Hawktalk

Facial recognition CCTV excluded from new data protection law by definition of “personal data”

I have come to the conclusion that the new definition of personal data in the Data Protection and Digital Information No.2 Bill (“No.2 Bill”) only applies to facial recognition CCTV if the data subject is on a watch-list.

If the individual is not on a watch-list, and the camera images are deleted immediately after checking the watch-list, then personal data are not processed and there are no data protection obligations (e.g. no transparency)

It then follows that if the watch-list, for example, involves details of criminals wanted by the police, many facial recognition systems will process personal data in total secrecy (i.e. no transparency).

This blog explains how the No.2 Bill’s definition of personal data moves such facial recognition CCTV systems into the twilight zone.

Suppose a facial recognition CCTV system is linked to a watch-list of suspects whose facial features have already been digitised (perhaps using the digitised biometric images derived from passport photographs).

Obvious examples of such watch-lists are: (a) a list of those who are of interest for law enforcement purposes or (b) those who commit a crime if they enter a specific area (e.g. those who have been excluded from entering a specific shop).

Suppose further, such a CCTV system is set up in a shopping centre and performs facial recognition on everybody who passes any of the system’s cameras.  The system sends a warning message to the camera operator if someone, on the watch-list, passes the camera; the system also retains the relevant images and other details of the encounter.  Only personal data of those on the watch list are retained.

The system is so designed that the details of those who are NOT on the watch list are not retained (i.e. deleted instantaneously) after the check against the watch-list is complete.

Bridges v South Wales Police

The system described above is the one that featured in the Court of Appeal judgement (Bridges v South Wales Police: paragraph 9, see references).  In this case, the data protection regime (in the DPA1998 and the pre-Brexit GDPR/DPA2018) was fully engaged because the Court determined that “personal data” were being processed about every individual whose image was captured by a Facial Recognition CCTV camera.

In the Bridges case, the Court’s interpretation of the definition of personal data was crucial.  This was derived by reference to Recital 26 of the pre-Brexit GDPR (or to Recital 26 of Directive 95/46/EC when the DPA1998 applied). These Recitals specified that if the information processed related to a living individual who was being singled out, then “personal data” were being processed.

Paragraph 46 of the Bridges judgment makes this point clear.  It states:

46. The primary point of dispute before the Divisional Court under the DPA 1998 was the extent to which using AFR Locate [the name used for the Facial Recognition CCTV system] entails processing personal data, SWP [South Wales Police] contending that the only personal data processed is the data of persons on the watchlist on the ground that it is only those persons that SWP can identify by name.

Having referred to the judgment of the Court of Appeal in Vidal-Hall v Google Inc [2015] EWCA Civ 311, [2016] QB 1003, and to the decision of the CJEU in Case C-212/13 Rynes v Urad [2015] 1 WLR 2607, the Divisional Court concluded (at [122]) that the processing of the Appellant’s image by the AFR Locate equipment was processing his personal data because the information recorded by AFR Locate individuated him from all others, that is to say it singled him out and distinguished him from all others.  (My emphasis).

As we shall see, “singling out” is NOT found in the new statutory definition of “personal data” in the No.2 Bill, and it is this omission that has significant consequences (i.e. SWP’s arguments in the first part of paragraph 46 as quoted above become correct).

Recitals are not law

The definition of personal data in the No.2 Bill is at first sight unchanged: “Personal data” means any information relating to an identified or identifiable living individual.  However, the No.2 Bill introduces the concept of direct or indirect identification of the individual into the statutory definition.

This new statutory definition, which also does not meet the standard of the Council of Europe Convention No 108 set in 1981 (see references), makes sure that the interpretation in Recital 26, as used in Bridges), is largely redundant.

This is because the Recitals themselves have no legal effect in the UK.  This was established in the case of Sanso Rondon v LexisNexis (see references), when the Court invalidated a requirement in Recital 80 (namely “the designated representative [of a controller or processor established outside the UK (or EU)] should be subject to enforcement proceedings in the event of non-compliance by the controller or processor”).

The Court came to this conclusion because the requirement was found only in Recital 80 and was not explicitly linked in any obligation in any Article of the GDPR.  That is why the Court concluded that, in relation to the liability of the representative for non-compliance (e.g. by a controller):

“…if the GDPR had intended to achieve 'representative liability' [for non-compliance as specified in Recital 80] then it would necessarily have said so more clearly in its operative provisions [i.e. the Articles of the GDPR]…(paragraph 101).

In other words, the Recitals are there to help interpret the legislation if there is doubt as to what the statutory requirements in an Article mean.  If a provision described in a Recital is not echoed in a relevant Article, then the interpretation in the Recital can be invalid.

In summary, the requirement for “singling out”, although it remains in Recital 26, it is not supported by any “operative provisions” found in the new statutory definition of “personal data”.  To the contrary, the new “operative provisions” of the definition work to exclude any prospect for “singling out”.

DPDI definition of “personal data”

The No.2 Bill additionally requires that to be “personal data”, there has to be a living individual who is directly or indirectly identifiable; in the latter case, indirect identification has to be at the time of the processing and by using reasonable means.

This raises three additional questions to be answered before the processing of “personal data” by a CCTV system, similar to that under discussion, can be confirmed.

The first question is:  ‘Are individuals identified “directly”?’.  The No 2 Bill requires that “An individual is identifiable from information “directly” if the individual can be identified without the use of additional information”.

Clearly, in the case of facial recognition CCTV, the answer is NO.  This is because additional information has to be used to perform the identification of those images captured by a facial recognition CCTV system (e.g. the pre-recorded details of those on the watch-list).

In other words,  direct identification, is not relevant because identification of a living individual (on or off the watch list) requires "the use of additional information" (contrary to the definition of direct identification).

The next question is: ‘Are individuals identified “indirectly” as defined?’.  The No.2 Bill states that “An individual is identifiable from information “indirectly” if the individual can be identified only with the use of additional information”.

Clearly, the answer is YES as additional information is available as part of the CCTV system to identify those individuals on the watch-list.

But what about those NOT on the watch-list?

This question is answered by the third question in the series: “Is indirect identification easy to do “at the time of the processing” and by “using reasonable means”  (Clause 3A(2) requires “the living individual is identifiable .… by the controller or processor by reasonable means at the time of the processing”).

In this case, for those not on the watch-list, there are no reasonable means of achieving identification available at the time of the processing (e.g. from the time of collection by a camera, checking the watch list, and then its instantaneous deletion).

There are three main reasons for this conclusion:

• first, there is no “additional information” that is available by “reasonable means… at the time of the processing” in the CCTV system itself (or held by some other person);
• second, the image of the individual and related biometrics have been deleted almost instantaneously, so there is no need for additional information to perform the unwanted indirect identification;
• finally it would be unreasonable to ensure the Facial Recognition system retained details of individuals not on the watch-list. The far more reasonable proposition is to protect the interests of such individuals is by deleting their personal details instantaneously, as such deletion guarantees their privacy.  In addition,  the captured details cannot be further processed for purposes other than the original check of “is this individual on the watch-list?”.

In addition, Article 11 of the UK_GDPR specifically states that additional information is not required to be collected.  It says:

A.11(1) “If the purposes for which a controller processes personal data do not … require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation. (My emphasis to show that this is the case when an individual is not on the watch-list).

Hence, there are no data protection obligations placed on those data that concern those whose images are collected and then instantaneously deleted because the individual is  NOT on the watch list.  Quite simply, such a CCTV system does not process personal data (as newly defined) in these circumstances.

The data protection regime of the No.2 Bill only applies to those on the watch list.

Why secret CCTV facial recognition systems?

As a facial recognition system is not processing personal data if an individual is NOT on the watch list,  then there is no need to be transparent as the UK_GDPR does not apply.  There is no need for a lawful basis nor a condition to overcome the processing of Special Category of Personal Data as the information processed is not personal data.

Transparency is only needed for data subjects on a watch list.  However,  there are a number of exemptions in the DPA2018 that provide the controller relief from the need to be transparent if being transparent would prejudice the crime, taxation, immigration or law enforcement purposes etc (e.g. Schedule 2, paragraphs 2 or 4; Section 44 of the DPA2018).  Hence there is no need to be transparent in these cases also.

It follows that many facial recognition CCTV systems can be installed without any transparency obligations and used more or less in secret.  As stated at the beginning of the blog, they enter the data protection twilight zone.

As this is the case, expect the number of Facial Recognition systems to mushroom exponentially after the enactment of the No 2 Bill.

References

Edward Bridges and -the Chief Constable of South Wales Police: Neutral Citation Number: [2020] EWCA Civ 1058

Sanso Rondon v LexisNexis; Neutral Citation Number: [2021] EWHC 1427 (QB)

Definition of “personal data” in DPDI No 2 Bill results in non-compliance with CoE Convention No.108: https://amberhawk.typepad.com/amberhawk/2023/04/definition-of-personal-data-in-dpdi-no-2-bill-results-in-non-compliance-with-coe-convention-no108.html

Data Protection Courses (Summer 2023)

An all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill. Will be held on Thursday 13 July  2023 hopefully to include changes made during the Committee stage of the Bill.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection FOUNDATION Course is on Zoom only (June 20-22, 2023 (Tuesday to Thursday, 3 days: 45am to 5.00pm).
• The next Data Protection PRACTITIONER Course is in London on Monday, 24 July 2023 to Friday, 28 July 2023 (5 days: 9.30am to 5.30pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing [email protected].

Data protection policy should return to the Ministry of Justice

The incoming Labour Government has expanded the role of the Department for Science, Industry and Technology (DSIT) by transferring many IT/data related functions from other parts of Government (mainly the Cabinet Office) into DSIT.  The objective is to make DSIT an important driver for economic growth.

In further detail, “experts in data, digital and AI from the Government Digital Service (GDS), the Central Digital and Data Office (CDDO) and the Incubator for AI (i.AI) [have transferred to DSIT] to unite efforts in the digital transformation of public services under one department” (see references).

The objective is to “transform public services and fuel economic growth through science and technology”.  This “will be the defining mission of a revamped [DSIT] department” and comprise the “first steps towards building a modern digital government”.

However, if such objectives comprise the strategic mission for DSIT, the questions that must be answered are:

• How do these economic objectives interact with DSIT’s approach to data protection policy?
• Will there be a repeat of an approach which viewed data protection as sand in the oil of economic progress and an inhibitor to wider data sharing across the public sector?
• Will data protection policy become subservient to economic priorities?

Historical approach to DP policy

For the two decades from 1984, governmental responsibility for UK data protection policy was very problematic.  For instance, the DPA1984 (and DPA1998) were both a minimal implementation of Council of Europe Convention No 108 (and Directive 95/46/EC) in order to have minimal impact on controllers, the economy and provide the minimal protection for data subjects as compared with European standards.

