way).

If the Government’s proposals were to become law, DNA of the innocent would have been lawfully retained by the police as the highest Court in the UK would have made an unanimous determination.  Such retention would be very different for European police forces.

In addition, I suspect all the surveillance A.8 cases where the national security agencies and the police have overstepped the mark (e.g. bulk personal data collection; use of CCTV facial recognition) would have been lost if the MoJ’s proposals were law.

One obvious reason for this is that the claimant would not be able to overcome the “significant disadvantage” threshold.  For instance, how do you know that you are subject to secret covert surveillance?  Answer:  you don’t know.   So how can you establish “significant disadvantage” before taking action.  Answer: you can’t. 

In general therefore many actions on human rights grounds are likely to fall at first base.  There will be limited leeway for a judge to allow a case to go to trial if a "highly compelling reason" of "public importance" can be established pre-trial, but this pathway is designed to be exceptional-use only.

Should the MoJ Consultation have given examples like Marper that illustrate the complex human rights issues involved  (e.g. what happens if the UK is out of step with the rest of Europe) so that respondents can make an informed and balanced response? The MoJ answer is: “of course not”; the subject is not even raised.

The case of Ellis

Does the MoJ give examples where it thinks individuals have won A.8 cases without merit? Answer: YES (in spades), especially in the area of prisoner voting and deporting immigrants.

However,  this “evidence” is presented in a very misleading way and this is illustrated by the case of R (Ellis) v the Chief Constable of Essex Police as used in the MoJ Consultation.

At the heart of Ellis is a simple question?  Should the police be able to deter crimes by printing posters or leaflets that identify known criminals who have been arrested or put behind bars?  So before reading on, what’s your answer: “YES”, “IT DEPENDS” or “NO”?

The MoJ consultation explains that the Ellis case:

“…has led to the situation where police forces face a real risk of legal challenge, where they wish to publicise the results of criminal activity or deter others by issuing posters identifying offenders who have been convicted for very serious crimes” (para 137).

Does the MoJ Consultation explain how the Court come to its conclusions in favour of Ellis? Of course not.  So I will provide the missing links.

In its evidence, the Probation Service provided the following explanation to the Court:

"If Gary Ellis were to be made subject to the Essex police naming scheme, this is likely to make worse the risk of homelessness, drug misuse, reoffending, non-compliance on licence and is likely to increase the risk of harm to the public. If named there is also the distinct possibility of some collateral harm to the parents of Gary Ellis, his ex-partner and his daughter."  (para 10-12 of the Ellis judgement).

So what’s your answer now: “YES” or “NO”?

In a later A.8 case, involving the London Borough of Brent (see references), the Ellis arguments resurfaced to prevent the distribution of a leaflet that identified youths who were excluded from a geographic area (e.g. a shopping centre).  The youths were subject to an Anti-Social Behaviour Order (ASBO) which specifically excluded named individuals from that area and the police wanted to enforce the ASBO by distributing a leaflet that identified those who were subject to the ASBO.

So should the leaflet be circulated by the police (e.g. to shopkeepers)? YES” or “NO”?

In this case, the A.8 argument used in Ellis was rejected by the Judge in the following terms:

“It is clear to me that whether publicity is intended to inform, to reassure, to assist in enforcing the existing orders by policing, to inhibit the behaviour of those against whom the orders have been made, or to deter others, it is unlikely to be effective unless it includes photographs, names and at least partial addresses.”  (para 40; my emphasis)

It is interesting to note that both the Met Police and L.B. Brent argued that the A.8 right was not engaged; the Judge rejected that view but concluded that “Article 8 could be involved if the publicity was found to be unnecessary or disproportionate”.

So these are the criteria that resolves the problem raised by the MoJ’s consultation in Ellis.  If the publication of personal data is necessary and proportionate then there is no A.8 breach, if publication is unnecessary or disproportionate there is an A.8 breach. 

In my view, all that is required is a proper assessment of necessity and proportionality; not a change in the law.   Is this explained by the MoJ Consultation? Of course not.  It wants to tip the scales in favour of Government.

Hence my conclusion that the arguments presented by the MoJ Consultation in support of the changes to the A.8 regime do not stand up to scrutiny.

Concluding comment

I have found one paragraph from the MoJ Consultation deeply unsettling and I wonder whether you read it the same way as I am.  This paragraph reads as follows:

“The Prison Service has settled claims alleging a combination of negligence, inhuman and degrading treatment (under Article 3), the violation of the right to a privacy (under  Article 8) and discrimination (under Article 14). This has cost the taxpayer around £7 million, including compensation paid out and legal costs” (bottom page 40).

Do you think the MoJ Consultation is suggesting that these settled claims are unfounded and should not have been settled?  Does this then imply that a small amount of “negligence, inhuman, degrading treatment, violation of the right to a privacy and discrimination” is somehow acceptable to the Prison Service?

As the MoJ Consultation wants to change the law, the answer is an inferred “YES”; hence my alarm. Note that the Consultation is promoting the “Prince Andrew” defence:  “No inhuman and degrading treatment occurred but we are paying compensation anyway (AND please sign our Non-Disclosure Agreement)”.

In other words,  the worrying reason why the Government is wanting to change the human rights regime to “make the law difficult to use so we can get away with it”.

Data Protection Courses

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection Foundation Course is in London, and starts Tuesday, February 1^st to 3^rd (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]
• The next Data Protection Practitioner Course is in London, and starts Tuesday, March 22 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]

References

The Adequacy Agreement with the UK: https://ec.europa.eu/info/sites/default/files/decision_on_the_adequate_protection_of_personal_data_by_the_united_kingdom_-_general_data_protection_regulation_en.pdf.

Human Rights Consultation Document from the MoJ: https://consult.justice.gov.uk/human-rights/human-rights-act-reform/.

Marper v UK references: Case of S. and Marper  v. The United Kingdom, (Applications nos. 30562/04 and 30566/04; judgement delivered 4 December 2008);  Regina v. Chief , Constable of South Yorkshire Police (Respondent) ex parte LS and Marper [2004] UKHL 39, judgment delivered 22 July 2004).

Blogs relevant to Marper:

• Marper case exposes how Parliament cannot consider human rights issues: https://amberhawk.typepad.com/amberhawk/2010/01/uk-terror-case-judgment-illustrates-a-failed-system-that-cannot-protect-privacy.html.
• Example of divergence between the UK and European approach to A.8 in Marper: https://amberhawk.typepad.com/amberhawk/2009/11/uk-courts-view-any-data-retention-as-human-rights-compliant.html.

2009 blog “Indefinite retention produces a DNA database that spans the population”: https://amberhawk.typepad.com/amberhawk/2009/12/indefinite-retention-produces-a-dna-database-that-spans-the-population.html.

R (Ellis) v the Chief Constable of Essex Police ([2003] EWHC 1321 (Admin)) https://www.bailii.org/ew/cases/EWHC/Admin/2003/1321.html.

R (Stanley et al) v Metropolitan Police and L.B. of Brent ([2004] EWHC 2229 (Admin)): https://www.bailii.org/ew/cases/EWHC/Admin/2004/2229.html.

Independent evidence that the DCMS data proposals could undermine adequacy.

First of all Happy New Year; I hope the recent festive excitement was not too infectious.  Indeed, with the risky policy of letting Omicron rip, let us hope there are not too many ex-data subjects, possibly as a result of the collapse of essential services.

I am starting the Year with a real treat; I have been given permission to publish the personal views of Rosemary Jay as submitted to the DCMS consultation “Data: a new direction” (see link at end of the blog).  It is a detailed 30 page submission.

I should add that I am a fan of all Rosemary’s writings and publications.  They are always well argued and fully referenced; the DCMS would be unwise to ignore her views.

In general, Rosemary thinks it was an error for the Consultation not to deal with the impact of the proposals on the UK’s Adequacy Determination from the European Commission.  She also agrees with the ICO that several proposals are unclear as to what is meant.

So if both the ICO and Rosemary are stating that the proposals lack clarity, the question must be asked as to how can the DCMS hold a meaningful public consultation?

Anyway, you don’t need me to prattle on;  so to whet your appetite, there follows several quotes from her text.

