Hawktalk

Facial recognition CCTV excluded from new data protection law by definition of “personal data”

I have come to the conclusion that the new definition of personal data in the Data Protection and Digital Information No.2 Bill (“No.2 Bill”) only applies to facial recognition CCTV if the data subject is on a watch-list.

If the individual is not on a watch-list, and the camera images are deleted immediately after checking the watch-list, then personal data are not processed and there are no data protection obligations (e.g. no transparency)

It then follows that if the watch-list, for example, involves details of criminals wanted by the police, many facial recognition systems will process personal data in total secrecy (i.e. no transparency).

This blog explains how the No.2 Bill’s definition of personal data moves such facial recognition CCTV systems into the twilight zone.

Suppose a facial recognition CCTV system is linked to a watch-list of suspects whose facial features have already been digitised (perhaps using the digitised biometric images derived from passport photographs).

Obvious examples of such watch-lists are: (a) a list of those who are of interest for law enforcement purposes or (b) those who commit a crime if they enter a specific area (e.g. those who have been excluded from entering a specific shop).

Suppose further, such a CCTV system is set up in a shopping centre and performs facial recognition on everybody who passes any of the system’s cameras.  The system sends a warning message to the camera operator if someone, on the watch-list, passes the camera; the system also retains the relevant images and other details of the encounter.  Only personal data of those on the watch list are retained.

The system is so designed that the details of those who are NOT on the watch list are not retained (i.e. deleted instantaneously) after the check against the watch-list is complete.

Bridges v South Wales Police

The system described above is the one that featured in the Court of Appeal judgement (Bridges v South Wales Police: paragraph 9, see references).  In this case, the data protection regime (in the DPA1998 and the pre-Brexit GDPR/DPA2018) was fully engaged because the Court determined that “personal data” were being processed about every individual whose image was captured by a Facial Recognition CCTV camera.

In the Bridges case, the Court’s interpretation of the definition of personal data was crucial.  This was derived by reference to Recital 26 of the pre-Brexit GDPR (or to Recital 26 of Directive 95/46/EC when the DPA1998 applied). These Recitals specified that if the information processed related to a living individual who was being singled out, then “personal data” were being processed.

Paragraph 46 of the Bridges judgment makes this point clear.  It states:

46. The primary point of dispute before the Divisional Court under the DPA 1998 was the extent to which using AFR Locate [the name used for the Facial Recognition CCTV system] entails processing personal data, SWP [South Wales Police] contending that the only personal data processed is the data of persons on the watchlist on the ground that it is only those persons that SWP can identify by name.

Having referred to the judgment of the Court of Appeal in Vidal-Hall v Google Inc [2015] EWCA Civ 311, [2016] QB 1003, and to the decision of the CJEU in Case C-212/13 Rynes v Urad [2015] 1 WLR 2607, the Divisional Court concluded (at [122]) that the processing of the Appellant’s image by the AFR Locate equipment was processing his personal data because the information recorded by AFR Locate individuated him from all others, that is to say it singled him out and distinguished him from all others.  (My emphasis).

As we shall see, “singling out” is NOT found in the new statutory definition of “personal data” in the No.2 Bill, and it is this omission that has significant consequences (i.e. SWP’s arguments in the first part of paragraph 46 as quoted above become correct).

Recitals are not law

The definition of personal data in the No.2 Bill is at first sight unchanged: “Personal data” means any information relating to an identified or identifiable living individual.  However, the No.2 Bill introduces the concept of direct or indirect identification of the individual into the statutory definition.

This new statutory definition, which also does not meet the standard of the Council of Europe Convention No 108 set in 1981 (see references), makes sure that the interpretation in Recital 26, as used in Bridges), is largely redundant.

This is because the Recitals themselves have no legal effect in the UK.  This was established in the case of Sanso Rondon v LexisNexis (see references), when the Court invalidated a requirement in Recital 80 (namely “the designated representative [of a controller or processor established outside the UK (or EU)] should be subject to enforcement proceedings in the event of non-compliance by the controller or processor”).

The Court came to this conclusion because the requirement was found only in Recital 80 and was not explicitly linked in any obligation in any Article of the GDPR.  That is why the Court concluded that, in relation to the liability of the representative for non-compliance (e.g. by a controller):

“…if the GDPR had intended to achieve 'representative liability' [for non-compliance as specified in Recital 80] then it would necessarily have said so more clearly in its operative provisions [i.e. the Articles of the GDPR]…(paragraph 101).

In other words, the Recitals are there to help interpret the legislation if there is doubt as to what the statutory requirements in an Article mean.  If a provision described in a Recital is not echoed in a relevant Article, then the interpretation in the Recital can be invalid.

In summary, the requirement for “singling out”, although it remains in Recital 26, it is not supported by any “operative provisions” found in the new statutory definition of “personal data”.  To the contrary, the new “operative provisions” of the definition work to exclude any prospect for “singling out”.

DPDI definition of “personal data”

The No.2 Bill additionally requires that to be “personal data”, there has to be a living individual who is directly or indirectly identifiable; in the latter case, indirect identification has to be at the time of the processing and by using reasonable means.

This raises three additional questions to be answered before the processing of “personal data” by a CCTV system, similar to that under discussion, can be confirmed.

The first question is:  ‘Are individuals identified “directly”?’.  The No 2 Bill requires that “An individual is identifiable from information “directly” if the individual can be identified without the use of additional information”.

Clearly, in the case of facial recognition CCTV, the answer is NO.  This is because additional information has to be used to perform the identification of those images captured by a facial recognition CCTV system (e.g. the pre-recorded details of those on the watch-list).

In other words,  direct identification, is not relevant because identification of a living individual (on or off the watch list) requires "the use of additional information" (contrary to the definition of direct identification).

The next question is: ‘Are individuals identified “indirectly” as defined?’.  The No.2 Bill states that “An individual is identifiable from information “indirectly” if the individual can be identified only with the use of additional information”.

Clearly, the answer is YES as additional information is available as part of the CCTV system to identify those individuals on the watch-list.

But what about those NOT on the watch-list?