Any data protection specialist who worked with either the DPA1984 or DPA1998 will remember that both sets of legislation were characterised by a weak regulatory regime, diminished rights and both carried a minimal threat of enforcement.

In addition, both DPAs (and FOIA) were enacted under the auspices of the Home Office, courtesy of its strangely named “Liquor, Gambling and Data Protection Unit”.

This meant that the Home Office, which has the political responsibility for functions that were very invasive of privacy (e.g. law enforcement, national security), were also charged with the responsibility of developing policies for protecting data subjects from such invasion.

It can be seen that this represents a huge conflict of interest.  If you have ever questioned why the data protection or FOI exemptions in these early Acts were very expansive when applied to Home Office functions, the answer is, quite simply, staring you in the face!

However, in 2007, responsibility for Data Protection, FOI, Human Rights and related civil society matters were centralised at the Ministry of Justice (MoJ); a neutral Department of State that did not have a vested interest in the processing of vast amounts of personal data for specific public sector functions like tax, housing, health, policing etc.

In data protection terms, the transfer to the MoJ, lifted responsibility for DP policy from a Home Office which processed large amounts of personal data in support of an opposite policy direction.

Why was the MoJ dropped?

The short answer is Micheal Gove MP, when he became Secretary of State at the Department for Education (DfE) in 2011 and thence Lord Chancellor, at the MoJ, in 2015.

In 2011, a FOI request to the DfE included a request to access information contained in Mr Gove’s Hotmail emails to and from his political advisor (“Mr and Mrs Spad”).  Mr Gove’s Department refused the request on the grounds that the relevant emails were private emails and the requested information was therefore not held by the DfE (as they would have been if the official gov.uk email address had been used).

This was despite the fact that the Hotmail communications related to official DfE business.

The FOI request was refused by the DfE and this was followed by appeal to the ICO and the inevitable Decision Notice in favour of the requestor.  Mr Gove’s Department appealed the Notice but the appeal was withdrawn before the Tribunal hearing.  Much, one assumes, to Mr. Gove’s ire.

All became quiet on the Westen Front, until Mr Gove arrived at the MoJ as Lord Chancellor after General Election in May 2015.  On October 15, 2015 he scattered policy responsibility for IT/data related matters to the winds.

For instance, responsibility for:

• Data Protection was transferred to the Department for Culture Media and Sport (DCMS) and thence to DSIT when this Department was formed by Rishi Sunak.
• Data Protection for law enforcement and national security was, in practice, returned to the Home Office.
• Human Rights law (including Articles 8 & 10) was retained by the MoJ.
• FOI and EIR (including DP/FOI/EIR interface) was transferred to the Cabinet Office.
• IT security for personal data processed by the public sector and the HMG Security Framework was managed by the Cabinet Office.
• IT security for personal data processed by the private sector (i.e. now surrounding the ISO27000 series) was developed by DCMS then DSIT.
• ID for Government Services developed by the Cabinet Office via Government Digital Service.
• Digital Verification Services parts of the defunct DPDI Bill were developed by DCMS then DSIT.
• Artificial Intelligence (i.AI) was launched in July 2023 by the Cabinet Office.

So much for joined up government!

Why a return to the MoJ

The Government’s changes, as announced, represent a partial reconstruction of responsibility for the above bullet points around DSIT (the first and the last four bullets from the list above).

The problem is that DSIT, with its enhanced responsibilities for AI, R&D and other technologies is intended to become an engine room for economic growth.  In these circumstances, data protection can all too easily be seen as an inhibitor (as it was with the previous Government).

The risk is then that DPDI-like provisions will re-emerge to provide wide ranging exclusions to ease the secondary use or disclosure of personal data in support of a turbocharged dash for growth.

To minimise this risk and to ensure that data protection is considered with its proper weight, responsibility for data protection policy should be returned to the MoJ.  Leaving DP responsibility in DSIT risks making data protection policy wholly subservient to its economic priorities.

References

Press release about DSIT’s enhanced responsibilities: https://www.gov.uk/government/news/dsit-bolstered-to-better-serve-the-british-public-through-science-and-technology

Post summer Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London (and Zoom) on Monday, 16 Sept to Friday, 20 Sept (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London (and Zoom) on (October 8-10: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].

New A.17 right to erasure in the UK_GDPR added during “wash-up”

Although the DPDI Bill is dead, you have probably missed the addition to the right to erasure (Article 17 of the UK_GDPR) which was made during “wash-up” period (last month) via another piece of legislation (the Victims and Prisoners Act ["VPA"] 2024).

In summary, the change in the law concerns what controllers do when there is a malicious complaint (e.g. to social services) and the procedure for removing that complaint, following the conviction of the complainant of a stalking or harassment offence and a finding that the complaint was malicious.  Phew, a number of conditions to explain!

The change to the A.17 can be found in Section 31 of the VPA Act; it deals with malicious reporting cases such as those as Stella Creasy (MP for Walthamstow, in London), which was publicised by the BBC. (See references for all relevant details).  The new right does not apply immediately; it has to be "commenced" by the incoming Government at sometime in the future.

The new right to erasure

The  VPA Act adds a new paragraph (g) to A.17(1). 

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay if…….

“…(g) the personal data have been processed as a result of an allegation about the data subject—

1. which was made by a person who is a malicious person in relation to the data subject (whether they became such a person before or after the allegation was made),
2. which has been investigated by the controller, and
3. in relation to which the controller has decided that no further action is to be taken.”

So who is a “malicious person”?  Quite simply a malicious person is a person who has made an allegation about a data subject AND that person has been convicted of a “relevant offence".  All the “relevant offences” are identified and relate to stalking or harassment;  they are tabulated in new Article 17(5) and there are ten such relevant offences.

Relevant offences include, for example, an offence under sections 2, 2A, 4 or 4A of the Protection from Harassment Act 1997 or section 8 of the Stalking Protection Act 2019.  Other legislation tabulated are the Scottish and Northern Ireland equivalent of these Acts, and specific legislation which deals with harassment and stalking offences committed by members of the UK’s armed forces.

Article 17(5) is accompanied with a new section 13A to the DPA2018 which provides an order making power to amend or add to the list of relevant offences via an affirmative resolution process.

When does the new right apply

Suppose male employee X stalks a female member of staff. The female member of staff reports it to HR and because of the seriousness of its preliminary investigation, the police get involved.  Supposes further there is an eventual prosecution of X for a stalking or harassment offence (i.e. a relevant offence) but the employee X’s defence, as explained to HR, involves scurrilous accusations against the victim.

Now clearly, the female victim might want HR to delete these allegations from her personal data. As there has been an investigation by the employer, a successful prosecution for a relevant offence and the employer has taken no further action against the female victim, then the new right applies to her.  However, this right does not apply to employee X, as the harasser/stalker is most likely sacked (where sacking is an “action”).

In summary, as there was an initial investigation before personal data were handed to the police, they can be deleted in relation to the female victim (no action against her) but retained in relation to the stalker (i.e. records can be kept of the reason for the sacking but not relating also to the victim).

Note that the new right does NOT apply to personal data processed by the police as their processing is likely to be subject to Part 3 of the DPA2018 (i.e. law enforcement processing) and not the UK_GDPR.

Enter Stella Creasy MP

Stella Creasy MP has faced such serious but false accusation concerning her children,  and this has influenced this amendment behind the scenes.  In the House of Lords’ debate the MP was thanked “for the amendments they have tabled on this issue, and their engagement with myself and officials in this area”.

In her case, according to the BBC, in 2023 a man told Leicestershire Police that her children should be taken into care due to her "extreme views".  This was followed by the MP reportedly facing a safeguarding review by the London Borough of Waltham Forest.

She was quickly cleared; the BBC reports that the man had objected to the MP breast feeding her newly born baby in the House of Commons chamber.

As there was a formal complaint to Police and it investigated a "number of emails" sent to the MP (presumably in the context of harassment). However, it was this police referral that triggered a statutory investigation by the Borough, and this explains why the Borough could not delete the personal data (even though it the Deputy Speaker of the House of Commons publicly criticised the "appalling abuse and harassment" Ms Creasy had received).

Because individuals can hold views that are wrong, the BBC reported that Leicestershire Police resolved the issue by “a community resolution rather than a formal sanction because the messages did not meet the threshold for a criminal offence”.

Concluding comment

You will note that the new right does not help Ms. Creasy get her personal data deleted, as the BBC report states that no relevant offence has been committed (see added note below).

This could have an unforeseen consequence; data subjects who are falsely accused by a stalker or harasser might put pressure on the authorities to prosecute in order to engage the new right.  This is preferable, from the victim’s perspective, than to allow the offender to be let off by treating the issue as some kind of misogynistic misdemeanour which results in the victim’s personal data remaining on file.

And that might not be a bad outcome.

Note added on 23/6/2024: there is a Times report dated 3rd December 2023 stating that Leicester Police changed their mind about harrassment and "a man from Wigston in Leicestershire, admitted harassment without violence and was given a 14-week prison sentence suspended for one year, in part because of overcrowding in prisons. He was also given a three-year restraining order and will be required to carry out 120 hours of unpaid work". (see updated references below).

References

The Parliamentary debate about the new right to erasure in A.17(1)(g) of the UK_GDPR: https://hansard.parliament.uk/Lords/2024-05-23/debates/CC504D8F-CC76-4EBB-9FF3-09FD1D2C2E74/VictimsAndPrisonersBill

Section 31 of the Victims and Prisoners Act 2024: https://www.legislation.gov.uk/ukpga/2024/21/section/31/enacted

BBC story “Stella Creasy: Call for action after online troll sparked MP probe” https://www.bbc.co.uk/news/uk-england-london-65463367

Times report (3/12/2023) on the re-opened case: "Troll’s harassment of Stella Creasy one of worst cases judge has seen" on https://www.thetimes.com/article/stella-creasy-labour-mp-online-troll-philip-stacey-guilty-0k9mzzmls

Forthcoming Data Protection Courses

The next Data Protection PRACTITIONER Course is in London on Monday, 16  September  to Friday, 20 September (5 days: 9.30am to 5.30pm).  Remember also our specialist DP qualification for those in Education. 

Details from www.amberhawk.com

Labour should not let the DPDI Bill go through in “wash-up”; it should kill it off.

When a Prime Minister calls a General Election, the Official Opposition in Parliament becomes very powerful.  The reason is that the two main political parties can agree to enact outstanding and uncontroversial pieces of legislation (e.g. in this case, before the end of next week – May 30th).  Parts of the DPDI Bill do fall into this uncontroversial category; but many bits don’t.