1. “The consultation includes a number of helpful and practical proposals. However the wide scope means that it can be difficult to tease out the useful and/or significant elements. In some cases the impact of the proposals is not clear and in some places it is difficult to work out how different aspects of the proposals fit together”.
2. “In addition there are some regrettable omissions…. The most striking omission is the absence of any assessment of the proposals on the UK’s adequacy finding from the EU. , it may mean that many who read the consultation paper will assume that none of these proposals will have a potential impact on adequacy.”
3. “It seems that an assumption of legitimate interests is reasonable (a bit like the old registration or notification exemptions – processing widely accepted as low risk) however the categories proposed need to be re-examined. Overall the better approach may be to add a presumption of legitimacy which could be rebutted in specific cases, particularly in the case of internal business purposes”.
4. “In relation to cookies this proposal seems nugatory and adds nothing to the impact of PECR and should be removed” [for the reasons set out in Rosemary’s evidence]…“...It is regrettable that cookies have been included in this section on legitimate interests without reference to the section of the paper covering PECR related issues, including the placing of cookies”.
5. “The proposals to remove the DPO role, DPIAs and central records of processing; the proposed changes to the position and independence of the ICO; the potential changes to the compatibility regime; the potential removal of the Article 22 rights; the proposal to diminish the test of fairness in relation to AI, and the cookie proposals all raise potentially serious problems with the adequacy assessment”
6. “There seems no point in removing the role of the DPO which is now well-understood and utilized, and replacing it by a “suitable individual responsible for the privacy management programme”.
7. “As a result the failure to evaluate and discuss the adequacy risks attached to different parts of the proposed changes means an essential element of the relevant policy consideration is missing in every aspect of the proposal”.
8. “Secondly there is little clarity over which parts of the proposals would impact on the law enforcement and security provisions in the Data Protection Act 2018 (DPA 2018)”.
9. One proposal that a new legal basis for processing is not required for compatible processing (justified in terms of an “odd sentence in Recital 50”) “….is fatally flawed”.  It would undermine the UK regime by importing an unjustified liberty to carry out new processing without proper assessment and ensuring the application of adequate grounds for processing in the particular case.  As the grounds for processing are a fundamental concept in the GDPR this would amount to a significant undermining of the UK regime”.
10. “These proposals are extremely confusing [relating to  when further processing may occur when the original lawful ground was consent].  It is difficult to have any real sense of what is being proposed.
11. “The conflation of research with non-research further processing is misleading. The proposals need to be clearly re-drafted and set out concisely what is being proposed in each case. In particular the cases where there is a statutory presumption of compatibility need to be distinguished from those where there is no such presumption, therefore re-use for research purposes should be clearly distinguished and it made clear the second section does not cover re-use for research”.
12. “Further, the use of the broad, generic term “public interest” needs to be addressed – there is no generic test of public interest and it needs to be considered and applied in specific contexts; re-consent or consent situations should be distinguished from those where there is no consent or no other ground”.
13. “It cannot be asserted that there is always a public interest in all research, or that, to the extent there is a public interest, it is always of the same nature or importance. Research into the hair colour of women who buy stiletto heels in not on a par with research into the causes of diabetes. Accordingly there is no justification for removing the rigour of the law from all research and a more appropriate and balanced option needs to be considered”.
14. “Irrespective of the purpose of the processing or the purpose of collection, it [the Consultation Document] recommends permitting the re-use of personal data for a new purpose, including an incompatible purpose, where the processing safeguards an important public interest”.
15. “ Irrationally (and arguably giving a misleading impression) this also covers where the data subject has “reconsented” to the new purpose which is a wholly different fact set and should be clearly differentiated. In such a case the controller can rely on the consent and the issue of compatibility does not arise”.

Concluding comments

Sometimes, I wonder who actually is driving some of the changes proposed by the DCMS; my nightmare is that it is the same people who wrote that awful TIGRR report (see references).

My blogs before Xmas provide ample evidence of a relatively low standard of data protection knowledge that is inherent in some of the DCMS justifications for its proposals (e.g. especially around consent, incompatibility, research and accountability).

In addition, I think the DCMS proposals:

• put the ICO’s independence at risk.
• in relation to transfer from the UK are far too loose and will be unacceptable in the EU.
• for a privacy management programme to replace accountability obligations is a recipe for inconsistent data protection management on the part of UK controllers.
• are not supported by evidence; that is why the DCMS Consultation asks for evidence.

It is strange that the Government wants to attract high tech industry to the UK whose customers are likely to include many EU controllers; such customers will expect that AI services and software products, produced in the UK, to satisfy the EU_GDPR requirements.

The fact that such products and services are produced in a country that has low data protection standards, as outlined by the DCMS proposals, does not strike me immediately as being a strong USP.

Hence losing that Adequacy Determination is an important factor;  Rosemary is absolutely correct to point out that the absence of Adequacy discussion in the DCMS Consultation was a major mistake.

Finally, given the political difficulties of the Prime Minister is in with his own Party, there is a real risk that the GDPR (and the proposed changes to the Human Rights Regime) will be red-meat to be thrown to the right wing of the Conservative Party (e.g. the TIGRR brigade) as an example of the UK “taking back control”.

In practice, the real threat is to UK data subjects losing control and the deliberate undermining of their privacy protection.

Data Protection Courses (Winter 2022)

Because of continued COVID uncertainty, fuel crisis, or the results at Barnsley FC the course can be attended in person, or via Zoom, or as a mixture if you something untoward happens: it's up to you.

• The Data Protection Practitioner Course is in London, and starts Monday, January 25-27; February 8-10 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]
• The Data Protection Foundation Course is in London, and starts Tuesday, February 1st to 3rd (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]

References

Load a copy of Rosemary’s personal evidence here: Download RJ personal view on DCMS Data proposals

The blog “TIGRR, Eeyore and Pooh Bear decide to destroy the GDPR”: https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html

“Data: a new direction” - Amberhawk's response to the DCMS Consultation

This blog comprises the response of Amberhawk Training Limited to the DCMS Consultation document “Data: a new direction”  (the “Consultation”).  Amberhawk is a training company established in 2000; its Directors have over 40 years’ experience in training those who are responsible for data protection in an organisation.

The response is over 15,000 words and takes the form of 7 blogs, each of which are about 2,300 words long.  They were published during the consultation period which ends tonight and have been updated as our understanding of the proposed reforms have improved.  The links to these blogs at the end of this document.

In summary, the blogs cover the following topics.

1. How the data subjects’ privacy protection is much diminished by proposals to change UK_GDPR. This text explains how the DCMS proposals significantly impact on the protection of data subjects to such an extent that the level of privacy protection for data subjects is about that found in the DPA1984.  The Ministerial promise of “maintaining the UK’s world-leading data protection standards” for data subjects is therefore dishonest and lacks credibility.
2. Government propose to reduce DP accountability requirements to OECD standards. The Consultation makes several mistakes and omissions when explaining its DPO proposals.   It follows that its arguments are misleading and its conclusions at this part of the Consultation are suspect. The proposals for a privacy management program do not comprise a recipe for improved data protection management; it is a recipe for inconsistent compliance (as in the DPA1984 and DPA1998) as many controllers will go off on a frolic of their own when deciding how their own programme is implemented and resourced.  It appears that the objective is to align UK DP law with OECD standards; DCMS should be more honest with respect to that objective.
3. Ministers want to pull the strings and rein-in the ICO’s independence. The blog explains why the DCMS proposals ensure that the ICO role is no longer independent of Government and explains how the Secretary of State is in control of key aspects that would identify the ICO as being independent.  If DCMS’s objective is to lose the adequacy agreement with the European Union, implementing these provisions would serve as a good way to achieve this objective.
4. Data Protection accountability suffers as a result of an unconvincing attempt to reduce red-tape. This blog discusses the proposal: to remove the obligation to maintain a register of processing activities (ROPA; A.30); to remove the requirement to undertake DPIAs (A.35 and A.36); and to reduce the circumstances when a data breach is reported to the ICO (A.33).   These will be replaced by far looser requirements that form part of a controller’s privacy management programme. Additionally, I suspect the DCMS author of this part of the Consultation does not understand the role of the ROPA nor the obvious solution to the over reporting of data breaches.  Mention of the processor’s ROPA is missing? Was this deliberate? Is it being retained? Or abolished?  This is an example of the problems associated with the Consultation document.
5. Government propose to tip the scales in the controller’s legitimate interests. As far as I can see, this proposal is based on a false data protection analysis and illustrated by examples that show that no change is needed. Additionally, if the controller’s legitimate interests always prevails, it follows that the data subject’s right to object to the processing and other related rights are also negated.  The impact of these negated rights is missing from the DCMS’s incomplete analysis. In short, if enacted, this proposal will take away rights of those data subjects who could face substantial distress by the processing of their personal data.
6. UK plans for incompatible processing undermines data protection for individuals. The proposals misses out any analysis of A.23(1) and in particular A.23(1)(e);  this undermines the proposals as the text becomes ambiguous as to what is intended.  As far as I can guess the objective is to break the link in A.6(4) between “public interest” and the exemptions in A.23(1) so that Ministers can declare what is in the public interest and negate the compatibility assessment.  Because of the lack of clarity, the outcome of this part of the consultation is suspect.  The analysis shows that proposal to change the law around incompatibility has a knock on effect that negates most of the Principles in A.5, provides a lawful basis for the “incompatible” processing, can involve the processing of special category of personal data and diminish the rights of data subjects.
7. Government’s UK_GDPR proposals for research are unethical and unsafe. The blog shows the proposals for the processing of personal data for research purposes; they are unreliable, untrustworthy and unethical.  For instance, the proposals are so “flexible” they can allow for secret research, using of special category of personal data or criminal offence personal data, similar to the “research” that gave rise to the Cambridge Analytica scandal.