This question is answered by the third question in the series: “Is indirect identification easy to do “at the time of the processing” and by “using reasonable means”  (Clause 3A(2) requires “the living individual is identifiable .… by the controller or processor by reasonable means at the time of the processing”).

In this case, for those not on the watch-list, there are no reasonable means of achieving identification available at the time of the processing (e.g. from the time of collection by a camera, checking the watch list, and then its instantaneous deletion).

There are three main reasons for this conclusion:

• first, there is no “additional information” that is available by “reasonable means… at the time of the processing” in the CCTV system itself (or held by some other person);
• second, the image of the individual and related biometrics have been deleted almost instantaneously, so there is no need for additional information to perform the unwanted indirect identification;
• finally it would be unreasonable to ensure the Facial Recognition system retained details of individuals not on the watch-list. The far more reasonable proposition is to protect the interests of such individuals is by deleting their personal details instantaneously, as such deletion guarantees their privacy.  In addition,  the captured details cannot be further processed for purposes other than the original check of “is this individual on the watch-list?”.

In addition, Article 11 of the UK_GDPR specifically states that additional information is not required to be collected.  It says:

A.11(1) “If the purposes for which a controller processes personal data do not … require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation. (My emphasis to show that this is the case when an individual is not on the watch-list).

Hence, there are no data protection obligations placed on those data that concern those whose images are collected and then instantaneously deleted because the individual is  NOT on the watch list.  Quite simply, such a CCTV system does not process personal data (as newly defined) in these circumstances.

The data protection regime of the No.2 Bill only applies to those on the watch list.

Why secret CCTV facial recognition systems?

As a facial recognition system is not processing personal data if an individual is NOT on the watch list,  then there is no need to be transparent as the UK_GDPR does not apply.  There is no need for a lawful basis nor a condition to overcome the processing of Special Category of Personal Data as the information processed is not personal data.

Transparency is only needed for data subjects on a watch list.  However,  there are a number of exemptions in the DPA2018 that provide the controller relief from the need to be transparent if being transparent would prejudice the crime, taxation, immigration or law enforcement purposes etc (e.g. Schedule 2, paragraphs 2 or 4; Section 44 of the DPA2018).  Hence there is no need to be transparent in these cases also.

It follows that many facial recognition CCTV systems can be installed without any transparency obligations and used more or less in secret.  As stated at the beginning of the blog, they enter the data protection twilight zone.

As this is the case, expect the number of Facial Recognition systems to mushroom exponentially after the enactment of the No 2 Bill.

References

Edward Bridges and -the Chief Constable of South Wales Police: Neutral Citation Number: [2020] EWCA Civ 1058

Sanso Rondon v LexisNexis; Neutral Citation Number: [2021] EWHC 1427 (QB)

Definition of “personal data” in DPDI No 2 Bill results in non-compliance with CoE Convention No.108: https://amberhawk.typepad.com/amberhawk/2023/04/definition-of-personal-data-in-dpdi-no-2-bill-results-in-non-compliance-with-coe-convention-no108.html

Data Protection Courses (Summer 2023)

An all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill. Will be held on Thursday 13 July  2023 hopefully to include changes made during the Committee stage of the Bill.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection FOUNDATION Course is on Zoom only (June 20-22, 2023 (Tuesday to Thursday, 3 days: 45am to 5.00pm).
• The next Data Protection PRACTITIONER Course is in London on Monday, 24 July 2023 to Friday, 28 July 2023 (5 days: 9.30am to 5.30pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing [email protected].

Data Bill makes any data sharing with any public sector body lawful

This blog considers how the Data (Use and Access) Bill (the “Bill”) impacts on the lawful bases used in the context of voluntary data sharing with public bodies.

In summary, the Bill creates an infrastructure of Ministerial powers that ensures voluntary data sharing to the public sector has a lawful basis;  that such data sharing is not incompatible with the purpose of obtaining, and that such data sharing is, in practice, exempt from the right to object.

These powers have to be combined with the ability of Ministers in Article 23(1)(e) to specify new exemptions that can negate other data subject right on the grounds of “general public interest”. (This will be the subject of my next blog).

By creating a comprehensive gateway for voluntary disclosures to the public sector, the Bill also has the effect of undermining the role of Parliament in determining the conditions under which an organisation is obliged to provide personal data by law.

These Ministerial powers have been criticised by the House of Lords Delegated Powers and Regulatory Reform Committee (see references).  It recommends that the powers should be removed from the Bill, because they are “inappropriate” and the justification for them, provided by Government, is “unconvincing”.

For example, in relation to the removal of the power to negate Purpose Limitation Principle the Committee concluded: “Given the fundamental nature of that principle and the fact that we found the Department’s reasons for needing the power unconvincing, we took the view in our report that the delegated power was inappropriate” (and recommended its removal).

I would add that the first paragraph of Annex 1 (which legitimises disclosures to any public sector body) should also be removed from the Bill.  This blog explains why.

Recognised Legitimate Interests

The Government’s justification for the change in data protection  law is seductively simple; it goes like this.

Data protection is hard for many controllers, especially when faced with a one-off request for disclosure of personal data from any law enforcement agency, an agency that protects vulnerable children and adults, a national security agency, a defence agency, and for public security purposes or in emergency situations (e.g. floods).

In these circumstances, so the Government claim, many organisations hesitate and do not know whether to disclose personal data or not.

Hence the Bill will clarify the law by providing a list of Recognised Legitimate Interests, so controllers can disclose without performing any balancing test of the competing interests.  This is because Recognised Legitimate Interests have pre-determined the balance of interests is in favour of disclosure of personal data.

Hence, it is unlikely that there will be any overriding interests on the part of the data subject and that, as a result, the right to object to disclosure (and perhaps other subsequent processing that depends on that disclosure) is effectively extinguished.

Just in case the Government needs flexibility, it has provided a Ministerial power to make variations or additions to these Recognised Legitimate Interests.

How does disclosure work now?

So, suppose you get a request from a Local Authority Social Work Department:  “We are worried about Child X; can we have a copy of your personal data that relates to Child X?”. You go through some security questions to ensure it’s not a hoax (e.g. check who is asking) and then you can move on to the decision whether to disclose or not.