In summary, the Opposition can say to Government something like; “we will agree to pass the DPDI Bill if you remove Schedule 11 (DWP powers to access bank accounts), the definition of personal data and the new disclosure arrangements in Schedule 1, paragraph 1” etc.  Alternatively something like: “we will let through the DPDI Bill limited to the DVS elements, ICO changes to an Information Commission and  law enforcement transfers of personal data outside the UK”.

This horse trading is called “wash-up”; it is undertaken in smoke filled rooms, out of the public gaze where FOI is a distant dream.

The problem is that the Labour Party is not opposed to the DPDI Bill; so it could agree to enact something from the DPDI.  That explains why privacy NGO “BigBrotherwatch” has launched a campaign to get its supporters to contact Labour MPs to ensure the DPDI Bill has no resurrection.

If Labour seeks the views of the ICO, he will repeat his oft-expressed (and erroneous) view that he supports this Bill as it presents no risk to data subjects (aaargh).

So in my last missive on the lamentable (but unlamented) DPDI Bill, I thought I would list the items that are in my view controversial in the hope that it helps “Kill the Bill.

Weakening data subject protections

The list is not complete but contains the following; all impact on the rights and freedoms of all UK data subjects.

Personal data: this definition is changed to make it more prescriptive (i.e. less personal data are subject to the DPDI Bill).  This definition, which impacts on all the data protection rights and Principles, does not meet the standard set by the DPA1984, CoE No 108 and GDPR and is a risk to the UK’s Adequacy Agreement with the EU.

Lawful basis: the specification of “Recognised Legitimate Interest” legitimises any voluntary data sharing of personal data from any private sector controller to any public sector controller for its public tasks.  In addition, the further purpose of the disclosure is also likely to be deemed compatible with the purpose of obtaining. The data subject’s right to object to such disclosures is much diminished.

As modifications of lawful basis are not possible with the GDPR, this provision is also a risk to Adequacy.

Marketing: “opt-in” (consent) for third party marketing becomes the exception; “opt-out” (legitimate interests) becomes the new norm. This overturns the “opt-in” consent rule for Third Party Marketing established under DPA1984  (40 years ago).

In my view, this change represents a spammer’s charter for Third Party marketing.

Transfers outside the UK: these transfers are legitimised via powers granted to the Secretary of State (SoS) without direct reference to Parliament (as it follows negative resolution procedures). The provisions allow the SoS to identify specific controllers in a certain country as adequate, even though the country itself is not deemed to be adequate.

This also could threaten the Adequacy Agreement if transferred personal data from the UK contains personal data that has originally been transferred from the European Union.

Data subject rights: the presumption that automated decision-taking is prohibited, is removed. This means that automated decisions using Artificial Intelligence (AI) techniques are likely to become the norm in the UK.  There is very little protection for UK data subjects except for making complaints after an AI decision has had an effect on them.

In addition, DPDI specifies that a data subject complaint is first directed to the controller. This will add a further month and a half delay before the data subject can complain to ICO (who often takes 4-5 months to allocate a case-worker).

This means delays of half a year or more concerning an automated decision can be expected.  Such a time delay does not protect the data subject’s interests; it protects the controller’s interests.

Research (RAS) processing: it becomes easier to share personal data for RAS purposes, in the absence of transparency to data subjects, so long as certain safeguards apply (see next bullet). Consent as the lawful basis for RAS is likely to be replaced by “legitimate interests” or “public task”. Existing databases can be used and disclosed for RAS purposes and the “scientific research” definition is expanded to cover AI research and development.

There is a considerable risk that, to facilitate AI research and development,  there will be disclosures of personal databases in the legitimate interest of Third Parties and onward to further Third Parties in their legitimate interests, again in the absence of transparency.  This “Wild West” approach to data-sharing is likely, in my view, to result in major data breaches or significant AI harm to individuals.

Research (RAS) Safeguards: The safeguards for data subjects associated with RAS purposes (mentioned above) are not particularly “safe”. For example, one safeguard is that the RAS disclosure does not cause “substantial damage or substantial distress”; this means that moderate damage or distress is perfectly acceptable to Government.

The Regulator: the ICO becomes an Information Commission where voting members of the Commission are all selected by SoS. Such self-selection puts at risk the regulatory independence of the UK and has knock on implications for the Adequacy Agreement.

Codes of Practice: Codes are still not produced in an independent manner in the UK. Although the SoS does not to approve the final text of a Code (as originally intended), it is possible for the SoS to recommend that Parliament vote down the Code.  As the SoS’s political party form the majority of MPs, the SoS veto over the text of Codes of Practice is maintained.  (btw the ICO thinks the veto has gone).

National security: the SoS can designate personal data processed by the police as being of interest to GCHQ. MI5 or MI6. The result is that the personal data, once designated, move from Part 3 of the DPA2018 to Part 4.  This then means that any processing of designated personal data fall outside the DP enforcement regime.

This reason for this designation mechanism has never been explained. However, it provides an alternative, for example, that could permit a bulk ANPR database that the police use to monitor traffic on UK roads being subject to national security rules for data protection purposes.

Forget bulk data transfers and the statutory restrictions and protections found in Investigatory Powers legislation; instead think designated databases under DPDI Bill and total freedom from ICO regulation.

Codes of Conduct: Law Enforcement Codes of conduct can be produced by expert Law enforcement bodies covering their own processing. If approved by a (SoS compliant) Information Commission, these Codes can specify that the processing described in a Code complies with Part 3 data protection obligations.

The prospect of controllers establishing that their own processing is compliant with DP law, by reference to a Code of Conduct they produced for themselves, is pure Alice in Wonderland.  It obviously risks reducing the protection afforded by data subjects

DWP Powers: the Department for Work and Pensions (DWP) want to obtain financial details from financial bodies to use AI techniques to identify whether any payment to any claimant is correct (e.g. benefit, pension, allowance).  As powers to demand these details when there is suspicion of fraud already exist, these new powers do not need any suspicion of fraud.

An “account information notice” from the DWP can demand details from accounts of those connected to a benefit recipient (e.g. of a family members).  So potentially these powers involve half the UK population (e.g. child benefits; OAPs, benefit recipients).

Even the ICO has identified a likely A.8 ECHR problems (ICO says “I do not think the current drafting is sufficient to ensure this [proportionality]”.  Note the ICO does state the obvious:  that there is lack of an A.6 lawful basis that could be subject to his enforcement powers.

International Agreement: there is a new lawful basis of “necessary for the purposes of responding to a request made in accordance with the Agreement … [between UK and USA Governments] … on Access to Electronic Data for the Purpose of Countering Serious Crime signed 3 October 2019”. This sets a precedent for other similar International Agreements having a similar lawful basis.

Again the ICO is on record as saying this change is unnecessary.

Conclusion

For the above reasons(and more), the data protection elements of the DPDI Bill should NOT be subject to the Parliamentary “wash-up” mechanism.  The Bill should be killed off.

This is especially the case as Government Ministers still claim that this DPDI Bill maintains a high level data subject protection and at the same time eases the load of controller compliance, when this is demonstrably wrong.  Quite simply, this Government cannot be trusted with data protection.

However, before you rest easy, the Tony Blair Foundation has plans for the wider use of NHS data to make large financial gains for UK Plc whilst maintaining the highest degree of patient confidentiality.

“Hang on a second; haven’t I heard this before?”  I therefore suspect that a further DP legislation is on the horizon after the Election.

Forthcoming Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture.

• Data Protection FOUNDATION Course is in London on (July 2-4: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Data Protection PRACTITIONER Course is in London on Monday, 8 July to Friday, 12 July (5 days: 9.30am to 5.30pm).
• Remember our specialist DP qualification for those in Education. Next course on June 11th, 12th & 18th 2024

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].

DPDI Codes of Conduct allow competent authorities to write their own DP rules

If, on April 1^st,  I reported that a cabal of controllers could club together and draft a Code of Practice that establishes their legal compliance with the UK’s data protection regime, you would probably say that this was too far-fetched to be true. Yet this is the procedure that has been put in place by our the Government for all law enforcement processing of personal data.

The grim detail can be found in Clause 68A of the Data Protection and Digital Information (DPDI) Bill.  The production of law enforcement Codes of Conduct (as they are called) does not have to involve any data protection expertise, nor the ICO, nor does the text require Parliamentary approval nor does a Code have to consider its impact on data subjects.

Yet, law enforcement processing often comprises the most sensitive of processing.

In addition, the DPDI Bill’s procedure for Codes of Conduct compares starkly with Codes of Practice (which does involve, by law, data protection expertise, impact on data subjects and the approval of the ICO and Parliament).

How Codes of Practice are produced

The DPDI Bill specifies that the ICO has to reissue the Data Sharing Code of Practice, the Age Appropriate Code, and the Journalism Code to accommodate the changes in the DPDI Bill.  As is well known, the Direct Marketing Code has been held up until the range of non-consensual marketing rules of the DPDI Bill become law.

Additional Codes of Practice can be produced on the instructions of the Secretary of State (SoS).

All these Codes follow the same procedure.  This first involves consultation with the SoS and other specified parties that have an interest in the production of a Code. This could involve a preliminary scoping document covering the need for a Code.

For example, a revised data sharing Code will have cover the voluntary data sharing arrangements for disclosures of personal data from the private sector to public sector controllers arising from the introduction of the “Recognised Legitimate Interest” lawful basis.  The revised Code also has to accommodate the weakened data subject’s right to object to such disclosures using this lawful basis.

The text of Code is first drafted by the ICO.  This is then considered by a panel of experts, chosen by the ICO for their knowledge of the subject; this panel then produces a report on the draft Code.  The panel of experts includes representatives of “persons likely to be affected by the Code” as well as representatives from data subject facing organisations.

This expert panel report can suggest modifications to the draft Code; the ICO can reject or accept some or all of the suggestions. Details of any rejection from the panel of experts has to be made public.  The Code (if modified) is then subject to an impact assessment.

This procedure is also followed for significant amendments to existing Codes.  However, for reasons unexplained, the analysis of a panel of experts can be dispensed with, if the Code is an additional Code produced following instructions of the SoS.

The Code is then submitted to the SoS for comments which are made public (if the SoS has any).  The ICO has a choice: he can reject SoS’s comments;  withdraw the Code, or submit a “revised” Code to accommodate them. The Code is then laid before Parliament by the SoS.

Note that if the ICO rejects the SoS commentary, the SoS can ask Parliament not to approve the Code.  In this way, the SoS still retains the “whip hand” if there is disagreement over the Code’s content.

How Codes of Conduct are produced

Let’s assume there is a need for a Code of Conduct covering facial recognition cameras as used by law enforcement agencies.  How would such a Code of Conduct be developed?