Concluding comments

In summary, the DCMS proposals for changing the UK_GDPR do not impress; there are too many mistakes and errors and the conclusions do not withstand intellectual rigour.  There is no evidence for the changes that the Government want to make and the invocation for responders to provide the evidence does not fill one with confidence.

One also gets the impression that the proposals for change will be pushed through Parliament using Ministerial Powers with little regard to the consequences.

What really irritates is the repeated statements by the DCMS that the proposals comprise “world class data protection” when they palpable do not. A little more honesty from Government would be better (e.g. we want to lower data protection standards to those of our new trading parties).

Links to the blogs

How the data subjects’ privacy protection is much diminished by proposals to change UK_GDPR; https://amberhawk.typepad.com/amberhawk/2021/11/how-privacy-protection-is-much-diminished-by-proposals-to-change-the-uk_gdpr.html

Government propose to reduce DP accountability requirements to OECD standards; https://amberhawk.typepad.com/amberhawk/2021/10/government-propose-to-reduce-dp-accountability-requirements-to-oecd-standards.html

Ministers want to pull the strings and rein-in the ICO’s independence; https://amberhawk.typepad.com/amberhawk/2021/11/ministers-want-to-pull-the-strings-and-rein-in-the-icos-independence.html

Data Protection accountability suffers as a result of an unconvincing attempt to reduce red-tape.; https://amberhawk.typepad.com/amberhawk/2021/11/data-protection-accountability-suffers-as-a-result-of-an-unconvincing-attempt-to-reduce-red-tape.html

Government propose to tip the scales in the controller’s legitimate interests; https://amberhawk.typepad.com/amberhawk/2021/10/government-propose-to-tip-the-scales-in-the-controllers-legitimate-interests.html

UK plans for incompatible processing undermines data protection for individuals; https://amberhawk.typepad.com/amberhawk/2021/10/proposals-for-incompatible-processing-undermine-protection-for-data-subjects.html

Government’s UK_GDPR proposals for research are unethical and unsafe; https://amberhawk.typepad.com/amberhawk/2021/09/governments-uk_gdpr-proposals-for-research-are-unethical-and-unsafe.html

Data Protection Courses (New Year: 2022)

Because of continued COVID double jab / booster uncertainty, the fuel crisis, or the results at Barnsley FC the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection Foundation Course is in London, and starts Tuesday, February 1^st to 3^rd (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]
• The next Data Protection Practitioner Course is in London, and starts Tuesday, January 25 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]

How privacy protection is much diminished by proposals to change the UK_GDPR

The DCMS Consultation document “Data: a new direction”  (the “Consultation”) proposes to tip the balance between the interests of controllers and the interests of data subject in favour of the controller.  This blog looks at the proposals, not in the context of how beneficial they are for controllers, but rather in the context of how they weaken the privacy protection afforded to data subjects.

The weakening provisions being mooted include:

• Introducing a fee arrangement for subject access which has a chilling effect on the subject access right. A £10 fee as per the DPA1998, for instance, is likely to disenfranchise the poor from the right of access;  having lost £20 in universal credit, post COVID, would impoverished data subjects pay £10 for subject access?  It is difficult to fathom how such a proposed fee arrangement forms part of the Government’s “levelling up” agenda.
• A fee arrangement based on FOI Appropriate Limit is likely to apply to complex requests (e.g. where there is personal data relating to more than one individual as is common in education, health and social work). Many of these complex requests risk being refused on the grounds that they are over the equivalent of the FOI Appropriate Limit.
• Effectively removing the A.22 right not to be profiled. As some profiling is to be deemed to be in the legitimate interests of controllers and some profiling deemed to be necessary for public tasks, the original right not to be profiled in A.22 thus only remains for “vital interests” processing.
• Increasing the prospect of unwanted marketing telephone calls unnecessarily. The proposal is for the “soft opt-in” (an “opt-out” in practice) to be extended to all forms of electronic marketing when the unsolicited marketing rules by telephone already allow for the use of an “opt-out” – oops I mean “soft opt-in”.
• Controllers do not work to a unified privacy standard as set out in the UK_GDPR; instead they work to their own data protection standards as set out in their own “privacy management program” (if controllers ever get round to establishing such a program). Unlike the Consultation,  I cannot see how letting controllers “do their own thing” (as per DPA1984 and DPA1998) allows for any consistency in the level of data subject protection.
• The ICO can no longer rely on the controller and processor maintaining records that demonstrates compliance with A.24-A.39 (e.g. appointment of DPO, DPIA, Data Breach, Security, Contracts) much to the detriment of data subjects. Even the ICO’s response to the Consultation states that “Keeping good records is a key element of good privacy management and high standards of privacy”.
• Reducing the ability of the ICO to enforce issues which are very important to a specific data subject but which are not common to many data subjects. The ICO is expected to focus on the important issues that impact on a large number of data subjects and not on issues that may seriously impact a single data subject.
• The change of focus mentioned in the previous paragraph (i.e. consideration of issues relevant to a large set of data subjects) leads to the circumstances when there is fettering of the ICO’s independent course of action. This arises by requiring the ICO to consider matters that have nothing to do with data protection (e.g. the ICO’s duty to consider economic or innovation issues or the public interest).
• The ICO can decide how, to what extent, or whether to investigate a complaint; the ICO cannot be challenged on, for example, a decision to close a case because it is too difficult for the ICO for whatever reason. This prospect could leave a data subject who has a complex case out in the cold.
• Requiring the data subject to attempt to resolve issues with the controller before complaining to the ICO. This can be uncontroversial in many circumstances.  However, the Consultation’s proposals wholly ignore the circumstances when such contact with the controller could cause detriment to the data subject (e.g. in cases of zero hours contracts, how many such contracts will a controller give a complaining data subject?).
• Extending the exemptions in A.49 so that transfers of personal data can be repetitive (and not occasional as of present). This means that personal data can be transferred to any other country on a bulk basis without reference to the data subjects’ wishes or interests or consideration whether the bulk personal data are safe (e.g. from the authorities) in any destination country.
• Allowing the Secretary of State to assign adequacy to groups of countries (e.g. all countries that implement Convention No. 108 are adequate). This means that there is no individual assessment of the level of protection on a case-by-case basis (e.g. there are 55 countries signed up to this Convention).  The Consultation’s pledge to keep each country’s DP law under continual review is simply not credible given that there are more than 100 countries with DP laws.
• The ICO in her response effectively equates the Consultation’s transfer proposals to the data protection equivalent of “Pie in the Sky when you Die”. She states that there are so many unanswered questions (which means the case of change has not been made):

“While we recognise that these proposals are still in development more detail is needed for respondents to fully understand how a risk-based  approach would work in practice. It would also be helpful to understand more detail about the proposals for future adequacy decisions to “take into account the different legal and cultural traditions which inform how other countries achieve high standards of data protection”. We look forward to seeing more detail about how these changes would work in practice” (para 120).

• Extending the processing of a data subject’s special category of personal data by specifying certain processing to be in the public interest or legitimate interests of the controller. Such processing could well occur without reference to the data subject’s wishes or interests (who is left bereft of options to protect their interests).
• Allowing for wider data sharing across the public sector and to include data sharing with private sector bodies without reference to the data subject’s wishes or interests (who is also left bereft of options to protect their interests).

Commentary

The Consultation provides no evidence for most of the legislative changes it claims that are needed.  That is why the Consultation frequently ask its consultees to provide the necessary evidence to substantiate the Government’s proposed change.   This is governance at its very worst;  a classic example of making detailed legislative changes before the existence of evidence for the need for such changes.

Given the sometimes basic errors and omissions in the Consultation’s data protection analysis (see references for some examples), one also wonders about the quality such received evidence.

That is why the Consultation asks respondents to answer the same question many times.  Roughly speaking, this question goes: “We know that controllers find the following data protection elements a right pain in the arse; please explain your answer, and provide supporting evidence where possible”.

The Consultation is largely drafted from a position where the controller becomes entitled to process the data subject’s personal data (i.e. entitled to use, disclose, retain or transfer the personal data) without consideration of how the data subject’s wishes or interests are protected (usually they will not be protected by the proposals in the Consultation).

If data subjects were to complain to the ICO,  they would find that the ICO is fettered by consideration of matters not related to data protection (e.g. a duty to consider the economy, innovation or the public interest).  There is simply no commensurate increase in the ways data subjects could protect their own interests.

In addition, there is very little the data subject can do if the ICO makes a mistaken decision.  Whereas controllers can appeal against the enforcement actions of the ICO, there is no comparable proposal that allows for an appeal for data subjects to obtain a review of the ICO’s decision.  Given the weakening of the ICO’s powers (as described above), the risk is that such mistaken decisions are set to increase.