In order to make this decision, you will probably ask for information about the circumstances pertaining to the disclosure (e.g. “what are the worries”; “what do you want from us”; “how would our personal data help you” etc).  Normally you will need this type of information before you decide whether to disclose(or not).

If the request is genuine and the concerns about Child X are real, you have a choice.  Protect Child X or protect the putative child abuser’s privacy. So which one is it?

Not a difficult choice is it?

Then you square the disclosure of personal data with the data protection requirements.  Currently such a disclosure would be necessary “in the legitimate interest of a Third Party” (the Social Work Department) and the questions you have asked (e.g. why would our personal data help etc) create the balancing test of whether there exists overriding interests on the part of the data subject in not disclosing.

How does disclosure work under the Bill?

Now we come to the Bill and, for example, how it proposes to deal with the same disclosure protecting vulnerable children.  Remember the decision in favour of disclosure is baked in.

In response to the question: “we are worried about Child X; can we have a copy of your personal data concerning Child X?”, are you going to respond as follows:

“We have checked you are a Social Work Department and a public body with responsibility for child protection. You have asked for these personal data because they are needed to protect Child X.  We are NOT interested in any other details, so here is your personal data.”

Similar with an emergency:

“We know you are a public body tasked with responding to an emergency. You have asked for certain personal data that you state are needed.  We are NOT interested in what the emergency is, so here is your personal data”.

I suspect the answer is “NO”.

In practice, I also suspect you would still ask the questions of the kind: “what is the emergency or worries”; “what do you want from us”, and “why would our personal data help you” etc to decide whether or not to disclose.

In the rare case of a decision not to disclose, the fact that the lawful basis is a Recognised Legitimate Interest would not change that decision.  This is because the data protection considerations come after the details that inform the decision at to whether (or not) to disclose personal data.

In other words, there is very little will change in relation to the Recognised Legitimate Interests described above.  Controllers will still assess the situation prior to disclosure and the data protection elements are a  secondary consideration, and only relevant in support of the decision to disclose personal data.

This is why I have concluded all the Recognised Legitimate Interests are unnecessary in DP terms (except for one which we will come to next).   I am quite relaxed about the Recognised Legitimate Interests in the Bill (except for the one which we will come to next) because nothing has really changed.

Real reason for Recognised Legitimate Interests

The Recognised Legitimate Interest  the Government has wanted for some time has been piggy backed on all the others mentioned above.  It reads as follows:

“the processing is necessary for the purposes of making a disclosure of personal data to another person in response to a request from the other person, and

the request states that the other person needs the personal data for the purposes of carrying out processing … [for its public task or in its official authority under UK law].  The actual words used are “…described in Article 6(1)(e) that has a legal basis that satisfies Article 6(3)”.

This means any public body can ask any other controller (usually private sector) to disclose any personal data because they are needed for its functions.

And what is the purpose of this disclosure?  Because other Recognised Legitimate Interests do not apply, this purpose has nothing to do with law enforcement, protecting the vulnerable, national security, defence, public security or emergencies.

In summary, any old purpose will suffice so long as:

(a) it does not fall within the list in the last paragraph and

(b) the controller can claim that it is necessary for the functions of the public body asking for personal data.

And who enforces claims that the data subject has been wronged? Well it’s the ICO (who current policy is not to do much enforcement against the public sector).

In summary, the provision allows any public body to obtain any personal data from anybody else and places responsibility on the ICO to police every voluntary disclosure to the public sector via this provision.

Anybody should be able to see that this is not a viable system of regulation.

As a result, the provision risks degrading into an unregulated,  “free for all”,  voluntary data exchange with the public sector (which, of course, certainly since the ID Card Act debates of 2005, successive Governments have always wanted).

Undermining of the role of Parliament

Parliament has given, for example, HMRC powers to demand personal data; these have been debated and contested.  By contrast, this new voluntary approach negates the need for future debate over statutory powers because, in our example,  HMRC can merely ask via the new voluntary disclosure route.

To explain how this could work, suppose you get the following request from HMRC:

“We are investigating certain matters relating to taxation; can we have a copy of all  your personal data relating to the following list of your employees.  Such a disclosure of personal data would be lawful as it is a Recognised Legitimate Interest”.

So suppose you respond with:

“It would help us to decide whether to disclose if you could give us the further details: […followed by a list of questions pertaining to the disclosure].

Now you get the response:

“We do not want to answer your questions because it could have an impact on our inquiries. We have given you a clear statement that this disclosure is lawful and necessary for our public task. Because the disclosure is a Recognised Legitimate Interest, no reason has to be provided to you.  We confirm that there  is no impediment to your disclosure of personal data to us.”.

So over to you.  Would you disclose?  Is this an invitation to disclose you can’t refuse.

Now I am sure many brave data protection staff would say “no” but the decision to disclose does not depend on the bravado of DPOs.  I am fairly confident that many senior managers will conclude: “We don’t want to upset HMRC,  for the sake of a quiet life and good relations we will disclose”.

In this way, the statutory route for disclosure gives way to the new, possibly  “voluntary” route, where most controllers will “comply with the request”, albeit with gritted teeth.  HMRC’s statutory powers to demand personal data are unused (when Parliament expects them to be used) and held in reserve.

This explains why the first Recognised Legitimate Interest should be removed from the Bill.

Winter Data Protection Courses

Amberhawk is holding our first session on the changes to the UK’s data protection regime arising from the Data (Use and Access) Bill, by Zoom, on Tuesday January 28^th 2025: (10.00am-4.30pm;  £275+VAT).

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course: London on January 20-24 (5 days: Monday to Friday: 9.30am to 5.30pm) and on March 17 to March 21 (same timings).
• Data Protection FOUNDATION Course: London on March 11-13 (Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].

References

House of Lords Delegated Powers and Regulatory Reform Committee, 9th Report of Session 2024–25, HL Paper 49 (28 November 2024).

“Legitimate Interests” for AI Training? Remember the common law of confidence.

There is a current debate as to whether “legitimate interests” can be reliably used as a lawful basis by a controller when using personal data to train/test AI algorithms/systems and when AI systems are deployed.

This blog explains how the common law of confidence and two recent CJEU decisions work together to challenge this assumption.