First the ICO identifies “expert bodies” who are “encouraged” to produce a Code.  Note that the identification is of expert bodies and not expert individuals.  In other words, there is no obligation placed on expert body, to choose from its ranks, an individual who has requisite expertise in data protection.  Note also, the expert bodies can reject the ICO’s encouragement.

These expert bodies are then also “encouraged” to submit their Code of Conduct to the ICO in draft.  In other words, the drafting of the content of a Code of Conduct can emerge without any submission of its text to the ICO.

If a draft Code of Conduct is submitted to the ICO, the ICO can express an opinion on a Code, decide to approve the Code, and publish the Code if approved.  Of course, this provision does not apply if the Code is not submitted to the ICO.

There is no requirement for the ICO to publish his or her opinion on a particular Code of Conduct (e.g. to explain why approval was not granted).  Codes that have not been submitted to the ICO for approval can still be published without any commentary from the ICO.

There is no requirement for an Impact Assessment (e.g. impact on data subjects) nor is there a requirement to seek Parliamentary approval of a Code of Conduct’s content.

One can easily see a situation where the ICO does not like a Code of Conduct and expresses some contrary views on its proposals.  The response of the expert bodies could well be to press ahead with that Code of Conduct without any further involvement of the ICO.

This could especially be the case with, for example, if a populist Government wanted to skew law enforcement policy in a specific direction (e.g. wanted facial recognition cameras to target those who have pre-booked seats on flights to Rwanda).

Remember the ICO is to be replaced by a Commission where all the voting members of the Commission are appointed by the SoS.  Additionally, the SoS might express a view that a strong emphasis on law enforcement should be a strategic priority for the Commission.

All these possibilities could put pressure on the Commission to approve the Code of Conduct produced by the law enforcement agencies.

Once a Code is “approved” by the ICO, then the text may be used to demonstrate compliance with the law enforcement requirements (see Clauses 56(4) and 59(7A) of the DPDI).

In this way,  public bodies producing a Code of Conduct effectively are drafting text that determines how data protection law applies to their controversial area of law enforcement processing. This "lawfulness" is without any reference to the Courts, Parliament, Impact assessment on data subjects nor any detailed privacy analysis from the ICO.

The ICO has not objected to such a prospect.

Forthcoming Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• All-day Zoom workshop (10.00-4.30)  on the DATA PROTECTION AND DIGITAL INFORMATION BILL held on Thursday 9 May.
• Data Protection PRACTITIONER Course is in London on Monday, 13 May to Friday, 17 May (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (July 2-4: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education. Next course on June 11th, 12th & 18th 2024

More details on the Amberhawk website: www.amberhawk.com  or email [email protected] (e.g  for. DPDI workshop agenda).

Government extends privacy protection to bequests made to the Conservative Party

Late on Good Friday (a very good time to bury “bad” news), the Government quietly tabled an amendment to the Data Protection and Digital Information Bill  (DPDI Bill) which extends the definition of personal data to include bequests and comments, made by a deceased, in his or her will.  The ICO has welcomed this amendment as a positive change to the law.

Although the amendment makes a somewhat quirky change to the Wills Act 1837,  an impeccable sauce has indicated that its main motive is to protect the privacy of bequests of large financial donations to the ruling Conservative Party.

Because the amendment is to a later Schedule of the Bill, it is expected to be debated towards the end of Committee stage in late April.

Amendment to Wills Act 1837

In further detail,  the unassuming amendment reads as follows:

At Schedule 12, page 270, line 8, insert new paragraph 29  (into the DPDI Bill)

29        WILLS ACT 1837

Insert into section 1 of the Wills Act, after the words “section 8 of the Human Transplantation (Wales) Act 2013…”, the following:

All personal information contained in a will shall be treated as if it were personal data (as defined in Section 3 of the Data Protection Act 2018) except when applied to the rights granted to data subjects as specified in Articles 12 to 22 of the UK_GDPR.

Following the amendment, there is a brief explanation of the impact of the change in the law.  This reads:

Minister’s explanatory statement

This amendment protects personal statements and bequests made by a deceased person in a will.  It ensures the deceased, when drafting a will, can be assured of the confidentiality of any bequest, after death.  The amendment also clarifies the law so that the recently deceased cannot exercise their data subject rights under the UK_GDPR.

Speaking on the new GBNews, Sunday breakfast, talk-show (“In The Pub with Lee Anderson MP”),  ex-GBnews presenter Esther McVey MP,  known by the tabloid press as the Minister for Common Sense, expanded on the amendment. She said:

“The amendment is a total realisation of the benefits of Brexit.  The UK is seizing back control of its laws by extending privacy protection to the wills of the newly departed.  The deceased will sleep more serenely in Heaven, secure in the knowledge that their privacy is maintained on Earth, from the moment they leave”.

Lee Anderson MP added a more practical observation:

“The text of wills can be very controversial, especially if the recently deceased leaves, in a will, a “parting shot” at his or her partner or another member of the family.  Such information is rightly protected from the do-gooders, neigh-sayers and anti-Brexit re-moaners who are jealous that their trivial political pursuits do not attract large financial donations from the dead”.

He added “where I come from, up North, we recognise the dead know a thing or two”.

ICO has also welcomed the clarity of the new amendment.  In a statement on his website, the ICO said:.

“I  heartily support the spirit of this amendment and I assure the British public that I shall enforce the new provision as robustly as I enforce the UK_GDPR and DPA2018 currently”.

“As a New Zealander, I am well attuned to a cultural tradition that embeds immense respect for ancestral history: “Hanga koa i taku gin me te tonic”, he added in Māori.

And finally…

Remember my Petition requesting the Government to implement the EU’s AI Act as part of the DPDI Bill is on that Parliamentary web-site: https://petition.parliament.uk/petitions/652982.  Please consider signing it and passing it to your colleagues to consider signing.

Details  reasons why you should sign the Petition are on my Hawktalk blog: https://amberhawk.typepad.com/amberhawk/2024/03/petition-calls-for-implementation-the-eu-data-act-to-protect-data-subjects-from-ai-abuse.html

Forthcoming Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• All-day Zoom workshop (10.00-4.30)  on the DATA PROTECTION AND DIGITAL INFORMATION BILL held on Thursday 9 May.
• Data Protection PRACTITIONER Course is in London on Monday, 13 May to Friday, 17 May (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (July 2-4: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our new specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected] (e.g  for. DPDI workshop agenda).

UK Government abandons Precautionary Principle and tolerates AI abuse risks to data subjects

Speakers at the Data Protection Forum in early March reinforced my reasoning that the Data Protection and Digital Information Bill  (“DPDI Bill”) should be used as a vehicle to implement the EU’s AI Act.  [Obviously my Petition which states this should also be supported: so please sign it! – see references].

One speaker, at the end of her presentation, made several personal comments about the risks associated with the fragmentary, “wait and see” approach of the UK Government towards AI regulation.

She pointed out that, in the UK, this meant that the five pillars of AI trustworthiness (Fairness, Robustness, Privacy, Explainability, Transparency: see references) could all to be interpreted differently by about 90 Regulators.

In further detail, these “trusty” five pillars, largely developed by the AI industry itself, can be summarised thus:

• Fairness: ensure that AI models don't exhibit biased behaviour when considering factors such as age, gender and ethnicity.
• Robustness: focus on the ability of AI models to perform well under exceptional conditions and adapt to changing circumstances.  Comment:  I assume this covers the change in AI functionality if there were to be another pandemic (the latter being the exceptional condition which could vary society’s usual modus operandi).
• Privacy: ensures that data used for training AI models remain protected and that insights derived from the models are under the control of the model builder. Comment: protected from whom? Does “under the control of the model builder” exclude data subjects (e.g. their rights)?
• Explainability: involves being able to understand and explain the decisions made by AI models to end users and decision makers. Comment: does this include data subjects?
• Transparency: emphasises making all relevant information about AI models easily accessible and inspectable. Comment: accessible and inspectable to data subjects?

The point being made in the “Comments”, is that any reference to “data subjects”, whose personal data are likely to be at the centre of much AI processing, is notably absent, especially with respect to the pillars relating to  Privacy, Explainability and Transparency.

Precautionary Principle

Given the obvious risks to data subjects, the Government’s laissez-faire approach to AI regulation abandons the Precautionary Principle towards its governance.

This Precautionary Principle arises when the risks of an action on society is high and the evidence about the future impact on that society of that action is uncertain.  I would argue that this fits the circumstances surrounding the development or use of AI to a tee.

It is this Principle which explains why the EU has enacted the Data and AI Acts that apply to the processing of all forms of data by AI.  By contrast, the Government’s approach sees this Principle as an obstacle to progress.

Indeed, the Government has deliberately weakened this Principle to accelerate such “progress”, by reducing the protection afforded to data subjects.

Data subjects at risk

For example, the A.22 UK_GDPR prohibition on profiling or automated decision taking is reversed.  Under the Bill, AI profiling/automated decisions can take place, in general, subject to a few exceptions usually associated with the processing of special category of personal data.

Yes there safeguards, but these all apply post automated decision when the decision has been taken effect and has impacted on the data subject.  There has been very little consideration of implementing safeguards prior to that AI induced, automated decision.

Secondly, much AI testing and development is also likely to fall within a revised “scientific research” definition.  Thanks to the Bill’s new transparency exemption for scientific research, such research can allow databases of personal data to be exchanged with Third Parties for their AI development purposes without existing data subjects knowing, so long as some (dodgy) “appropriate safeguards” apply.

One such appropriate safeguard is that substantial damage/distress to any data subject is unlikely; this merely means that moderate damage/distress to data subjects is acceptable to this Government!

There are impacts on data subjects’ rights.  How can data subjects exercise their right to object to the processing if they’re kept ignorant of who processes their personal data because of the new transparency exemption associated with scientific research?

Finally, such personal data exchange for scientific research purposes (i.e. AI development; algorithm testing) is also deemed “compatible” with the purpose of collection by the DPDI Bill.  In this way,  the Bill throws precautions to the wind, and legislates its way around the provisions in Article 6 (lawfulness of processing) that could prevent unlawful processing of personal data for AI development purposes.

Concluding comment

The Precautionary Principle, if followed, would add AI clauses to the DPDI Bill  which were aligned with the EU Data and AI Acts (both of which  maintain the GDPR standard).  Such amendments could be tabled for the Bill’s Report stage in the House of Lords (e.g. expected to be over five-days in May/June).

This Bill, once enacted (e.g. before the summer recess) will preserve the ability of the UK’s AI businesses to develop services that meet the requirements of the only available, recognised, international legal (and precautionary) standards that apply to AI.