Indeed, the Consultation makes Judicial Review of the ICO (itself a cumbersome and expensive procedure for data subjects) less likely.

In some circumstances, the proposal is for the substantial public interest or the legitimate interest of the controller to always prevail irrespective of the data subject’s wishes or interests.

Finally,  transparency of processing to the data subject is deemed to be sufficient protection; however if the data subject cannot do much with that transparency, then transparency is, of itself, of little value.

The result is rather similar to when someone is blackmailed; those blackmailed are fully informed as to what the blackmailer knows but can do very little about it.

Liz the Departed

All the proposed changes are occurring at the end of the watch of the departing Elizabeth Denham as ICO;   one wonders how much the changes to the UK’s data protection regime will become her legacy.  Apart from a mere handful of cases over her tenure, she has limited her enforcement action to unsolicited electronic marketing.  Picking on spammers is easy; picking on controllers who have disregarded other GDPR marketing norms (e.g. Adtech) is far more difficult.

One gets the impression that instead of taking the lead in tackling difficult data protection issues of concern, the ICO has preferred to jump on the coat-tails of privacy activists who crowdfund Judicial Review (e.g. facial recognition CCTV and Big Brother watch; Immigration exemption and the Open Rights Group).

Indeed, she has strenuously opposed the Information Rights Tribunal looking at specific issues of ICO inaction (e.g. her failure to address Adtech and the Open Rights Group).

In addition, her response to the Consultation contains too many statements of the kind: “We would also welcome more detail from Government about how these proposals would before we can comment ….”.

This approach is far too laid back.  Sadly the next ICO will only see the requested “more detail” when it is etched on the face of fresh legislation, likely to enacted by Ministerial edict, and not subject to any meaningful Parliamentary debate.

In conclusion, the Ministerial promise of “maintaining the UK’s world-leading data protection standards” is both dishonest and lacks credibility.   I expect the UK’s data protection regime to emerge at a reduced standard somewhere between the DPA1984 and DPA1998.

Data Protection Courses (New Year: 2022)

Because of continued COVID double jab / booster uncertainty, the fuel crisis, or the results at Barnsley FC the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection Foundation Course is in London, and starts Tuesday, February 1^st to 3^rd (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]
• The next Data Protection Practitioner Course is in London, and starts Tuesday, January 25 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]

References

Please feel free to use of previous blogs when responding to the Consultation.

Government propose to reduce DP accountability requirements to OECD standards; https://amberhawk.typepad.com/amberhawk/2021/10/government-propose-to-reduce-dp-accountability-requirements-to-oecd-standards.html

Ministers want to pull the strings and rein-in the ICO’s independence; https://amberhawk.typepad.com/amberhawk/2021/11/ministers-want-to-pull-the-strings-and-rein-in-the-icos-independence.html

Data Protection accountability suffers as a result of an unconvincing attempt to reduce red-tape.; https://amberhawk.typepad.com/amberhawk/2021/11/data-protection-accountability-suffers-as-a-result-of-an-unconvincing-attempt-to-reduce-red-tape.html

Government propose to tip the scales in the controller’s legitimate interests; https://amberhawk.typepad.com/amberhawk/2021/10/government-propose-to-tip-the-scales-in-the-controllers-legitimate-interests.html

UK plans for incompatible processing undermines data protection for individuals; https://amberhawk.typepad.com/amberhawk/2021/10/proposals-for-incompatible-processing-undermine-protection-for-data-subjects.html

Government’s UK_GDPR proposals for research are unethical and unsafe; https://amberhawk.typepad.com/amberhawk/2021/09/governments-uk_gdpr-proposals-for-research-are-unethical-and-unsafe.html

Ministers want to pull the strings and rein-in the ICO’s independence

Summary introduction

The DCMS propose to change the duties of the Information Commissioner (ICO) in such a way that they decrease the prospect of enforcement on data protection grounds; in this way the changes reduce the protection afforded to data subjects.

This prospect arises as the Commissioner will have a duty to consider factors relating to the economy, public safety or the Government’s international agenda prior, for example, to exercising the ICO’s powers of enforcement against a controller.

The Secretary of State is also seeking powers to determine the Commissioner’s priorities.  These include vetting the ICO’s Guidance to ensure it is appropriate for a business friendly, data protection era in the UK.

Apart from minor adjustments to compel witnesses to appear and longer timescales for an ICO investigation,  there is no corresponding strengthening of the Commissioner’s powers.

So, if the Commissioner were to make a misjudgement (e.g. decide that the economic objectives take precedence over the data subject’s privacy) and failed to enforce the DPA2018, there would be no appeal to the Tribunal available to affected data subjects.

However, there would be an appeal to the Tribunal in the reverse situation (e.g. if a controller thinks that the ICO has placed too much emphasis on individual privacy rather than economic objectives when enforcing the DPA2018).

Make no bones about it: the proposals for “Reform of the Information Commissioner’s Office” comprise a power grab to influence (or determine) what the Commissioner’s duties and priorities should be.

Finally, the independence of the UK’s data protection regulator is wholly undermined by these proposals (as shown below).  This has the potential to have a knock on effect with respect to the Adequacy Agreement signed with the European Commission.

The proposals can be found at Chapter 5 of the DCMS Consultation document “Data: a new direction”  (the “Consultation”).

Wider role for ICO

The ICO’s mission statement on its website reads: the ICO is “The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals”.  Notice the wider factors mentioned in the Summary Introduction (e.g. economic considerations) are not mentioned as part of the current mission statement.

So, I was a bit shocked when I read in the ICO’s response to the Consultation, that she already considers her role to be a “whole economy and public sector regulator with extensive domestic and international responsibilities”.  First impression: this was a very grandiose and self-inflated job description especially when all the ICO’s powers (if they were actually used) relate to the data protection regime in the UK.

I have subsequently discovered the Government designated the ICO as having a duty to consider the desirability to promote economic growth four years ago, using powers under Section 108 of the Deregulation Act 2015.  The detail can be found in “The Economic Growth (Regulatory Functions) Order 2017”;  the ICO was one of over a hundred regulators identified in the Order.

Only the data protection functions of the Commissioner are subject to the new economic consideration (i.e. the FOI functions of the ICO are not so constrained); the Equality and Human Rights Commissioner is not constrained at all.

The latter is curious given that data protection is linked to A.8 of the European Convention on Human Rights; so I suspect there may be legal arguments based on the degradation of that A.8 right, that the ICO should not have been included in the list of Regulators subject to S.108.

Neither debate nor discussion

As is usual when Ministers use such powers, Parliament does not debate the main issues; the debate approving the change to a hundred regulators’ duties lasted half an hour and did not specifically mention the ICO.

However, it did cover the important issue of what happens if a Regulator is challenged by an individual if the Regulator considers the duty to consider economic factors prevail over the objective of protecting an individual.  Which one takes precedence? Economy or protection?

I have put in [square brackets] the data protection context to show what the Minister said:

“We want to see regulators balance their regulatory purpose with their duty to promote growth. …. While, in principle, it is possible for a legal challenge to be brought [e.g. by an individual using Judicial Review (JR) to claim that the ICO has the balance between economy and privacy wrong], the statute and the regulations require that regulators have regard to the desirability of promoting economic growth”.

“Providing a regulator does so, a legal challenge [i.e. the JR action taken by the data subject] would fail, so there is no real prospect of a court being asked to consider the particular balance being struck by a regulator.”

“That balance is up to the regulator [e.g. the ICO]  and if they have good reason for their decision—if they have considered their duty to promote economic growth but concluded that, on that occasion, it is trumped by another of their other duties [e.g. to protect the data subject] they will merely have to demonstrate that reasoning” (column 10 of the debate; see references).

So even before we look at the Consultation’s provisions, it can be seen that in data protection terms the protection of the data subject has to trump the duty with respect of the economy.

The convoluted wording (“A person exercising a regulatory function [e.g. the ICO] to which this section applies must, in the exercise of the function, have regard to the desirability of promoting economic growth”) is not an accident.  It is also employed in the Consultation and deliberately designed to reduce the prospect of the ICO being subject to a successful Judicial Review challenge.

Additionally,  there is no Appeal to the Tribunal by a data subject against the ICO’s actions; this is thanks to S.166 of the DPA2018 which the ICO relies on if challenged.  The data subject is thus effectively limited to Court action in relation to data subject’s rights (i.e. a Compliance Order) or maladministration on the part of the ICO via the Parliamentary Ombudsman.

In other words, the data subject is almost bereft of options under the data protection regime if the ICO gets it totally wrong.

New duties and powers

When reading the following list of duties and powers, remember the Minister has already told Parliament that the ICO’s new duties trump the data protection ones.

First, “the government proposes to introduce a new, statutory framework that sets out the strategic objectives and duties that the ICO must fulfil when exercising its functions” (para 321; my emphasis on must).  Evidently the UK’s supposedly “independent” ICO must fulfil the objectives and duties set by Ministers.