The first half of the blog explains why “legitimate interests” can work as a lawful basis for AI training/testing in some instances.  In the second half, I explain why, because of confidentiality constraints, “legitimate interests” does not work in general.

What is surprising is that reference to the common law of confidence is absent from the ICO’s guidance on AI.

When does legitimate interest work

Suppose a controller wants to explore the use of AI to make “efficiency savings” (e.g. a euphemism for reducing staff numbers) or to “enhance customer experience” (e.g. making it harder for a customer with a difficult problem to talk to a human).

Suppose further, nothing has changed in the controller’s processing environment except the desire to process its existing collection of personal data in order to explore the potential use of AI (i.e. “proof of concept” processing).

There are four key processing assumptions I am making in during this proof of concept phase; these are:

• the controller ensures that “there is no impact on any data subject of any kind whatsoever”;
• there are no transfers outside the UK and established security/accountability standards are maintained throughout the testing;
• no special category of personal data or criminal offence personal data are processed (as this would involve speculating about the Article.9 (UK_GDPR) or Schedule.1 (DPA2018) requirements); and
• personal data relating to those who have objected to marketing are excluded, if direct marketing is a main objective of the deployment phase of AI.

The CJEU has determined (twice) that a commercial interest of the controller is indeed a legitimate interest (see references). This means that the controller can rely on the legitimate interests lawful basis to assess whether it can improve services and profitability using AI.  In DP terms the “processing is necessary for the purposes of the legitimate interests pursued by the controller” (the first part of the balancing test required by A.6(1)(f)).

At the same time, there is little risk that “such interests are overridden by the interests … of the data subject...” because there is no impact on any data subject.  Put simply, the counter-balancing risk of an overriding interest on the part of the data subject almost vanishes because of the application of the first bullet-point assumption above.

Second there is no need to do a DPIA (A.35).  A DPIA is only needed when the processing “is likely to result in a high risk to the rights and freedoms of natural persons”.   However, as the controller has determined that its own AI proof of concept processing has no impact on the data subject, there is no high risk to any data subject.  A DPIA is unnecessary.

Third, there is no need to worry about the automated decision making provisions (A.22).  These apply when “a decision based solely on automated processing, including profiling… produces legal effects concerning him or her or similarly significantly affects him or her”.  There again, the controller has determined at the outset the proof of concept processing presents no legal/significant effects on any data subject. So no worries then.

Fourth, there are no incompatibility issues (as per A.6(4) and A.5(1)(b)) as the processing for a further purpose is very similar to the purpose of obtaining (e.g. the exploration of how existing services, known to the data subject can be improved by processing personal data using AI techniques).

This is because there is a strong “link between the purposes for which the personal data have been collected and the purposes of the intended further processing” (the test in A.6(4)(a)). Additionally there is no change in “the relationship between data subjects and controller” (test in A.6(4)(b)),  and “the possible consequences of the intended further processing for data subjects” are negated (test in A.6(4)(d)) because there is no impact on any data subject.

Fifth, there should be no problems concerning the data subject’s right to object (A.21).  This arises because the data subject has to present “grounds in relation to his or her particular situation”, and these grounds are going to be difficult to establish if the processing has no impact on any data subject.

Finally, the Transparency/Privacy Notice might need adjusting, but not if it already says something like “we additionally use your personal data to develop or improve our services to you”.

The above analysis works for the proof of concept phase when using ordinary personal data which, as we shall see, are not subject to an obligation of confidence.

Obviously the provisions that are ignored during the testing phase must be considered before the processing moves beyond the proof of concept phase.  Indeed, there would be no point proceeding with any proof of concept processing, if there were to be no lawful basis for the deployment phase itself.

The common law of confidence

Suppose you tell me something in confidence. What are you expecting me to do after you have told me?  Can I use or disclose this confidential information for my benefit without your consent?

In general, a duty of confidence can arise either expressly or by implication if:

• the content of the information possesses the “essence” of confidentiality (e.g. something personal or sensitive for whatever reason), and
• the information has been collected in circumstances where confidentiality can be expected (e.g. in a closed room where you and your GP/solicitor discuss your medical/legal options).

Not all the information imparted is subject to an obligation of confidence, and in general, there needs to be a case-by-case analysis of the specific circumstances surrounding the transfer of information.  Confidential details can easily lose any claim to confidentiality (e.g. if overheard as part of a noisy argument or displayed on a laptop screen when travelling on a crowded train).

In summary, your financial personal data are usually confidential, but not if financial details have been made public on Facebook.  Your medical record is confidential, but your name and address contained in that record might not be confidential.  By contrast, names and addresses of those in witness protection are obviously confidential.

In general, a duty of confidence often arises with the following personal data: financial affairs, tax, benefits, means testing, grants, health, social work, education and policing.  Employee personal data are often confidential (e.g. Occupational Health or disciplinary mechanisms) but your pay grade is unlikely to be confidential (as pay grades are made public in job adverts).

Indeed, special category of personal data and criminal offence personal data are often good examples of confidential personal data.

A breach of confidence

A breach of confidence can arise by a use or disclosure of confidential details for another purpose.  “Disclosure” is widely recognised as a cause of a breach of confidence (e.g. a GP who discusses your medical records in the pub), however much case law relates to “use”.

This historic use case-law often related to the protection of Intellectual Property.  For example, suppose you are a Victorian widget manufacturer (circa 1880).  I come to you with a “super-widget” design and once you have satisfied all my orders, you begin producing a “super-duper widget”, based on my design, in competition with me.  Perhaps you can improve my design – who knows.

The point is that you could only have produced your “super-duper widget” by using the confidential design for my super-widget.  You have not disclosed any confidential information you received, rather you used that information for your benefit instead.

Coming back to data protection, “use” and “disclosure” are “processing” operations.  Hence to use or disclose confidential personal data for other purposes can involve a breach of confidence.

Of course, confidentiality is not an absolute. There are several legal requirements (e.g. Court Order, statutory demand) or public interest reasons (e.g. law enforcement request, protecting children or the vulnerable) where one can lawfully set aside an obligation of confidence in the absence of consent.

However, if these two do not apply, then the only justification for setting aside an obligation of confidence is when the data subject has consented to the further use or disclosure.