These AI legal standards might not be the best, but they establish an important safety break in UK law.  That is what the Precautionary Principle is all about.  In addition, as the UK is no longer an EU state, the next Government can tweak these provisions if they do not work as intended.

The alternative is to adhere to this Government’s policy towards AI and put UK’s data subjects in harms’ way.

Forthcoming Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London on Monday, 18 March to Friday, 22 March (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (April 9-11: Tuesday to Thursday, 3 days: 9.45am to 5.00pm)
• All-day Zoom workshop (10.00-4.30)  on the DATA PROTECTION AND DIGITAL INFORMATION BILL held on Thursday 9 May.  Email [email protected] for workshop agenda or to reserve a place on this session.

References

Regulation 2023/2854 (Data Act} on “Harmonised rules on fair access to and use of data” (published in the OJ on 13 December 2023).  See also my updated Hawktalk blog dated 5 Jan 2024 (DPDI Bill combines with EU's Data Act and AI Act to strangle the UK’s AI industry?).

The Petition is on: https://petition.parliament.uk/petitions/652982.  Please consider signing it and passing it to your colleagues to consider signing.

Details  reasons why you should sign the Petition are on my Hawktalk blog: https://amberhawk.typepad.com/amberhawk/2024/03/petition-calls-for-implementation-the-eu-data-act-to-protect-data-subjects-from-ai-abuse.html

Chapter and verse on the relationship between scientific research and AI: https://amberhawk.typepad.com/amberhawk/2023/10/dpdi-no-2-bill-undermines-transparency-of-artificial-intelligence-development-and-training.html

Example used is IBM’s five pillars: https://www.toolify.ai/ai-news/the-five-pillars-of-trust-for-ai-a-guide-to-building-reliable-and-ethical-ai-systems-2584388

Petition calls for implementation the EU AI Act to protect data subjects from AI abuse.

I am asking readers to sign my Petition on the Parliamentary web-site (see end of this blog); most of the blog's text explains why you should sign.

In summary, the Petition states that the Government would be negligent if it failed to draft clauses for the Data Protection and Digital Information Bill  (“DPDI Bill”) to protect data subjects from the harmful impact of Artificial Intelligence (AI).

I have suggested that these AI clauses should be aligned with the EU Data/IA Acts (both of then apply; see references) and added to the DPDI Bill at Report stage in the House of Lords.  This will preserve the ability of the UK’s AI businesses to develop services that meet the requirements of the only available, recognised, international legal standard that applies to AI.

If the Government misses this legislative boat, any AI legislation in the UK will be delayed until after the next General Election (that is assuming a new incoming Government sees AI legislation as a major priority after the next General Election).

This, in turn, means the earliest that UK legislation is likely to be enacted is in 2025, coming into force by 2027.  By contrast, the EU Data Act becomes law beginning September 2025 - the AI Act soon after.

The current position of the UK Government is for an “AI Safety Institute” to make recommendations to Government.  January’s official announcement of the Institute describes its functions as follows.

“The Institute is not a regulator and will not determine government regulation. It will collaborate with existing organisations within government, academia, civil society, and the private sector to avoid duplication, ensuring that activity is both informing and complementing the UK’s regulatory approach…”

I am sure such collaboration and academic debate will be very worthy.  Sadly, however, the urgent requirement is for legislation governing the current risks arising from unregulated AI as of now, and not a “talking shop”.

Diminished protection from AI abuse

The EU Data/AI Acts maintain the EU_GDPR (or the current UK_GDPR) as setting the standard of privacy protection for data subjects.

This is unlike the DPDI Bill which weakens that privacy protection in the following areas relevant to AI processing: personal data, lawful processing, scientific research, automated decision taking and the Information Commission.

The problems associated with each of these areas are summarised below with reference to longer blog items.

Definition of “personal data”.

The DPDI uses a definition of “personal data” that does not meet the standards described in the DPA1984, the Council or Europe Convention No 108 nor the GDPR itself.  In other words, what is personal data in France might not be personal data in the UK.

Such a reduction in the reach of “what is personal data?” has the potential to have a significant impact on how the Principles, obligations and rights of the UK_GDPR apply in practice.  How can one assess, for instance, that an AI algorithm processes personal data “fairly”, if the meaning of personal data in the UK differs from that used in the rest of Europe.

The UK has been here before.  The defective Durant decision in the Court of Appeal in 2004 concerning “what is personal data?” caused a decade of confusion in the UK; just Google “Durant decision data protection” to find that out.

This judgment caused the European Commission to start infraction proceedings against the UK, and the issue is still so sensitive that information associated with these proceedings are still not accessible by FOI. (I tried 2 years ago).

This continuing refusal to release information about a 20 year-old historical event,  helps explain why the risks to the Adequacy Agreement between EU and UK, arising out of the DPDI Bill’s inadequate definition of personal data are very real.

A complete description showing why the UK’s definition of personal data does not meet European standards (or the 40 year old standard set by the DPA1984) can be seen from Hawktalk blogs dated 4 Aug 2022 and 13 Apr 2023.

Lawful and compatible processing

The DPDI gives the Secretary of State powers to:

• define certain AI processing as lawful by changing Annex 1 of DPDI;
• ensure that such AI training and algorithm development is compatible with the original purpose of the processing by changing Annex 2 of DPDI; and
• provide powers to introduce exemptions based on economic grounds to protect AI training and development from interference by the application of data subject rights (e.g. the right to be informed: see powers in A.23(1)(e) of the UK_GDPR).

These powers are extremely broad.  They can be used to ensure that any Minister’s pet processing project, in future, is defined as lawful, compatible with the purpose of obtaining and exempt from transparency obligations.  They can also be used to ensure that AI economic priorities prevail over measures that protect privacy.

I should add the House of Lords Committee on Delegated Powers (HL Paper 60; 14 February 2024) have called for these powers to be removed from the Bill as they are so general that they are “capable of being exercised more broadly to give effect to changes in policy”.

Detail of these data sharing powers is in my blogs dated 18^th and 31^st August 2022.

Secrecy and “scientific research”

The DPDI defines scientific research to include AI development and testing.  Additionally there is a new exemption from transparency if certain (dodgy) ”appropriate safeguards” apply and any further processing of personal data for such scientific research is deemed to be compatible with the purpose of obtaining, again if these safeguards apply

For example, one safeguard proffered by the DPDI Bill is that the processing is unlikely to cause substantial damage or substantial distress to any data subject.  This merely means that any moderate damage or moderate distress to data subjects (i.e. anything short of substantial), is acceptable as far as this Government is concerned.

The DPDI Bill anticipates that much “scientific research” (i.e. AI development) will be made lawful in terms of “legitimate interests” of controller or a Third Party.  This means that large databases can be lawfully used by controllers (or disclosed to Third Parties) for AI development purposes.

Additionally, if the appropriate safeguards apply, the exemption from transparency means that existing data subjects described in the database are not informed about this further AI use or Third Party disclosure.

Such secrecy also applies to any onward data sharing of databases to any Third Party AI development, subject to the “appropriate safeguards” applying.

The Government say this liberal exchange of personal data is an example of it allowing personal data to become the oil that fuels economic dynamism.  Others may  view it differently: the Government is transporting this fuel in oil-tankers such as the Torrey Canyon or Exxon Valdiz.

Details of the risk from data sharing for scientific research is in my Hawktalk blog dated 31 Oct 2023.

AI automated decision taking

The DPDI reverses A.22 and the right not to be subject to automated decision taking or profiling.  Instead of few exceptions when automated decisions can be taken (e.g. authorised by law),  the DPDI permits automated decision taking in general, subject to a few exceptions (e.g. involving special category of personal data).

In other words, the DPDI Bill opens the door to untrammelled automated decision taking using AI techniques on UK’s data subjects.

There are safeguards, but these all apply after the automated decision has been taken and the significant effect on the data subject has impacted. There is nothing in the DPDI Bill that relates to safeguards prior to that automated decision being taken.

I think this position tells you something about the Government’s priorities here.

Independent Regulator

The DPDI Bill reduces the independence of the Regulator (e.g. when enforcing AI best practice).

The Secretary of State appoints all the voting non-executive members to the new Information Commission and sets the Commission’s strategic direction which includes economic, law enforcement and national security priorities.

Note that all these priorities set by the SoS are likely to apply to the Governments future exploitation of AI techniques.

For instance, the DWP are seeking powers to demand bulk personal databases from banks for its own AI purposes to identify those associated with any erroneous benefit claim or pension payment  – which of course means processing personal data relating to millions of pensioners and claimants and those related to them.

The DPDI Bill therefore reduces confidence in an independence of the Regulator when enforcing the data protection rules in the context of AI. Detail in my Hawktalk blog dated 19 Oct 2023.

Common theme

The common theme in all the above, is that the DPDI Bill allows for AI development practices to proceed, in the presence of deliberately weakened legislative protection for data subjects.

Given that all USA high tech are large players in the AI Industry and given these companies do not have a proud tradition in the field of privacy protection, the Government’s policy amounts to “a wing and a prayer” that its “wild west” approach to the free flow of personal data for AI purposes will not result in any significant misuse.

In short, the Government has knowingly and recklessly abandoned the Precautionary Principle associated with the governance as applied to AI.

That is why I have tabled this petition; please consider signing it (and pass it to your colleagues to consider signing).  First target 10K signatures.

The Petition

The text is as follows:

Amend the DPDI Bill to protect us from harmful Artificial Intelligence (AI)

The Data Protection and Digital Information Bill (now in the Lords) is a vehicle that allows the Government to legislate to protect against misuse of AI. The Bill should be amended so that it mirrors EU's AI/Data Act, which we believe provides better data protection with regards to AI.

The Prime Minister has said he wants “guard rails” to protect society from the misuse of AI.

We believe there is no excuse for Government inaction, and that failure to implement protective clauses on the lines of the EU's AI Act may risk damaging AI innovation and development in the UK.

The Petition is on: https://petition.parliament.uk/petitions/652982.

Forthcoming Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London or Zoom on Monday, 18 March to Friday, 22 March (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London or Zoom on (April 9-11: Tuesday to Thursday, 3 days: 9.45am to 5.00pm)
• All-day Zoom workshop (10.00-4.30)  on the DATA PROTECTION AND DIGITAL INFORMATION BILL held on Thursday 9 May.  Email [email protected] for workshop agenda or to reserve a place on this session

Finally, we have launched a specific qualification for data protection specialists in the Education sector. 