The Consultation explains how Ministers will set the ICO’s agenda: “As the ICO's role becomes increasingly important for competition, innovation and economic growth, this strategic framework should empower the ICO to take greater account of impacts in these other domains as it supervises and enforces the UK's data protection regime” (para 321; my emphasis).

The use of the word “empower” is classic doublespeak: it means the ICO is required by law to consider issues unrelated to data protection (e.g. “competition”).   For example, suppose the ICO finds another industry (e.g. like Adtech) that is flagrantly breaking the data protection law (which Adtech has), the “empowerment” to consider “competition, innovation and economic growth” could well prevent the ICO from taking enforcement action to protect data subjects on these grounds.

Secondly, “the government proposes to introduce a power for the Secretary of State for DCMS to prepare a statement of strategic priorities to inform how the ICO sets its own  regulatory priorities.” (para 322).   This spells out how the ICO has to follow the Government’s strategic priorities rather than the ICO’s own regulatory practices.

This is reinforced in para 345 which is unequivocable: “The government proposes to introduce a new power for the Secretary of State for DCMS to periodically prepare a statement of strategic priorities to which the ICO must have regard when discharging its functions”.  These powers exist to ensure the ICO “toes the line”.

Thirdly, “the government proposes to strengthen the ICO’s existing obligations by placing a new duty on it to have regard for economic growth and innovation when discharging its functions.”.  As the Minister explained to Parliament (see above), these duties to consider “economic growth and innovation” can determine that powers to protect privacy are not exercised.

Fourthly, “the government proposes to introduce a duty for the ICO to have regard to competition when discharging its functions”.  For example, suppose a controller would be put at a significant competitive disadvantage by having received an Enforcement Notice that requires the deletion of personal data.  Such a controller would be able to Appeal to the Tribunal that the Notice did not properly take into account the economic, innovation or competition grounds (none of which relate to data protection).

As a reminder, even if the ICO makes a catastrophic error in performing the balancing act between competition and privacy, the data subject cannot appeal to the Tribunal concerning the ICO’s outcome of that balancing act (thanks to S.166 of the DPA2018).

Fifthly, “the government proposes to include, as part of the new framework of objectives and duties, a new statutory objective for the ICO to consider the government's wider international priorities when prioritising and conducting its own international activities” (para 349).  Rough translation:  as the UK is seeking trade deals with certain countries,  the ICO should not rock the enforcement boat if there were to be some dodgy transfers to such countries.

Sixthly, “the government is proposing …the need for the ICO to have due regard to public safety when carrying out its functions”.  So suppose an UK controller (e.g. police; local authority) is processing of CCTV images in breach of data protection obligations.  The duty to consider public safety factors might mean that the breach of the data protection law caused by CCTV surveillance system might not be enforced on public safety grounds.

Degrading the ICO’s mission statement

The degradation of the ICO’s enforcement role is illustrated by the government proposals “to introduce a new overarching objective for the ICO, in addition to its other functions, tasks and duties”.  These “overarching objectives” omit important data protection considerations from the data subjects’ perspective.

The two elements of this “overarching objective“ read like a new mission statement for the ICO; they comprise an attempt to wallpaper over the cracks caused by weakening the ICO.  The Consultation says that the ICO’s objectives are:

• Upholding data rights: this ensures “the ICO can monitor the application of data protection legislation, uphold the data rights of individuals, and safeguard personal data from misuse”.
• Encouraging trustworthy and responsible data use: this ensures “the ICO will uphold the public's trust and confidence in use of personal data”.

The best thing I can do, is edit the above to remove the obvious omissions so you can appreciate the gaps.

These editorial changes are mainly to do with the words “objectives” (it is not clear whether “objectives” trump a “duty”?), the limitations associated with the word “misuse” (this should refer to the word “processing” which is far broader in scope) and the absence of any mention of an objective to explicitly protect data subjects.

My reworded overarching objectives (with added words underlined or [deleted]) reads as follows:

• Upholding data rights: this ensures “the ICO has a duty to monitor and enforce the application of data protection legislation, uphold the data rights of individuals, and to  safeguard the privacy interests of data subjects [personal data from misuse] ”.
• Encouraging trustworthy and responsible data processing [use]: this ensures “the ICO has a duty to [will] uphold the public's trust and confidence in [use] the processing of personal data”.

Anything less than the above change to the text of the overarching objectives is not worth considering.

Further fettering the ICO’s role

The government “proposes to give the Secretary of State for DCMS a …power to give the Secretary of State a 40-day period to approve a code of practice or complex or novel  guidance. If the Secretary of State does not approve it, the ICO must not issue it and another version must be prepared” (my emphasis).

Put bluntly, if ICO guidance contains, for example, too much data protection and not enough economy and innovation it can be refused approval; and has to be re-written.  This equates ICO guidance on data protection with school homework which has not been done properly; the Minister marks it for acceptability.  In short, the ICO is not even in control of its own Guidance.

Additionally, to ensure the ICO comes to the “correct” conclusions (e.g. about the economy and innovation),  the government “proposes to establish an independent board and a chief executive officer at the ICO”;  these are intended “to create greater clarity and certainty” in the ICO’s decision making process (which includes the new duties).

The Board and CEO is not appointed by the ICO but by Ministers “via the Public Appointment process”.  The detail in the Governance Code on Public Appointments (Dec. 2016; section 3) explains how Ministers make all the key decisions.  For example:

• Ministers must agree the composition of Advisory Assessment Panels (i.e. Ministers chose the members of the Panel that choses the CEO or Board Members).
• Ministers must be consulted before a competition opens to agree the job description for the role, the length of tenure and remuneration (Ministers set the job spec) and agree how the post will be advertised and the selection process to be used.
• Ministers may choose to appoint someone who is not deemed “appointable” by the Advisory Assessment Panel or decide to appoint a candidate without a competition.

In other words, these new powerful positions (e.g. CEO) could easily be filled by Party apparatchiks, chosen by Ministers for their loyalty to the cause.

Adequacy undermined?

With respect to the ICO’s independence, the Adequacy Agreement with the European Commission states:

The independence of the Commissioner is explicitly established in Article 52 of the UK GDPR which does not make any substantive changes to Article 52(1)-(3) GDPR.  The Commissioner must act with complete independence in performing her tasks and exercising her powers in accordance with the UK GDPR, remain free from external  influence, whether direct or indirect, in relation to those tasks and powers, and neither seek nor take instructions from anyone. (Para 87: Adequacy Agreement).

So three YES/NO questions to conclude with:

1. Is there a “substantive change” to the ICO’s role?
2. Is the ICO “free of external influence” from the Secretary of State?
3. Can the ICO act with “complete independence”?

My answers are: YES to 1; NO to 2 and 3 – and that is why Adequacy could be an issue.

Is this discussed in the Consultation? Of course not.

 

Practitioner Data Protection Courses

Because of continued COVID uncertainty, fuel crisis, or the results at Barnsley FC the course can be attended in person, or via Zoom, or as a mixture if you something untoward happens: it's up to you.

• The Data Protection Foundation Course is in London, and starts Tuesday, November 16 (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]
• The Data Protection Practitioner Course is in London, and starts Monday, December 6 (5 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]

References

Details of the ICO’s wider “economic” role were spotted via the Information Rights blog of Jon Baines:  https://informationrightsandwrongs.com/2021/02/06/ico-statutory-duty-to-promote-economic-growth/

Parliamentary Report from the Delegated Legislation Committee on the Draft Economic Growth (Regulatory Functions) Order 2017 (28 Feb 2017): https://hansard.parliament.uk/Commons/2017-02-28/debates/720823d2-233c-4ece-921a-0069ca0e2c9e/details

A bonus: the DCMS did not telling the CCTV Surveillance Commissioner about the Consultation: amusing but angry response on https://www.gov.uk/government/publications/data-a-new-direction-commissioners-response/dcms-consultation-data-a-new-direction-response-by-the-biometrics-and-surveillance-camera-commissioner-accessible-version

Government propose to reduce DP accountability requirements to OECD standards

The Government intend to change the accountability arrangements in the UK_GDPR in such a way that it will become harder to hold controllers to account.  In summary, Chapter 2 of the DCMS Consultation document (“Data: a new direction”) makes two main proposals in relation to accountability:

• to reduce or remove the requirement to undertake DPIAs (A.35 and A.36); to reduce or remove the requirement to have a Data Protection Officer (A.37-A.39); to remove the need to create a register of processing activities (ROPA; A.30); and to reduce the need to report a data breach to the ICO (A.33).
• for each controller to develop its own privacy management programme which includes many of the accountability elements similar to those identified in the previous bullet point above.

This is a huge topic so I am splitting my commentary into two blogs; this blog deals with the privacy management programme and the proposal to remove or reduce the DPO role.  The next blog will deal with the rest (e.g. ROPA, data breach reporting).

As with previous blogs, there is a lack of evidence in the Consultation that shows the need for change.