This includes using existing confidential personal data for AI training purposes  (and indeed in any deployment phase).

Consequences (CJEU)

There are two decisions of the CJEU that support the above argument. CJEU case 621/22, which concluded that a controller can rely on the legitimate interests lawful basis for commercial reasons so long as the controller ”having regard to all the relevant circumstances, that the interests or fundamental freedoms and rights of those users [a reference to the interests of the data subject] do not override that legitimate interest of the controller”.

In my view, the interests of the data subject in maintaining his or her confidentiality are very likely to override the legitimate interests of the controller who sets confidentiality aside for its own commercial interests.

The relevant conclusion of CJEU case 621/22 added that whilst the legitimate interest pursued by that controller do not require “that such an interest be determined by law, it requires that the alleged legitimate interest be lawful”.

In my view this means that in the UK, the reference to a lawful legitimate interest includes the consideration of the application of the common law of confidence to that legitimate interest.

Concluding comment

It is likely to be difficult to rely on “legitimate interests” as the correct lawful basis if confidential personal data, already processed by a controller, are further used in AI proof of concept processing and in later deployment.

This is because it is usually in the overriding legitimate interest of the data subject to preserve his or her own confidentiality over the commercial interests of the controllers that happen to supply services to the data subject.

Confidentiality constraints, in my view, push one in the direction of consent as the correct lawful basis.

Winter Data Protection Courses

Amberhawk is holding our first session on the changes to the UK’s data protection regime arising from the Data (Use and Access) Bill, by Zoom, on Tuesday January 28^th 2025: (10.00am-4.30pm;  £275+VAT).

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course: London on January 20-24 (5 days: Monday to Friday: 9.30am to 5.30pm) and on March 17 to March 21 (same timings).
• Data Protection FOUNDATION Course: London on March 11-13 (Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].

References

CJEU Case C-252/21  (involving Facebook/Meta)

CJEU Case C‑621/22 (involving Koninklijke Nederlandse Lawn Tennisbond)

ICO’s lawfulness guidance on AI: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-do-we-ensure-lawfulness-in-ai/#purposes

What are the main features of the Data (Use and Access) Bill?

The blog concerns the content of the new  Data (Use and Access) Bill (DUAB) as published last week; it bears a strong relationship with the previous Data Protection and Digital Information (DPDI) Bills.  In fact, DUAB could easily have been named the DPDI (No 3) Bill.

The Bill itself is 138 Clauses, 16 Schedules and 251 pages; many of the provisions of DPDI re-appear in DUAB but with different Clause numbers. The Bill is a complex read as its data protection changes appear as amendments to existing legislation (i.e. one has to cross reference DUAB with the DPA2018 and the UK_GDPR to find out what is happening).

There are, in addition, three immediate political consequences with start of the Parliamentary processes in the House of Lords.

• First, it will be difficult for the official opposition to oppose DUAB since it contains many of the Conservative’s DPDI proposals. In other words, apart from the odd maverick intervention, the opposition to this Bill will not come from the two main political parties.
• Second, the Bill has started its Parliamentary life in the House of Lords. This, from the Government’s perspective, gets the awkward Parliamentary stages out of the way first and at a time when Peers and NGOs have not had much time to really understand the detail of the Bill’s proposals. The Commons passage is likely to be cursory given the Government’s majority in the Commons (as it was with the DPDI Bills).
• Third, if the Bill, after Second Reading in the House of Lords, is remitted to be considered under the Grand Committee procedure of the House of Lords, then voting on amendments to the Bill in Committee will not occur. This means that the Report stage will be the main area of voting contention, and where Government amendments to the Bill will surface for minimal debate. So expect Parliamentary scrutiny of the Bill’s content to be much diminished.

The blog is in three parts: what has been dropped from DPDI; what has been copied from DPDI; and what is new. If I have missed something out, please let me know.

Just so you know; I am reinstating our Zoom sessions on the major changes to the UK_GDPR and DPA2018, arising from DUAB, on January 28^th next year (Data Protection Day); details at end of the blog.

What was in DPDI but not in DUAB

DUAB does not contain any proposals:

• to weaken the definition of “personal data”.
• to change the status of Data Protection Officers (so Senior Responsible Individuals are gone).
• to change the requirements associated with the Record of Processing Activities maintained by a Controller or by a Processor.
• to change the circumstances when a DPIA has to be completed.
• to remove the requirement to have prior consultation with the ICO if there are high risks to data subjects that cannot be mitigated after a DPIA has been completed.
• to exclude subject access requests because they are vexatious.
• to encourage “electoral engagement” (I did not understand these in the DPDI anyhow).
• to specify the ICO’s strategic direction (but I suspect this can be done by other means).
• to permit the DWP access to bank records of benefit claimants including pensioners (expect this to appear in other Benefit related legislation).
• to abolish the Home Office’s Biometrics and Surveillance Camera Commissioner and merge the latter responsibility for CCTV with the ICO’s role.
• to scrap the requirement for a Representative in the UK if the controller is based outside the UK and offering services to those residing in the UK (i.e. the Representative in the UK is needed).

What’s in DUAB that was in DPDI

Like DPDI, the DUAB contains proposals that:

• Install a lawful basis of “recognised legitimate interests”, the most important one being the ability of any public body to ask another controller (usually in the private sector) for the disclosure of personal data it needs to deliver its functions. This applies to all public bodies and the Secretary of State (SoS) has powers to add to the “recognised legitimate interests” (but see next bullet). It is difficult to see how the right to object can prevail if the processing is made lawful in terms of a “recognised legitimate interest”.
• Specify that certain further processing purposes as compatible with the purpose of the obtaining of personal data; the SoS has powers to add to the list of  further “compatible” processing purposes.  These powers are unfettered; in extreme, it permits any future Government to define processing to be lawful, compatible (and provide for exemptions from rights courtesy of A.23(1)(e)).
• Introduce a lawful basis that allows USA law enforcement authorities to obtain telecommunications data for its law enforcement purposes, as per a reciprocal Agreement with the USA (the “Access to Electronic Data for the Purpose of Countering Serious Crime”) signed by Priti Patel when she was Home Secretary (October 2019). There is no information provided as to how this international Agreement has worked in practice or whether it is equally balanced.
• Limit the right not to subject to automated decision making processing or profiling to special category of personal data; this facilitates automated decision or profiling using normal personal data. Controllers are therefore free to make such automated decisions (e.g. to use AI techniques on the information scraped from the internet on applicants for employment).  This is “wild west” deregulation and is just asking for trouble.
• Clarify the time limits associated with the exercise of data subject rights (e.g. dealing with requests when the data subject’s original request does not identify the data subject).  The controller does not need to make excessive searches for the requested personal data; the search for personal data has to be "reasonable and proportionate ".
• Provide the data subject has the right to complain to the controller (i.e. to resolve an issue with the controller before complaining to the ICO); in summary this looks as if an FOI type internal review procedure will be needed.
• Overturn the 40 year old requirement (from DPA1984 days) to obtain consent for Third Party marketing as such marketing can be in the “legitimate interests” of that Third Party (i.e. an opt-out will do instead).
• Disapply transparency requirements when personal data are used for RAS purposes (Research, Archive and Statistical purposes) and to make any further RAS purpose always compatible with the processing so long as what is called “the appropriate safeguards” apply. This means that personal data can be exchanged secretly between a controller and any number of Third Parties for RAS purposes.  As with DPDI, one of safeguards does not impress: there is a requirement for the personal data processed not to cause “substantial damage” or “substantial distress”, as if causing “just short of substantial damage/distress” is acceptable.
• Permits the SoS to apply a “data protection test” when considering whether a country, part of a country, or a controller located in an country offers an adequate level of protection. These provisions increases the risk of divergence from European transfer standards if the European Commission and UK Government have different views on what “adequate” means.  Also I don’t understand how a country is not deemed adequate, but a controller, processor, or recipient located in that country is.
• Reinstates the complex proposals for transfers outside the UK for law enforcement; this includes the possibility of a law enforcement controller transferring personal data for law enforcement purposes by assessing the data protection test (instead of Secretary of State).
• Allow the SoS to designate that certain police personal data sets become subject to national security rules (i.e. the personal data subject to Part 3 of the DPA2018 can be designated as being subject to Part 4). The difference: the ICO can enforce Part 3, he can’t enforce Part 4 and the proposal has the effect of taking large volumes of personal data out of the UK's data protection regime.
• The ICO is abolished in favour of the Commission. The problem remains that the SoS appoints the most important members of the Commission and this ability to appoint has the potential to give the SoS undue influence over the Commission’s decision making processes (e.g. determining the policy towards enforcement of AI).
• The Commission still has to have regard for: the desirability of promoting innovation and competition; the importance of the prevention, investigation, detection and prosecution of criminal offences; and the need to safeguard national security.  In other words, these “regards” could fetter decisions to protect the privacy of data subjects.

What’s new

The new items I have identified are:

• Allowing the SoS to add items of special category of personal data so that the processing of newly define types of special category of personal data is prohibited (the example given is “neurodata”). These provisions cannot be used to modify the existing list of special category of personal data specified in A.9(1).
• Giving the Treasury powers over the use and disclosure of “business data” and “customer data” with the permission of the customer. If the “customer data” are also personal data, you may have to grapple with "recipient", "third party" and now “third party recipient” (so good luck with that one).  The objective is to establish “smart data” schemes, which allow the use the customer’s data to provide services for the customer or business as well as sharing or publication of contextual business data.

Concluding comment

There is no Keeling Schedule published for the DUAB at the moment; as with the DPDI Bill, the absence of a Keeling Schedule significantly hinders any prospect of an informed public debate about its content. Perhaps the ICO could publish one?

One cannot expect anyone to understand what the Government proposes if one has to cross reference the DPA2018; the UK_GDPR and this Bill at the relevant pages where amendments are proposed.  This is especially important as there appears to be major concerns (listed above).

I shall be returning to DUAB; so watch this space.

References

All DUAB documents (the Bill; explanatory memorandum etc) can be obtained from  https://bills.parliament.uk/bills/3825/publications

Winter Data Protection Courses

The first all-day Zoom workshop (10.00-4.30)  on the DATA (USE AND ACCESS) BILL will be held on Tuesday 28 January 2025  (£275+VAT per place).

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London on Monday, 18 Nov to Friday, 22 Nov and Monday, 20 Jan to Friday, 24 Jan 20 (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (December 8-10: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].

Data protection policy should return to the Ministry of Justice

The incoming Labour Government has expanded the role of the Department for Science, Industry and Technology (DSIT) by transferring many IT/data related functions from other parts of Government (mainly the Cabinet Office) into DSIT.  The objective is to make DSIT an important driver for economic growth.

In further detail, “experts in data, digital and AI from the Government Digital Service (GDS), the Central Digital and Data Office (CDDO) and the Incubator for AI (i.AI) [have transferred to DSIT] to unite efforts in the digital transformation of public services under one department” (see references).

The objective is to “transform public services and fuel economic growth through science and technology”.  This “will be the defining mission of a revamped [DSIT] department” and comprise the “first steps towards building a modern digital government”.

However, if such objectives comprise the strategic mission for DSIT, the questions that must be answered are:

• How do these economic objectives interact with DSIT’s approach to data protection policy?
• Will there be a repeat of an approach which viewed data protection as sand in the oil of economic progress and an inhibitor to wider data sharing across the public sector?
• Will data protection policy become subservient to economic priorities?

Historical approach to DP policy

For the two decades from 1984, governmental responsibility for UK data protection policy was very problematic.  For instance, the DPA1984 (and DPA1998) were both a minimal implementation of Council of Europe Convention No 108 (and Directive 95/46/EC) in order to have minimal impact on controllers, the economy and provide the minimal protection for data subjects as compared with European standards.

Any data protection specialist who worked with either the DPA1984 or DPA1998 will remember that both sets of legislation were characterised by a weak regulatory regime, diminished rights and both carried a minimal threat of enforcement.

In addition, both DPAs (and FOIA) were enacted under the auspices of the Home Office, courtesy of its strangely named “Liquor, Gambling and Data Protection Unit”.

This meant that the Home Office, which has the political responsibility for functions that were very invasive of privacy (e.g. law enforcement, national security), were also charged with the responsibility of developing policies for protecting data subjects from such invasion.