Further details of all the above on the Amberhawk website (www.amberhawk.com)

References

Regulation 2023/2854 (Data Act} on “Harmonised rules on fair access to and use of data” (published in the OJ on 13 December 2023).  See also my Hawktalk blog dated 5 Jan 2024

Details of AI Act: https://www.europarl.europa.eu/news/en/press-room/20231206IPR15699/artificial-intelligence-act-deal-on-comprehensive-rules-for-trustworthy-ai

DPDI Bill combines with EU's Data Act and AI Act to strangle the UK’s AI industry?

Text Updated 6 March 2024

Most people will agree that the promised “Brexit benefits” have yet to manifest themselves in physical form.  This is especially the case with the Data Protection and Digital Information (“DPDI”) Bill which for three years been touted by Ministers as the pre-eminent Brexit Bonus for Britain.

The Bill, it is claimed, combines a high level of data protection for data subjects with easier compliance for controllers and the wider exploitation of personal data:- such data being the new oil in a free-running, modern, data-driven UK economy.

Readers of this blog will know I think this claim to be pure fantasy; the true position is the Bill lowers the level of data protection for data subjects.  The Bill only oils the wheels of business/public sector processing to the extent that it removes obligations and reduces rights.

However, the recent publication, just before Xmas, of the European Union’s Data Act and agreement on the EU's AI Act add another dimension.  The former Act's text is in the public domain; the latter's text has yet to appear.

The provisions of both infer the DPDI Bill is likely to damage UK controllers who are intending to develop/sell Artificial Intelligence (AI) expertise, products or consultancies into Europe.  Such damage negates the reasons given by Ministers as to why the Bill was needed.

Put simply, if AI controllers based in the UK ignore the EU's Data Act (and adhere to the DPDI Bill) they may experience difficulty trading with partners in European Union. If they comply with the Data Act, then implicitly they are accepting GDPR standards of data protection for the UK (and not the lower standards of the DPDI Bill).  The combination of adhering to the Data Act and also the DPDI Bill (once enacted) is not a viable option.

This blog explains why this is the case.

Legislative catch-up needed?

Whilst the Government has been gathering AI plaudits by hobnobbing with the great and the good at Bletchley Park conferences on AI, those “pesky Europeans” have stolen a legislative march.  The EU will have comprehensive legislation in place in each Member State governing AI from September 2025; by contrast the UK has yet to draft a single clause.

This creates a problem for the UK Government; it has three options in a game of “regulatory catch up”.  It can:

• Continue to believe in Brexit (a “do nothing” option). As Government believes its own rhetoric (e.g. that the DPDI Bill’s “high standard” of data protection does not jeopardise the Adequacy Agreement with the EU), it follows that there is no change with the EU's Data or AI Act. The UK can thus ignore the Data Act and take “control of its laws” to its own timetable (e.g. introduce AI legislation, only if needed, after it has won the next General Election).
• Prepare amendments to the DPDI Bill for its House of Lords’ Report stage in April/May. This involves Government having a set of private discussions with its friends (as it did with the DPDI Bill) on how to respond to the Data and AI Acts.  The DPDI Bill provides a vehicle for any AI amendment which can then be pushed through Parliament with minimal scrutiny at Report stage. (In much the same way 125 pages of amendments were pushed through Report stage in the House of Commons in December).
• Halt the DPDI Bill for four months. This allows for a public consultation on AI legislative options to take place, allow time for amendments to be prepared based on that consultation, and allow time for them to be scrutinised properly by Parliament.  If Government acts quickly, completion of the DPDI Bill is still possible before the summer recess in July, so the delay is unlikely to interfere with the Prime Minister’s suggested timetable of a General Election from the Autumn.

The Data Act (Regulation 2023/2854)

In the EU, AI processing will be subject to both the Data Act and the AI Act. This part of the blog relates to the Data Act as its text is available (unlike the AI Act as of the time of writing).

The Recitals to Data Act (i.e. Regulation 2023/2854 – see references) spells out its purpose.  It is to provide a Euro-wide standard covering “The proliferation of products connected to the internet” which “has increased the volume and potential value of data for consumers, businesses and society”.

The objective is to encourage reuse and interoperability of the data from different domains in order to “increase competitiveness and innovation and ensure sustainable economic growth”. However, “barriers to data sharing prevent an optimal allocation of data for the benefit of society”.

These barriers include “a lack of incentives for data holders to enter voluntarily into data sharing agreements, uncertainty about rights and obligations in relation to data, the costs of contracting and implementing technical interfaces, the high level of fragmentation of information in data silos, poor metadata management, the absence of standards for semantic and technical interoperability, bottlenecks impeding data access, a lack of common data sharing practices and the abuse of contractual imbalances with regard to data access and use”.

The Act therefore “responds to the needs of the digital economy” by “removing barriers to a well-functioning internal market for data” by establishing “a harmonised framework specifying who is entitled to use product data or related service data, under which conditions and on what basis”.  Clearly, this includes processing for AI purposes.

All the above statements could have been uttered by any Brexit loving Minister concerning the reasons for introducing the DPDI Bill.

Protecting data subjects

Divergences arise when it comes to protecting data subjects in the forthcoming AI revolution.  Whereas the DPDI Bill essentially reduces data protection standards to ease AI processing, the Data Act stresses that the fundamental rights and obligations that protect personal data are safeguarded by the GDPR (and by PECR). There is no reason to believe the AI Act is different.

These two “legislative acts provide the basis for sustainable and responsible data processing, including where datasets include a mix of personal and non-personal data”.  Note the implication that non-compliance with these two legislative acts (e.g. by exempting GDPR provisions via the DPDI Bill) is unsustainable and irresponsible.

The Data Act therefore “is without prejudice” to the GDPR and PECR and “no provision [of the Data Act] should be applied or interpreted in such a way as to diminish or limit the right to the protection of personal data or the right to privacy and confidentiality of communications” (my emphasis: the confidentiality of communication requirement is found in Article 5(3) of PEC Directive 2002/58/EC).

Any processing of personal data should comply with the GDPR “including the requirement of a valid legal basis for processing under Article 6”, and “where relevant, the conditions of Article 9” (A.9 deals with overcoming the prohibition from processing of special category of personal data such as health records).

The Data Act “does not constitute a legal basis for the collection or generation of personal data by the data holder” (my emphasis).  In other words, any personal data processed has to have an A.6 lawful basis.

Where the user [of an AI system] is not the data subject, the Data Act “does not create a legal basis for providing access to personal data or for making personal data available to a third party and should not be understood as conferring any new right on the data holder to use personal data generated by the use of a connected product or related service” (my emphasis).

The Data Act “should not adversely affect the data protection rights of data subjects”. For instance, with respect to right to object to certain disclosures of personal data, the disclosure request can be satisfied by “anonymising [the shared] personal data” [i.e. when the right would not apply]

There is no change in the Data Act to the right not to be profiled or not to be subject to automatic decision taking in A.22 of the GDPR.

With respect to subject access “where the readily available data contains personal data of several data subjects” the software can be designed to “transmitting only personal data relating to the user” [in this case, the user is the specific data subject making the request].

In addition “the principles of data minimisation and data protection by design and by default are essential when processing involves significant risks to the fundamental rights of individuals”.

Data sharing falling within scope of the Data Act should include “pseudonymisation and encryption”, but also the application of “technology that permits algorithms to be brought to the data … without the transmission between parties or unnecessary copying of the raw or structured data themselves”.

What one discovers is that the DPDI Bill has provisions that negate or vary all the above Data Act strictures; one assumes it is likewise for the AI Act..

A contrast in protection

In summary, under the EU’s Data Act, processing for AI purposes can proceed, subject to the data protection standards of the GDPR (and PECR).  In the UK,  processing for AI purposes can proceed are subject to the weakened standards of the DPDI Bill. (Further detail in the Hawktalk blog dated 31 Oct 2023).

There are six points of divergence between the Data Act and the DPDI Bill worthy of description in this blog; the same is likely to apply to the EU's AI Act

First, the definition of “personal data”.  The Data Act defines “personal data” to be the GDPR’s definition (in Article 4(1)) and defines ‘non-personal data’ to mean “data other than personal data”.  By contrast, the DPDI Bill redefines “personal data” to be at a standard demonstrably lower that the UK’s Data Protection Act 1984 and the 1981 version of the Council of Europe Convention No 108 (detail is in the Hawktalk blog dated 13 Apr 2023).

The DPDI Bill is designed to reduce the “data” that can be classified as “personal data”.  It means that what the Data Act considers as “personal data” could well be treated by the DPDI Bill as “data” (i.e. free of any data protection right or obligation).

It then follows that the Bill’s reduction in the scope of “personal data” means the UK implementation of AI rules risks being considered as being defective, when compared with similar Data Act requirements (which relies on the GDPR definition of “personal data”).

It is worth reminding readers that the DPA1998 was deemed to be a defective implementation of Directive 95/46/EC because of the Durant decision in the Court of Appeal that weakened the scope of the definition of personal data.  Details of the reasons for the EU’s infraction proceedings against the UK over this definition are still being refused to be released under FOI (latest attempt in 2022).

Second, the new lawful basis for sharing personal data with the public sector (Recognised Legitimate Interest).  This is contrary to the Data Act, which limits the list of lawful bases to those in Article 6 of the GDPR.

So if a UK public sector controller were to rely on the new Recognised Legitimate Interest lawful basis to ask for disclosure of personal data to support its AI work, then it would the processing personal data below the standards specified in the Data Act.

Not only that, the data subject rights of erasure with respect to such disclosed personal data would not apply to any public authority that obtained the personal data via a Recognised Legitimate Interest disclosure.  In addition, the right to object would be difficult to apply.  This diminishing of data subject rights is also contrary to the Data Act standards, which maintains all GDPR data subject rights.

Third, exemptions that cover AI algorithm training and development. The DPDI Bill provides a new exemption from transparency and incompatibility requirements for AI training and development by controllers and related Third Parties.  These are subject to certain safeguards (which are of dubious standard) and these exemptions apply, irrespective of the nature of the AI purpose.

Indeed, this new exemption from the right to be informed raises the prospect of secret transfers of personal data to Third Parties in third countries for their AI purposes.  (Detail in the Hawktalk blog of 31 Oct 2023).

Finally,  the new exemption from the right to be informed in the DPDI Bill for AI training and development arises because of the Bill’s expanded definition of “scientific research”; this exemption is not replicated in the GDPR.  This is also contrary to the Data Act which maintains all GDPR data subject rights.

Fourth, the reversal of the right not to be subject to automated decision taking (A.22). The Data Act maintains the primacy of A.22 of the GDPR which prohibits the data subject from being subjected to an automated AI decisions or profiling in general.

Instead, the GDPR defines when a controller can take such automated decisions (e.g. decisions necessary for a contract or likely contract with the data subject; decisions authorised by law or by the consent of the data subject).