So what is accountability?

If accountability is being changed, what is it being changed from?  I think it best to let the ICO spell it out. In a speech (17 Jan 2017), Ms Denham said:

“But arguably the biggest change [in the UK’s DP regime] is around accountability.

The new legislation creates an onus on companies to understand the risks that they create for others, and to mitigate those risks. It’s about moving away from seeing the law as a box ticking exercise, and instead to work on a framework that can be used to build a culture of privacy that pervades an entire organisation…..

… The GDPR mandates organisations to put into place comprehensive but proportionate governance measures. Good practice tools that the ICO has championed for a long time - such as privacy impact assessments and privacy by design - are now legally required in certain circumstances.

It means a change to the culture of an organisation. That isn’t an easy thing to do, and it’s certainly true that accountability cannot be bolted on: it needs to be a part of the company’s overall systems approach to how it manages and processes personal data.

But this shift in approach is what is needed. It is what consumers expect. The benefit for organisations is not just compliance but also providing an opportunity to develop the trust of its consumers in a sustained way.”

So, according to the ICO, compared with previous DPA1998 and DPA1984 regimes,  the GDPR mandates; “proportionate governance measures”, “good practice tools that the ICO has championed for a long time” and “moves away from seeing the law [a reference to the DPA1998 and DPA1984} as a box ticking exercise”.  Above all “accountability cannot be bolted on” at the end of a project; it’s integrated into project development.

Yet the Consultation claims that better data protection outcomes are achievable, not by having statutory accountability objectives, but instead, by adopting non-statutory objectives similar to those found in the previous DPA1998 and DPA1984 regimes.

It is noteworthy that the Consultation claims (para 139) that the statutory requirements of the UK_GDPR “tends towards a ‘box-ticking’ compliance regime”.  Yet the ICO says a non-statutory approach towards compliance under the previous DPA1998 and DPA1984 regimes created a  “box ticking” mentality.

So who do you trust on box-ticking and improved accountability?  A Government which as a matter of policy has always wanted to diverge UK data protection from European standards, or the UK’s data protection regulator reflecting on the experience of 35 years of data protection law?

What is a privacy management programme?

Central to the new accountability regime is a privacy management programme.  Such a programme is a set of data protection policies and procedures which, according to the Consultation, could be subject to enforcement if it were unfit for purpose.

Such a programme is claimed by the Consultation to provide “a more flexible and risk-based accountability framework” as it is produced by each controller.  Advice as to what a privacy management programme “must” include (note the must!) is given in the Consultation document (para 156).  Note providing this must do list is not the responsibility of the ICO.

The use of the word must in relation to the proposed privacy management programme raises the question: “has anything really changed?”. For instance (see para 156):

• instead of a mandatory DPO, there will be designated responsible “individual(s) for the privacy management programme and overseeing data protection compliance” (e.g. this could be a devolved data protection role with a specified individual in each part of the controller as was commonplace under the DPA1998 and DPA1984).
• Instead of a mandatory ROPA, there will be a “personal data inventory which will describe and explain what data is held, where it is held, why it has been collected and how sensitive it is” (i.e. replace one inventory with another).
• Instead of a DPIA, there will be a requirement to use “risk assessment tools for the identification, assessment and mitigation or privacy risks” (i.e. replacing a risk methodology associated with a DPIA with another risk assessment methodology, yet to be invented).

This, the Consultation claims, allows it “to remove some of the unnecessarily prescriptive or burdensome requirements” (i.e. the ones in A.30, A.33, A.35-A.39).

Yet at the same time the Consultation admits that “the introduction of privacy management programmes may create additional burdens for organisations arising from increased discretion as to how to deliver compliance within the new accountability framework” (my emphasis in para 182).

Barrier to protect or barrier to progress

So either way, one concludes that any data protection regime creates burdens, but this has always has been the case (something which the Consultation overlooks).

The prime objective of data protection is to protect the data subject’s personal data by creating barriers that a controller has to overcome (e.g. if a controller wants to process personal data for something else).  Barriers are designed to protect and get in the way; a flood barrier in a zone that may be flooded might block a road, but no one says remove the flood barrier.

Data protection barriers protect data subjects, and overcoming barriers create burdens, and overcoming burdens is burdensome.  Remove the barriers, reduce the burdens risks reducing the protection for data subjects.

That explains why any removal of barriers has to be justified and evidence based.  There is nothing in the proposal for a privacy management programme which gives me reason to believe that such evidence exists.

Instead the Consultation wants to readers to believe in Cakeism: that is the religion that emerged during the Brexit debates.  In this case, without providing any evidence, the belief that data subjects can have a higher level of protection with reduced burdens for controllers.

No role for the ICO

It is surprising that the Consultation does not specify a role for the ICO in identifying the content of a privacy management programme or the new accountability arrangements in general; the provisions in Canada, Singapore, New Zealand and Australia evidently take precedence (see para 154).

This is reinforced by the Consultation which reduces the ICO’s input into the content of a privacy management programme to be available “to organisations lacking the capacity or expertise to design their own accountability practices” (para 150).  This carries the obvious inference that many controllers can develop their own privacy management programme and can more or less ignore the ICO’s guidance on this subject.

Finally, I note that advice on how to “create a comprehensive privacy management programme” forms part of the ICO’s Accountability Framework (which is mentioned by the Consultation in passing and only in the context of a data breach; para 183). Somehow, this advice does not get a look in.

Why is the ICO deemed to be so unimportant here?  I would have thought the ICO would be hopping mad about being effectively excluded from the design of the very important accountability regime.  Her response to the Consultation is very acquiescent in this regard (see references).

What is the impact of the changes?

In effect, all that is happening is that a set of statutory requirements of the UK_GDPR (e.g. in A.30, A.33, A.35-A.39) are being incorporated as components of a mandatory, but non-statutory, privacy management programme.

In addition, every controller is ploughing its own furrow with regard its own privacy management programme where the ICO’s views can be excluded from the programme’s content.  To my mind, this is not a recipe for improved data protection management; it is a recipe for inconsistent compliance as many controllers go off on a frolic of their own when deciding how their own programme is implemented.

Similarly, if the DPO function can be devolved to several individual(s), that is a recipe for inconsistent delivery of advice, procedures and accountability.  I suspect many readers who experienced the DPA1998 or DPA1984 would be able to vouch for how fragmenting data protection responsibilities does not work.

The proposed changes protect a controller from enforcement.  The UK_GDPR allows a breach of the requirements in each of A.30, A.33, A.35-A.39 to be enforced separately; the Consultation proposals require that the privacy management programme to be so deficient it can be enforced as a whole (the latter being a more difficult).

In summary, I don’t think the DCMS has any evidence to substantiate any change to the current accountability arrangements – that is why the Consultation calls for “evidence” with every question about the proposed changes.

In addition, the ICO has not enforced any accountability obligation since 2018 so there is no case-law that provides a clue that something is obviously wrong with the current accountability arrangements (e.g. unlike say with Durant in the DPA1998 where the definition of “personal data” was narrowed too far).

I was under the mistaken belief that when Government proposed legislative changes, it already had the supporting evidence.  Not in this case evidently.

No private sector DPOs

As shown below, the Consultation makes several mistakes and omissions when explaining its DPO proposals.  It follows that if its arguments are misleading then its conclusions are suspect, then DPO removal or reduction cannot be justified in terms of the official reasons provided by the Consultation.

The Consultation states that the private sector needs a DPO when “certain types of processing” occur (para 161).  A precise (and less sinister) description of these “certain types of processing” would refer to “core activities” that involve the processing of “large scale” special category of personal data or “large scale” criminal offence personal data, or involve systematic or regular surveillance of data subjects on a “large scale”.

The omission of “large scale” and “core activities” plus the use of “certain types of processing” suggest to the reader that more DPOs are needed when, in practice, the current statutory requirement for a DPO is relatively limited.  The Consultation does not provide one example of a DPO being appointed when there was no statutory requirement to appoint one. Important evidence to support the proposed changes is therefore missing.

The Consultation then goes on to state that “Some organisations may struggle to appoint an individual with the requisite skills and who is sufficiently independent from other duties, especially in the case of smaller organisations” and as a result “The government therefore proposes to remove the existing requirements to designate a data protection officer” (para 162-163).

There are at least two things wrong with these two statements.  “Smaller private organisations” would need a DPO only if they were engaged, for example, in large scale and systematic surveillance or the processing of large scale criminal records or health data and these were “core activities”.

Such small organisations, I contend, do not exist in large numbers; the Consultation gives the impression they do.  It is noteworthy that the Consultation does not provide a single example of any such small organisation.

Secondly, when there is a shortage of DPO skills, the Consultation proposes to do away the requirement to have a DPO.

This argument is wholly specious.   For example, does the Government solve the shortage of HGV drivers (or brain surgeons or whatever) by removing the obligation to have the “requisite skills” to become a HGV driver (or brain surgeon or whatever)?