It can be seen that this represents a huge conflict of interest.  If you have ever questioned why the data protection or FOI exemptions in these early Acts were very expansive when applied to Home Office functions, the answer is, quite simply, staring you in the face!

However, in 2007, responsibility for Data Protection, FOI, Human Rights and related civil society matters were centralised at the Ministry of Justice (MoJ); a neutral Department of State that did not have a vested interest in the processing of vast amounts of personal data for specific public sector functions like tax, housing, health, policing etc.

In data protection terms, the transfer to the MoJ, lifted responsibility for DP policy from a Home Office which processed large amounts of personal data in support of an opposite policy direction.

Why was the MoJ dropped?

The short answer is Micheal Gove MP, when he became Secretary of State at the Department for Education (DfE) in 2011 and thence Lord Chancellor, at the MoJ, in 2015.

In 2011, a FOI request to the DfE included a request to access information contained in Mr Gove’s Hotmail emails to and from his political advisor (“Mr and Mrs Spad”).  Mr Gove’s Department refused the request on the grounds that the relevant emails were private emails and the requested information was therefore not held by the DfE (as they would have been if the official gov.uk email address had been used).

This was despite the fact that the Hotmail communications related to official DfE business.

The FOI request was refused by the DfE and this was followed by appeal to the ICO and the inevitable Decision Notice in favour of the requestor.  Mr Gove’s Department appealed the Notice but the appeal was withdrawn before the Tribunal hearing.  Much, one assumes, to Mr. Gove’s ire.

All became quiet on the Westen Front, until Mr Gove arrived at the MoJ as Lord Chancellor after General Election in May 2015.  On October 15, 2015 he scattered policy responsibility for IT/data related matters to the winds.

For instance, responsibility for:

• Data Protection was transferred to the Department for Culture Media and Sport (DCMS) and thence to DSIT when this Department was formed by Rishi Sunak.
• Data Protection for law enforcement and national security was, in practice, returned to the Home Office.
• Human Rights law (including Articles 8 & 10) was retained by the MoJ.
• FOI and EIR (including DP/FOI/EIR interface) was transferred to the Cabinet Office.
• IT security for personal data processed by the public sector and the HMG Security Framework was managed by the Cabinet Office.
• IT security for personal data processed by the private sector (i.e. now surrounding the ISO27000 series) was developed by DCMS then DSIT.
• ID for Government Services developed by the Cabinet Office via Government Digital Service.
• Digital Verification Services parts of the defunct DPDI Bill were developed by DCMS then DSIT.
• Artificial Intelligence (i.AI) was launched in July 2023 by the Cabinet Office.

So much for joined up government!

Why a return to the MoJ

The Government’s changes, as announced, represent a partial reconstruction of responsibility for the above bullet points around DSIT (the first and the last four bullets from the list above).

The problem is that DSIT, with its enhanced responsibilities for AI, R&D and other technologies is intended to become an engine room for economic growth.  In these circumstances, data protection can all too easily be seen as an inhibitor (as it was with the previous Government).

The risk is then that DPDI-like provisions will re-emerge to provide wide ranging exclusions to ease the secondary use or disclosure of personal data in support of a turbocharged dash for growth.

To minimise this risk and to ensure that data protection is considered with its proper weight, responsibility for data protection policy should be returned to the MoJ.  Leaving DP responsibility in DSIT risks making data protection policy wholly subservient to its economic priorities.

References

Press release about DSIT’s enhanced responsibilities: https://www.gov.uk/government/news/dsit-bolstered-to-better-serve-the-british-public-through-science-and-technology

Post summer Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London (and Zoom) on Monday, 16 Sept to Friday, 20 Sept (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London (and Zoom) on (October 8-10: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].

New A.17 right to erasure in the UK_GDPR added during “wash-up”

Although the DPDI Bill is dead, you have probably missed the addition to the right to erasure (Article 17 of the UK_GDPR) which was made during “wash-up” period (last month) via another piece of legislation (the Victims and Prisoners Act ["VPA"] 2024).

In summary, the change in the law concerns what controllers do when there is a malicious complaint (e.g. to social services) and the procedure for removing that complaint, following the conviction of the complainant of a stalking or harassment offence and a finding that the complaint was malicious.  Phew, a number of conditions to explain!

The change to the A.17 can be found in Section 31 of the VPA Act; it deals with malicious reporting cases such as those as Stella Creasy (MP for Walthamstow, in London), which was publicised by the BBC. (See references for all relevant details).  The new right does not apply immediately; it has to be "commenced" by the incoming Government at sometime in the future.

The new right to erasure

The  VPA Act adds a new paragraph (g) to A.17(1). 

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay if…….

“…(g) the personal data have been processed as a result of an allegation about the data subject—

1. which was made by a person who is a malicious person in relation to the data subject (whether they became such a person before or after the allegation was made),
2. which has been investigated by the controller, and
3. in relation to which the controller has decided that no further action is to be taken.”

So who is a “malicious person”?  Quite simply a malicious person is a person who has made an allegation about a data subject AND that person has been convicted of a “relevant offence".  All the “relevant offences” are identified and relate to stalking or harassment;  they are tabulated in new Article 17(5) and there are ten such relevant offences.

Relevant offences include, for example, an offence under sections 2, 2A, 4 or 4A of the Protection from Harassment Act 1997 or section 8 of the Stalking Protection Act 2019.  Other legislation tabulated are the Scottish and Northern Ireland equivalent of these Acts, and specific legislation which deals with harassment and stalking offences committed by members of the UK’s armed forces.

Article 17(5) is accompanied with a new section 13A to the DPA2018 which provides an order making power to amend or add to the list of relevant offences via an affirmative resolution process.

When does the new right apply

Suppose male employee X stalks a female member of staff. The female member of staff reports it to HR and because of the seriousness of its preliminary investigation, the police get involved.  Supposes further there is an eventual prosecution of X for a stalking or harassment offence (i.e. a relevant offence) but the employee X’s defence, as explained to HR, involves scurrilous accusations against the victim.