By contrast DPDI allows automated AI decisions and profiling to be taken in general, but defines the circumstances when a controller cannot make such decisions (e.g. the processing to make an AI decision is justified in terms of a Recognised Legitimate Interest – the new A.6 lawful basis for the UK).

This is a major change in protection for data subjects because in the UK decisions about individuals can be expected to be taken by AI as a matter of routine.  Yes, data subjects in the UK might be able to make representations concerning the automated decision but I suspect in practice this is of little value.  This is because managers will very rarely have the courage to overturn a decision of a “tested” AI Algorithm.

Fifth, the role of Data Protection by Design and by Default. When testing AI training or AI algorithms, the Data Act states that “the principles of data minimisation and data protection by design and by default are essential”.  By contrast, the DPDI Bill removes this “essential” element; instead it merely states that the “appropriate safeguard” is to “show respect” for these elements.

Sixth, reducing the independence of the Information Commissioner weakens protection for the data subject. A data protection regulator that has other priorities (e.g. economic objectives) grafted on to them cannot fully protect the data subject’s interests when these priorities conflict with data protection objectives.

In addition, the Secretary of State (SoS) can effectively control the replacement Commission when the Office of Information Commissioner is abolished. Detail of how the SoS chooses all the voting, non-executive members of the Commission can be found in the Hawktalk blog dated 19 Oct 2023.

Concluding commentary

The UK has a population of 65 million data subjects; the EU a population of 750 million.  Suppose you are looking at using AI to offer services to the EU and UK population or selling AI expertise/products into the EU and UK.  Now answer the following questions.

• Whose AI training regime presents the highest risk to your organisation? Is it one designed under UK data laws (if they appear) or EU Data/AI Acts?
• Whose AI products and services will your customer, the data subject, trust the most? Is it one designed under UK data laws or EU Data/AI Acts?
• Whose AI products and services expose the greatest risk to your organisation, if your new emergent AI technology goes horribly wrong? Is it one designed under UK data laws or EU Data/AI Acts?

If your answer is UK data laws, then clearly European standards are chucked out of the window with obvious consequences for the risk to trade with Europe.  If your answer is the EU Data Act, then implicitly they bring in the GDPR standards of data protection into the UK and not the DPBill’s reduced standard.

In short, it is answers to questions like this which explains the headline to the blog: why the Data/AI Acts and DPDI Bill combination strangles the UK’s emerging AI industry.

Of course, if you still believe in the benefits of Brexit, the previous sentence is obviously false.

Data Protection Courses in early 2024

Our well received, all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information Bill will next be held on Thursday 29 February  2024.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London on Monday, 18 March 2024 to Friday, 22 March 2024 (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (April 9-11, 2024: Tuesday to Thursday, 3 days: 9.45am to 5.00pm)

References

Regulation 2023/2854 (Data Act} on “Harmonised rules on fair access to and use of data” (published in the OJ on 13 December 2023)

Details of the AI Act (text not available): https://www.europarl.europa.eu/news/en/press-room/20231206IPR15699/artificial-intelligence-act-deal-on-comprehensive-rules-for-trustworthy-ai

KC's legal advice supports Hawktalk’s claims of inadequate standards set by DPDI Bill

This is my contribution to the Second Reading (Lords) of the Data Protection and Digital Information (DPDI) Bill which is tomorrow.

First there is a legal opinion, just published by defenddigitalme from Stephen Cragg KC of Doughty Street Chambers. This is accessible from https://defenddigitalme.org/2023/11/28/new-legal-opinion-on-the-data-protection-and-digital-information-bill/ 

This legal opinion reinforces the major concerns raised in my previous blogs on the DPDI Bill.  Collectively these concerns weaken data subjects rights and the privacy protection afforded by the current UK_GDPR. They concern the definition of personal data, data sharing, third party marketing and scientific research/AI.

The changes mentioned below have not been debated fully in the Commons because of the strict time limits imposed by Government on these proceedings (e.g. 3hrs to debate 125 pages of Government amendments at Report stage).

Four concerns

The four concerns in the blog that overlap with the legal opinion are:

First, the definition of “personal data” results in a level of protection below that established by the DPA1984 and Council of Europe Convention No 108. This has the potential to result in great divergence from the European standard for data protection and threaten the UK’s adequacy agreement with the EU.

Readers might remember the problems raised by the Durant judgement which narrowed the scope of “personal data” under the DPA1998.  Here the European Commission commenced infraction proceedings that the DPA1998 was not a proper implementation of Directive 95/46/EC.  I should add that repeated FOI requests to the detail of these proceedings, two decades on, are still being refused.

Messing with the definition of personal data, as the DPDI Bill does, messes with all the data subject rights, Principles and obligations in the UK_GDPR.  That is why this undebated definitional change that weakens its scope is so fundamental to the level of data protection afforded by the UK’s DP legislation and the Adequacy Agreement with the EU.

Detail of the definitional changes can be found on https://amberhawk.typepad.com/amberhawk/2023/04/definition-of-personal-data-in-dpdi-no-2-bill-results-in-non-compliance-with-coe-convention-no108.html

Second,The powers that facilitate voluntary data sharing with (or between) any public body that asks for the personal data is a power grab by Ministers to define, that at any future time, any disclosure of personal data to any public body can become is lawful and compatible. It does not matter what the purpose of the processing is, so long as it falls within the official remit of the tasks of the asking public body the disclosure is a “Recognised Legitimate Interest”.

The provisions are so broad that they even encompass the other DWP personal data grab that can demand banking personal data of benefit claimants (including pension and child benefit claimants).  These compulsion powers are unnecessary as the DWP could easily use the extensive voluntary route proposed by the Bill.

Additionally, there is no evidence that the voluntary approach, touted by Government has failed. Hence it follows that the DWP’s justification for its major personal data grab is being made in the absence of any evidence that these ominous powers are required.

Grim detail on: https://amberhawk.typepad.com/amberhawk/2022/08/voluntary-disclosure-to-hmrc-always-lawful-and-always-compatible.html

Third, The changes associated with marketing are likely to result in a spammers’ charter for work email addresses. Collections of  harvested work email addresses can be used or disclosed (or transferred) for third party marketing on the basis of that third party’s “legitimate interests”. The right to object to marketing is much diminished and the Bill overturns the consent requirements for Third Party marketing that were established thirty years ago.

Detail on: https://amberhawk.typepad.com/amberhawk/2023/05/dpdi-no2-bill-dumps-all-data-subject-consent-requirements-for-third-party-marketing.html

Fourth, Scientific research is redefined to include AI training and development. The Bill permits large databases of personal data to be used, disclosed and transferred (including outside the UK) for AI training and development without the knowledge of the data subject (let alone their consent).

Grim detail on: https://amberhawk.typepad.com/amberhawk/2023/10/dpdi-no-2-bill-undermines-transparency-of-artificial-intelligence-development-and-training.html

“Brexit bus numbers”

Government Ministers are continuing to spout nonsense numbers about projected savings arising from the DPDI Bill. To show this, I recently asked the ICO for details of notified controllers.  The response shows that the current notification figures are as follows:

• Tier 1 – 1,068,221 controllers; maximum turnover of £632,000 or no more than ten members of staff.
• Tier 2 – 108,934 controllers; maximum turnover of £36 million or no more than 250 members of staff.
• Tier 3 – 7,001 – large controllers; more than 250 staff or greater than £36 million turnover.

Now apply the above numbers to recent Ministerial statements given to Parliament that “justify” the legislative proposals.

Minister: “We are expecting micro and small businesses to save nearly £90 million in compliance costs every year: that is £90 million more for higher investment, faster growth and better jobs”. (2^nd reading DPDI, Hansard, 17/4/23 at col 69). £90 million per year is £900 million per decade (or £0.9 billion; this figure used later).

However, there are approximately 1.07 million Tier 1 small and medium sized controllers notified with the ICO.  This means that the “micro and small businesses to save nearly £90 million in compliance costs every year: comes to just under £90 per year per small business or  £1.61 per week per SME”.

Could be wrong, but I don’t think you get much investment and growth for £1.61 per week – except for a half a cappuccino from the local cafe.

The Minister at Report stage in the Commons: “Taken together, we believe these amendments will benefit the economy by £10.6 billion over the next 10 years. That is more than double the estimated impact of the Bill when it was introduced in the spring” (Report DPDI, Hansard, 29/11/23 at col 872).

To get an upper limit of these savings, assume all these savings are concentrated on Tier 2 and Tier 3 controllers (turnover greater than £632,000).  The ICO shows that there are 116,000 of them and the projected savings are £1.06 billion per year (but remember to subtract the SME savings of £0.09 billion stated above).

It can be seen that the projected £0.97 billion savings per year (£1.06-£0.09) represents an the average saving per controller of around £9,000 per controller.

In other words, for Tier 2 there is a saving of a maximum of 0.03% of turnover if the controller’s turnover is £32 million.  In other words, the touted savings are still insignificant.

Rwanda

Finally, to Rwanda.  The Safety of Rwanda (Asylum and Immigration) Bill defines Rwanda as safe for the transfer of migrants who risk their lives to arrive in those small boats.

However, Rwanda has not been identified as a territory that offers adequate level of protection for the transfer of personal data from the UK.  Hence Rwanda is unsafe for the general transfer of personal data concerning migrants to Rwanda, but is safe for the transfer of the migrants themselves.

You cannot make this stuff up.

Forthcoming Data Protection Courses in 2024

Our well received, all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information Bill will next be held on Thursday 29 February  2024.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London on Monday, 15 January 2024 to Friday, 19 January 2024 (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (April 9-11, 2024: Tuesday to Thursday, 3 days: 9.45am to 5.00pm)

Full details on Amberhawk’s website (www.amberhawk.com) or  obtained by emailing [email protected].

DPDI Bill undermines transparency of Artificial Intelligence development and training

Last week, Prime Minister asked  “how can we write laws [to regulate AI] that make sense for something we don’t yet fully understand?”.  The PM does not appreciate that his Government has already drafted a law that applies to the processing of personal data for AI purposes but which has the objective of diminishing the protection afforded to data subjects.

In this blog, I show, in the context of scientific research, how the proposed DPDI No 2 Bill” (the “Bill” ) permits personal data to be used,  disclosed or transferred outside the UK for AI training and development purposes, in secret, without consideration of compatibility or the right to object to the processing.

The legislative steps in the Bill that achieves these objectives are as follows.