In general, I suspect the need for the appointment of a DPO in the private sector has been worded in order to provide the answer the Government wants:  that many controllers will strongly agree that DPOs are not needed (even though the respondents themselves don’t have to appoint a DPO).

Finally, the idea to abolish DPOs on the basis of a skills shortage shows that how low the Government values the skills of the data protection profession.

No public sector DPOs

With respect to the public sector, the Consultation fails to explain that the mandatory DPO requirement arises from the fact that many public authorities have the powers to demand vast quantities of personal data, or that thousands of data subjects have little choice but provide personal data if they want services from a public authority.

Additionally, the Consultation omits that certain small public bodies (e.g. Parish Councils) have been defined not to be public authorities (see S.7(3) of the DPA2018) with the result that such public bodies do not need a DPO.   Indeed, S.7(4) of the DPA2018 provide powers that can be used to add to the list of public bodies defined not to be public authorities (i.e. no DPO needed).

It is surprising that the fact that these powers exist is wholly omitted by Consultation; expanding the current list of small public authorities from the need to have a DPO is the obvious way of resolving any problem.

Finally, the Consultation does not provide a single example of a small public authority that does not need a DPO.  The evidential base is again deficient.

Motive for change

The Consultation, with all its emphasis on the data protection regimes of Singapore, Canada and Australia reveals a possible motive for change: it is to reduce UK_GDPR standards closer to those set out in the “OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data”.  Removal of A.30, A.33, A.35-A.39 is consistent with that motive.

Such a move would support the UK’s application to become a member of Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP) whose members include (guess who?) Australia, Canada and Singapore.  Part of the negotiation could be the promised use of powers of the Secretary of State under S.17 of the DPA2018 to determine that CPTPP countries are adequate.

If my suspicions are correct, all the talk in the Ministerial Forward about “maintaining the UK’s world-leading data protection standards” is complete twaddle.  Instead “it’s the economy, stupid": the UK desperately wants trading partners not hitched to the European standards of data protection.

It’s not quite “if you buy our Yorkshire Puddings, the UK will chuck in a adequacy determination” but it is a step in that direction.

With that in mind, I propose the UK_GDPR should be renamed the UK_OECD.

Data Protection Practitioner Course (late Autumn)

Because of continued COVID uncertainty, fuel crisis, or the results at Barnsley FC the course can be attended in person, or via Zoom, or as a mixture if you something untoward happens: it's up to you.

• The Data Protection Foundation Course is in London, and starts Tuesday, November 16 (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]
• The Data Protection Practitioner Course is in London, and starts Monday, December 6 (5 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]

References

• ICO on Accountability: https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2017/01/gdpr-and-accountability/
• ICO privacy management programme is part of her Accountability Framework: https://ico.org.uk/for-organisations/accountability-framework/
• ICO response to the DCMS Consultation: https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2021/10/response-to-dcms-consultation-foreword/

Government propose to tip the scales in the controller’s legitimate interests

The Government proposes that the “Legitimate Interests” balancing test between controller and data subject in A.6(1)(f) is changed so that the controller’s legitimate interests always prevails in a limited number of pre-defined circumstances.

As far as I can see, this proposal is based on a false data protection analysis and illustrated by examples that show that no change is needed.

If the controller’s legitimate interests always prevails, it follows that the data subject’s right to object to the processing and other related rights are also negated.  The impact of these negated rights is missing from the DCMS analysis.

In short, if enacted, this proposal will take away rights of those data subjects who could face substantial distress by the processing of their personal data.  The proposals are found in section 1.4  of the DCMS Consultation document (“Data: a new direction”).

How the “balance of interests” works

The balance of interests test found in Article 6(1)(f) of the UK_GDPR states that personal data can be lawfully processed when the ...

“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject….” (my emphasis).

There are four important observations about Article 6(1)(f):

• the legitimate interest lawful basis is a “safety net” lawful basis for the controller/third party if the processing cannot be justified in terms of any other lawful basis (e.g. necessary for a contract with the data subject, legal obligation, public interest task).
• the legitimate interest of the controller/third party cannot be an interest that causes significant detriment to the data subject’s interests (as the data subject’s interests will override those of the controller). The controller/third party interest thus has to be an uncontroversial interest which any data subject can see as being legitimate and reasonable (e.g. profitability, efficiency of the controller).
• the legitimate interest of the controller/third party does not negate the interests of the data subject in preserving his/her privacy, data protection rights and does not cause, for example, unwarranted distress to the data subject.
• the processing of personal data has to be necessary to pursue that legitimate interest (i.e. the processing cannot be excessive in achieving that legitimate objective; any processing has to be proportionate).

Note that the controller’s legitimate interests have to be overridden by the interests of the data subject if the data subject’s interests are to prevail.  So one can see that the balance of interests is initially tipped in favour of the controller.

It follows that if the controller’s interests are not overridden then the processing is lawful. More importantly, if there is no impact on, or significant detriment to, the data subject, the processing by the controller can also occur lawfully.

Secondly, use of this lawful basis expects that the “fundamental rights and freedoms of the data subject” to be protected.  This is achieved by complying with the UK_GDPR.  For example, the controller/third party:

• establishes procedures that deal with data subject’s rights;
• complies with the Principles (data minimisation, accuracy, purpose limitation, retention and security); and
• is transparent, accountable and meets other obligations (e.g. DPIA if required).

The real problem when using this lawful basis arises as the controller is not in a position to recognise all the relevant “interests” of the data subject.  The controller can have a good guess at what these interests are, but in general, the controller cannot identify the specific circumstances, unique to the data subject, that are likely to cause unwarranted distress to the data subject etc as only the data subject knows what these are.

This explains why the right to object in A.21 is so important.

Adding the right to object

The right to object in A.21 allows each data subject to inform the controller of grounds relating to his/her specific circumstances (which the controller is not in the position to identify).  The objective is for the controller to repeat the balancing test for this specific data subject when given this new information. If the revised balance is in favour of the data subject, then the processing ceases for that specific data subject.

For example, suppose a controller is placing details of employees on the intranet to facilitate efficient contact at work (the controller’s legitimate interest).  Suppose further a particular employee has a security problem that emerges following the intranet posting (e.g. a woman has escaped from a violent relationship).

That woman could exercise the right to object to the processing and get her details (and only her details) removed from the employers intranet site (e.g. as she does not want friends of her abuser who work for the employer to tip off the abuser).

Other rights (A.18 and A.19) augment the right to object (A.21). All these rights do not feature in the Consultation’s analysis yet as explained above they are central to the legitimate interests test.

Other issues with the DCMS analysis

The Consultation states that many controllers have found the balancing test difficult to perform; it reports that:

“When relying on legitimate interests as a lawful ground, the UK_GDPR requires organisations to show that the processing is necessary and to document how their interests outweigh the rights of data subjects. Assessing whether the organisation’s interests outweigh the rights of individuals appears to cause the most uncertainty for data controllers” (para 58; my emphasis)

Note that the above quote assumes the controller’s interests have to outweigh the data subject’s whereas the lawful basis itself is founded on the reverse assumption (i.e. the data subject’s interests have to outweigh the controller’s).

Additionally, the Consultation also does not mention that the same balancing test was incorporated into the First Data Protection Principle of the DPA1998; hence the Consultation is reporting difficulties that, presumably,  have encountered by these controllers for at least two decades.

What do you think would happen if a driver was stopped by the police for going through a red traffic light, and explained the error as follows: “Do you know what?  I have had difficulty with this part of the Highway Code for 23 years now; the Code must be wrong”.

Yet the Government is basing its proposals on comments like this from controllers. This just adds to my view that the DCMS analysis in this area is incomplete and the product of this analysis suspect.

Examples of the new approach

The Consultation suggests several examples where the legitimate interests of the controller will always prevail (paragraph 61).

Several of these examples do not have any measurable impact on the data subject so it follows that the legitimate interests of the controller would prevail without any change in the law (e.g. when correcting bias in AI systems, enhancing security perhaps by using pseudonymised personal data,  making personal data anonymous, improving services or safety of a product, business innovation, efficiency).

Other examples listed are better justified using lawful basis other than Article 6(1)(f) (e.g. disclosures of personal data to third party authorities; statutory public consultation, delivery of statutory notices, public health messages).

Even if Article 6(1)(f) did apply in disclosure to an authority, the third-party’s legitimate interest would inevitably prevail.  For instance, what do you think if the data subject said: “the police should not have received the personal data because my interests in not being apprehended for a crime, outweigh the police’s interests in pursuing an investigation?”.

One example is a requirement of the Accuracy Principle (e.g. maintaining accuracy of a database) – so I am ignoring it.

However, a few examples listed (e.g. “business innovation”, “improving” service delivery) could be interpreted as straying into a marketing or market research purpose.  If such straying occurred, then the right to object to marketing, whether data subject consent for the marketing purpose is required, and transparency obligations would become data subject “rights and freedoms” that would have to be addressed prior to relying on A.6(1)(f).

However, I am concerned that some respondents will read these elements of the Government’s list as including marketing-type initiatives and will respond enthusiastically in favour of them, especially as the data subject's right to object is negated.

This uncertainty adds to the unreliability of the evidence collected in support of the proposals in Section 1.4 of the Consultation.

Singaporean Model (debt recovery)

It appears the Government might emulate Singaporean DP law to say that debt recovery is always in the legitimate interest of the controller.  This allows me to show why this could cause severe problems for a few data subjects.

Suppose someone “does a runner” and fails to pay for a service and the controller starts debt recovery processing.  Do you think the data subject’s interests will be able to prevail with the following argument: “the controller should not process my personal data because my interests in not paying outweigh the controller’s interests in being paid for services I have used?”.  Can we agree that the right to object will not prevail?

However, suppose the controller has mixed up personal data so there are two data subjects with the same name and very similar addresses whose personal data are confused, so much so, that one data subject is being pursued remorselessly (i.e. harassed) for the debts of the other data subject.

Suppose further the controller fails to take any notice of the data subject who has been pursued for the debt (who will probably make repeated representations about not being responsible for the debt).  I should add this kind of problem has happened in the UK..

In these kinds of circumstances, the UK_GDPR permits a data subject to exercise three rights in A.21, A.17 and A.18.  The essence of the letter to the controller is as follows:

“Your failure to identify the correct data subject with a debt is causing me so much grief that I am exercising my right:

• • to object to the processing of the debt information; (A.21)
  • to restrict your processing until you have completed the necessary rebalancing test in accordance with A.18(1)(d); and
  • to obtain a list of recipients to whom your rubbish personal data have been disclosed” (A.17).

If the Government’s proposals are enacted, this protection for data subjects who experience these kinds of extreme circumstances is gone.

Concluding comment

At the beginning of the blog I said that the DCMS proposals “if enacted will take away rights of those data subjects who could face substantial distress by the processing of personal data”.  The debt example above makes this statement understandable.

In most circumstances the DCMS has identified, the legitimate interests of the controller will prevail and no change in the law is needed.  However, there may be a specific and rare combination of circumstances where the data subject’s interests should prevail. 

After all, there are 60 million data subjects in the UK and it is reasonable to expect that all sorts of mysterious combinations of circumstances will interact with any controller’s processing of personal data.

The proposals that a controller’s legitimate interests should automatically prevail do not simplify the law.  They expose a few data subjects to suffer unwarranted substantial distress and who are left to swing in the wind.

So the answers to Q1.4.1 and Q1.4.2 are strongly disagree for the reasons above; Q1.4.3 is that no change is needed to safeguard the data subject’s interests.

Data Protection Practitioner Course (Autumn)

Because of Indian variant, fuel crisis and the continuing COVID pingdemic uncertainty, the course can be attended in person, or via Zoom, or as a mixture if you get pinged (it's up to you).

• The Data Protection Foundation Course is in London, and starts Tuesday, November 16 (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]
• The Data Protection Practitioner Course is in London, and starts Monday, December 6 (5 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]

UK plans for incompatible processing undermines data protection for individuals

This blog is limited to commentary on the Government’s proposals for the Further Processing of personal data found in section 1.3 of the DCMS Consultation document (“Data: a new direction”).

In summary, the Consultation proposes to exempt the application of the Purpose Limitation (or Finality) Principle whenever there is an important public interest in the further processing; this further processing could be undertaken by a controller different to the one that collected the personal data. 

As this blog shows, the meaning of “important public interest” is left deliberately opaque and many important data subject safeguards are negated.

As much scientific research (e.g. a national cancer registry) will be judged to be in the important public interest,  these provisions in section 1.3 are very relevant to most researchers.

In my view, if anything causes the European Commission to pull the plug on its UK adequacy determination, the implementation of these section 1.3 proposals will carry a significant part of the blame.

Purpose Limitation – what is it?

If one considers the Purpose Limitation Principle (“Personal data shall be collected for a specified, explicit and legitimate purpose and not further processed in a manner incompatible with those purposes”), it can be seen that the Principle protects the data subject from a controller saying one thing about the processing of personal data at the time of collection and, in future, doing something else completely different with the personal data.

Notice the key word used in the Purpose Limitation Principle is “incompatible” and not “different”.  For a processing purpose to be “incompatible” with the purpose of collection it has to be “very very different” from that purpose specified at the time of collection (e.g. in a transparency or privacy Notice), explicit (e.g. the Notice is clearly explained) and “legitimate” (e.g. the purpose of collection has an A.6 lawful basis).

The proposals in the Consultation document are the complete opposite (e.g. “further processing for an incompatible purpose may be permitted when it safeguards an important public interest”).   This change protects the controller from the data subject so long as the further “incompatible” processing purpose is in the “important public interest”.

So is processing for the “important public interest”  the same thing as the processing for “other important objectives of general public interest” as specified in Article 23(1) of the UK_GDPR especially at A.23(1)(e)?  The answer appears to be NO.

So what’s in Article 23(1)(e)?

The provision in A.23(1)(e) allows for an exemption from all incompatibility considerations if the processing is to meet “other important objectives of general public interest”.  However, the implementation of any exemption has to be “necessary and proportionate measure in a democratic society”  and particular safeguards for data subjects have to be in place; these are set out in A.23(2).

The Consultation’s proposals relating to further processing that is in the “important public interest”, by contrast, do not mention the words “necessary”, “proportionate” nor make any reference to the A.23(2) safeguards.

So is the difference between “other important objectives of general public interest” (as used in A.23(1)(e))  and “important public interest”  (as used by the Consultation) explained?   Answer: No.    Are there examples of “important public interest” provided by the Consultation? Answer: “No”.

It follows that the meaning of “important public interest” in the Consultation has nothing to do with defence, national security, law enforcement, prisons, probation,  court procedures, regulatory action, financial matters, budgets, public health, social security, tax and free speech etc as all these important public interest considerations are already implemented in the UK as exemptions described in Schedules 2 to 4 of the DPA2018.

My best guess is that the term “important public interest” as used in the Consultation is defined as follows: “an important public interest is an interest that a Minister considers may be important to the public”.

I suspect many respondents to the Consultation will not spot the difference between the two “public interest” cases discussed above.  They will think of their own examples of important public interest (e.g. disclosure for tax or money laundering purposes) when responding to the Consultation.  If this suspicion is correct, respondents views on questions Q1.3.1 to Q1.3.4 are wholly unreliable.

Consequences for the UK_GDPR

Setting the navel gazing on the meaning of important public interest etc to one side, it is important to understand the consequences if the proposition (e.g. “further processing for an incompatible purpose may be permitted when it safeguards an important public interest”) ever comes into data protection law.

The lawful basis for such further processing will be A.6(1)(e) – “task carried out in the public interest”.  As there is a lawful basis, the lawfulness test of the first Principle in A.5 is met  (A.5(1)(a)).

In the previous blog, I showed that the processing might not be transparent to the data subject, especially in the context of a further research purpose.  These provisions (described last time)  could be used negate the fairness and transparency limb of this Principle as well; especially if research can be tagged as being of important public interest.

There also appears to be no barrier to including the use of special category of personal data (see Schedule 1 of the DPA2018) or indeed criminal offence personal data in any important public interest processing.  This is because many of the conditions in Schedule 1 are subject to a substantial public interest test which looks very similar to the important public interest test suggested by section 1.3.

The right to object is effectively negated (the processing is in the important public interest remember), as is the right to erasure for the same reason.

If legislation specifies the processing of specific items of personal data to be in the important public interest, this will negate the Principles in A.5(1)(c) and A.5(1)(e).  This is because the legislation specifies that the personal data will be relevant to an important public interest purpose and can be retained for as long as that important public interest purpose exists.

Any residual fairness issue (A.5(1)(a)) will be resolved as part of the new law (i.e. the “challenges to ensure re-use remains fair and within reasonable expectations” will be “taken care of”, and of course the Purpose Limitation Principle will be set aside for reasons of “important public interest”.

Concluding comment

It can be seen that a proposal to change the law around incompatibility has a knock on effect that negates most of the Principles in A.5, provides a lawful basis for the “incompatible” processing, can involve the processing of special category of personal data and diminish the rights of data subjects.

Welcome to another example of the “UK’s world leading data protection standards”, as specified in the Ministerial Forward to the Consultation Document.

Data Protection Practitioner Course (Autumn)

Because of Indian variant, fuel crisis and the continuing COVID pingdemic uncertainty, the course can be attended in person, or via Zoom, or as a mixture if you get pinged (it's up to you).

• The Data Protection Foundation Course is in London, and starts Tuesday, November 16 (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]
• The Data Protection Practitioner Course is in London, and starts Monday, December 6 (5 days); Full details on amberhawk.com/StandardDP.asp or by emailing [email protected]