• Define “scientific research” so it includes private AI development and AI algorithm training (i.e from now on, read “scientific research” to include private sector AI research, training and development).
• Define “appropriate safeguards” for AI “scientific research” that are below the equivalent safeguards specified in the GDPR.
• Ensure that AI “scientific research” can be undertaken in the “legitimate interest of the controller or of a third party” if the previously mentioned “appropriate safeguards” apply. Thanks to this Bill, the “legitimate interests” lawful basis is likely emerge as the preferred alternative to “data subject consent” for most “scientific research” because of the reduction in the level of data subject protection.
• Ensure that any further processing for AI “scientific research” purpose is always deemed to be compatible with the purpose of obtaining, irrespective of that obtaining purpose or of the nature of the AI research.
• Introduce a transparency exemption which applies to existing data subjects described in any dataset. This exemption applies to the further use of personal databases for AI “scientific research” purposes by the controller or by any third party to whom the personal data is disclosed.

It is the lack of transparency which diminishes data subject rights. For instance, how do data subjects know they can exercise their rights if they do not know their personal data are being processed in the first place?

However, before we get to explaining all the above, the blog has to deal with the definition of “scientific research” and then “appropriate safeguards”.

Scientific Research

The analysis begins with the definition of “scientific research”.  This definition reads:

 “Any research that can reasonably be described as scientific, whether publicly or privately funded….”. and  “include processing for the purposes of technological development or demonstration, fundamental research or applied research, so far as those activities can reasonably be described as scientific…”.

Does this includes AI learning or AI development?  Well to get that answer I asked CHAT_GBT the question.  It replied:

“Yes, scientific research often involves AI and machine learning, which are important tools in various scientific disciplines. … Machine learning is a subset of AI that focuses on developing algorithms and models that can learn from data and make predictions or decisions based on that learning”.

So AI training and development can fall within “scientific research”. The next outstanding issue is whether the appropriate safeguards apply.

Appropriate safeguards

The “appropriate safeguards” (defined in A.84B; some detail in A.84C) can be summarised as follows.  To be helpful, I have added some commentary.

Safeguard 1: The processing of personal data does not permit identification of a living individual apart from the collection of personal data but the safeguard does not apply if the further AI “scientific research” purpose cannot be fulfilled without the identification of a living individual.

Commentary on Safeguard 1: The inference underpinning this safeguard is that the identification details in the personal data should initially be separated from the personal data after collection.

This separation could allow that in any subsequent processing,  the relevant (non-identifiable) data are treated as anonymous at the time of that processing  (even though the controller knows that, at a later time, how to reconstitute the data as personal data).  This increases the possibility that, at the time of that processing,  there would be no DP obligations arising from the further processing for AI (thanks to the new narrow definition of “personal data” in the Bill).

In any event, if the controller considers that the AI “scientific research” purpose cannot be fulfilled without using personal data, then the safeguard does not apply.

In practice, therefore, Safeguard 1 might prove to be not much of a safeguard.

Safeguard 2: The processing is “likely to cause substantial damage or substantial distress to a data subject to whom the personal data relates”.

Commentary on Safeguard 2: “Gosh” and “Crikey”!  Processing likely to cause moderate damage/distress to data subjects (i.e. anything short of substantial) is below this safeguard’s threshold. This is touted as safeguard? Surely not!

Safeguard 3: No decisions with respect to any particular data subject are made unless is it medical research approved by SoS, medical ethics committee etc.

Commentary on Safeguard 3: this safeguard existed in the DPA1998 so it is nothing new.  However, for medical research it allows the SoS indirect powers to approve future AI “medical research” (e.g. via an ethics body made up of SoS appointees which could approve medical research for the NHS undertaken by USA high tec industries such as the Palantir).  Although this is touted as a safeguard,  in practice it could easily become a licence that allows the Government to exploit NHS personal data.

Safeguard 4:show respect for data minimisation Principle or pseudonymisation.

Commentary on Safeguard 4:  it’s noteworthy that an obligation with to respect “anonymising personal data” is missing”.  In addition, the safeguard is not new and replicates the controller’s obligation in Article 25 (data protection by design and by default).

Comparison with the safeguards specified in Recital 156 of the EU_GDPR shows the latter is far more protective of data subjects than this obligation (see below).

Recital 156: “…Those safeguards should ensure … that technical and organisational measures are in place to ensure,  in particular, the principle of data minimisation. The further processing of personal data for ..[“scientific research” purposes] …. is to be carried out when the controller has assessed the feasibility to fulfil those purposes by processing data which do not permit or no longer permit the identification of data subjects, provided that appropriate safeguards exist (such as, for instance, pseudonymisation of the data…)”

Note that Recital 156 equates pseudonymisation with the safeguard; the Bill merely equates “respecting for pseudonymisation” as the equivalent safeguard.

Finally, the S.o.S has powers to vary the “appropriate safeguards” (Article 84D).  It would be optimistic to say that these powers would be used to strengthen the data subject protection when the Bill’s direction of travel is clearly in the opposite direction.

Lawful basis for AI

Much processing for “scientific research” can continue to be undertaken using the lawful basis of fully informed and freely given “data subject consent”.  If data subjects give consent, they are obviously made aware of the AI “scientific research” purpose and are protected in that they can withdraw consent at any time.

Although the Bill makes changes to “consent” to make it more flexible for the “scientific research” purposes, the fundamentals of consent have not been changed by the Bill (e.g. records of consent have to be kept, withdrawal of consent is part of the Privacy Notice).

If, however, the lawful basis for such AI research changes to “legitimate interests”, then the right to object to the processing applies.  To exercise this right, data subjects have to present grounds relating to their individual situation and, in addition, data subjects have to be made aware that the right to object applies (e.g. in a Privacy Notice).

As will be seen, these last two requirements can be negated by the Bill.

As an aside, the ICO has already determined that the “legitimate interests”  lawful basis can be approved for medical research by the ICO (see references).  In fact, I expect this lawful basis to emerge as the preferred option for all “scientific research” (because of the diminution of data subject protection)

Legitimate interests in detail

Consider the “legitimate interests” lawful basis in detail; this reads:

“Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.…” (my emphasis)

If the processing causes no impact on the data subject, then there is unlikely to be overriding interests of the data subject to protect.  Indeed it will be difficult for the data subject to provide grounds that their interests or rights should prevail,  if there is no impact of the processing on them

Hence I expect the right to object to be refused and the processing for AI “scientific research” to continue unabated.

Note that this “legitimate interest” basis also allows a controller to lawfully disclose personal datasets to a third party for its legitimate interest in using such personal data for its AI  “scientific research” (see reference at end).

Secrecy and A.13

The Bill states that if the “appropriate safeguards” (see above) associated with the processing for an AI “scientific research” purpose apply,  there are circumstances when there is no need to tell existing data subjects about the further processing for this AI “scientific research” purpose. (I will explain “existing” later).

In further detail, exemption states that (my emphasis):

“If the controller intends to further process personal data…

(i) for (and only for) the purposes of scientific or historical research, the purposes of archiving in the public interest or statistical purposes, and

(ii) in accordance with appropriate safeguards [see above] and

providing the transparency information is impossible or would involve disproportionate effort” where

“Disproportionate effort” depends on “among other things, the number of data subjects, the age of the personal data and any appropriate safeguards applied to the processing”.

Clearly if a new AI project requires access to a large volume of personal data and the processing falls within the AI “scientific research” definition and the appropriate safeguards are applied, then this exemption is very likely to be engaged.  It follows that there is no need to inform data subjects described by such personal data about the further AI “scientific research”  purpose.

It means any database can be further used for AI “scientific research” purpose without any transparency to data subjects described in the data.  As stated previously, such secrecy also applies when there is a disclosure by a controller of these personal data to a third party in its legitimate interests for an AI “scientific research” purpose.

Note that the exemption does not apply to new data subjects who are added to a dataset after use or disclosure for the AI “scientific research” purpose.  This is because the disproportionate effort definition is unlikely to apply as new data subjects can easily be informed by an updated Privacy Notice describing this purpose.

I know this exemption is complicated!  This because it only applies to not informing data subjects already described in a dataset to a new further AI “scientific research” purpose associated with the processing of their personal data when the appropriate safeguards etc apply.

Compatibility, secrecy and A.14

Suppose a controller discloses a personal dataset, not for its own AI “scientific research” purpose, but for the AI “scientific research” purpose of a third party.  If the disclosing controller does not need to identify the further purpose to existing data subjects, what about the third party? Does that third party need to contact the data subject?

The answer is “no”, as there is a similar provision introduced as new Article A.14(6) that states the third party does not need to inform the data subject of its AI “scientific research” purpose if “disproportionate effort” applies and the appropriate safeguards apply.

If there were to be onward disclosure by a third party to another third party for its AI “scientific research” purpose, then the same exemption applies assuming disproportionate effort and the appropriate safeguards apply.

To avoid the risk that a further AI “scientific research” purpose is incompatible with the purpose of obtaining,  the Bill provides that any further use or disclosure for that purpose is deemed compatible, if disproportionate effort and the appropriate safeguards apply (see new Article 8A(3)(b)). 

In other words, “deemed compatibility” can also apply to any further third party disclosure for AI “scientific research” purposes.

Conclusion

The blog describes that, under the DPDI No 2 Bill, a controller can disclose, to any number of other controllers, a huge dataset of personal data in circumstances when there is no obligation to inform data subjects described in that dataset about the use or disclosure for an AI “scientific research” purpose so long as the disproportionate effort and appropriate safeguards criteria apply.

The blog also describes that the “appropriate safeguards” are not as safe as one would expect.

Because the UK has a transfer agreement with the USA, such a dataset can be transferred to the USA for another third party’s AI “scientific research” purpose, away from the UK/EU jurisdiction.  Because there is an exemption from transparency, this transfer is unknown to each data subject.

Readers are probably aware that Clearview, Facebook, Google, Twitter and Yahoo are all high tech USA companies that have been fined by European Data Protection Regulators and are all global players in AI “scientific research”.

Many will find it surprising that a large dataset of personal data can be lawfully transferred from the UK to the USA for any third party AI “scientific research” purpose without data subjects described in the dataset knowing about the circumstances of such a use or disclosure.

Given the above, I ask the reader a simple question: “What possibly could go wrong?”. Answers by email to the Prime Minister who needs enlightenment (Email form on https://contact.no10.gov.uk/Contact.aspx).

Forthcoming Data Protection Courses

Our well received, all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill will be held on Thursday 7 December  2023.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London on Monday, 20 November 2023 to Friday, 24 November 2023 (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (December 12-14, 2023: Tuesday to Thursday, 3 days: 9.45am to 5.00pm) or

Full details on Amberhawk’s website (www.amberhawk.com) or  obtained by emailing [email protected].

References

Use of legitimate interests for lawful basis in medical research : see para 3.16 of the Sandbox on Our Future Health: https://ico.org.uk/media/for-organisations/documents/4026890/our-future-health-regulatory-sandbox-final-report.pdf