Now clearly, the female victim might want HR to delete these allegations from her personal data. As there has been an investigation by the employer, a successful prosecution for a relevant offence and the employer has taken no further action against the female victim, then the new right applies to her.  However, this right does not apply to employee X, as the harasser/stalker is most likely sacked (where sacking is an “action”).

In summary, as there was an initial investigation before personal data were handed to the police, they can be deleted in relation to the female victim (no action against her) but retained in relation to the stalker (i.e. records can be kept of the reason for the sacking but not relating also to the victim).

Note that the new right does NOT apply to personal data processed by the police as their processing is likely to be subject to Part 3 of the DPA2018 (i.e. law enforcement processing) and not the UK_GDPR.

Enter Stella Creasy MP

Stella Creasy MP has faced such serious but false accusation concerning her children,  and this has influenced this amendment behind the scenes.  In the House of Lords’ debate the MP was thanked “for the amendments they have tabled on this issue, and their engagement with myself and officials in this area”.

In her case, according to the BBC, in 2023 a man told Leicestershire Police that her children should be taken into care due to her "extreme views".  This was followed by the MP reportedly facing a safeguarding review by the London Borough of Waltham Forest.

She was quickly cleared; the BBC reports that the man had objected to the MP breast feeding her newly born baby in the House of Commons chamber.

As there was a formal complaint to Police and it investigated a "number of emails" sent to the MP (presumably in the context of harassment). However, it was this police referral that triggered a statutory investigation by the Borough, and this explains why the Borough could not delete the personal data (even though it the Deputy Speaker of the House of Commons publicly criticised the "appalling abuse and harassment" Ms Creasy had received).

Because individuals can hold views that are wrong, the BBC reported that Leicestershire Police resolved the issue by “a community resolution rather than a formal sanction because the messages did not meet the threshold for a criminal offence”.

Concluding comment

You will note that the new right does not help Ms. Creasy get her personal data deleted, as the BBC report states that no relevant offence has been committed (see added note below).

This could have an unforeseen consequence; data subjects who are falsely accused by a stalker or harasser might put pressure on the authorities to prosecute in order to engage the new right.  This is preferable, from the victim’s perspective, than to allow the offender to be let off by treating the issue as some kind of misogynistic misdemeanour which results in the victim’s personal data remaining on file.

And that might not be a bad outcome.

Note added on 23/6/2024: there is a Times report dated 3rd December 2023 stating that Leicester Police changed their mind about harrassment and "a man from Wigston in Leicestershire, admitted harassment without violence and was given a 14-week prison sentence suspended for one year, in part because of overcrowding in prisons. He was also given a three-year restraining order and will be required to carry out 120 hours of unpaid work". (see updated references below).

References

The Parliamentary debate about the new right to erasure in A.17(1)(g) of the UK_GDPR: https://hansard.parliament.uk/Lords/2024-05-23/debates/CC504D8F-CC76-4EBB-9FF3-09FD1D2C2E74/VictimsAndPrisonersBill

Section 31 of the Victims and Prisoners Act 2024: https://www.legislation.gov.uk/ukpga/2024/21/section/31/enacted

BBC story “Stella Creasy: Call for action after online troll sparked MP probe” https://www.bbc.co.uk/news/uk-england-london-65463367

Times report (3/12/2023) on the re-opened case: "Troll’s harassment of Stella Creasy one of worst cases judge has seen" on https://www.thetimes.com/article/stella-creasy-labour-mp-online-troll-philip-stacey-guilty-0k9mzzmls

Forthcoming Data Protection Courses

The next Data Protection PRACTITIONER Course is in London on Monday, 16  September  to Friday, 20 September (5 days: 9.30am to 5.30pm).  Remember also our specialist DP qualification for those in Education. 

Details from www.amberhawk.com

Labour should not let the DPDI Bill go through in “wash-up”; it should kill it off.

When a Prime Minister calls a General Election, the Official Opposition in Parliament becomes very powerful.  The reason is that the two main political parties can agree to enact outstanding and uncontroversial pieces of legislation (e.g. in this case, before the end of next week – May 30th).  Parts of the DPDI Bill do fall into this uncontroversial category; but many bits don’t.

In summary, the Opposition can say to Government something like; “we will agree to pass the DPDI Bill if you remove Schedule 11 (DWP powers to access bank accounts), the definition of personal data and the new disclosure arrangements in Schedule 1, paragraph 1” etc.  Alternatively something like: “we will let through the DPDI Bill limited to the DVS elements, ICO changes to an Information Commission and  law enforcement transfers of personal data outside the UK”.

This horse trading is called “wash-up”; it is undertaken in smoke filled rooms, out of the public gaze where FOI is a distant dream.

The problem is that the Labour Party is not opposed to the DPDI Bill; so it could agree to enact something from the DPDI.  That explains why privacy NGO “BigBrotherwatch” has launched a campaign to get its supporters to contact Labour MPs to ensure the DPDI Bill has no resurrection.

If Labour seeks the views of the ICO, he will repeat his oft-expressed (and erroneous) view that he supports this Bill as it presents no risk to data subjects (aaargh).

So in my last missive on the lamentable (but unlamented) DPDI Bill, I thought I would list the items that are in my view controversial in the hope that it helps “Kill the Bill.

Weakening data subject protections

The list is not complete but contains the following; all impact on the rights and freedoms of all UK data subjects.

Personal data: this definition is changed to make it more prescriptive (i.e. less personal data are subject to the DPDI Bill).  This definition, which impacts on all the data protection rights and Principles, does not meet the standard set by the DPA1984, CoE No 108 and GDPR and is a risk to the UK’s Adequacy Agreement with the EU.

Lawful basis: the specification of “Recognised Legitimate Interest” legitimises any voluntary data sharing of personal data from any private sector controller to any public sector controller for its public tasks.  In addition, the further purpose of the disclosure is also likely to be deemed compatible with the purpose of obtaining. The data subject’s right to object to such disclosures is much diminished.

As modifications of lawful basis are not possible with the GDPR, this provision is also a risk to Adequacy.

Marketing: “opt-in” (consent) for third party marketing becomes the exception; “opt-out” (legitimate interests) becomes the new norm. This overturns the “opt-in” consent rule for Third Party Marketing established under DPA1984  (40 years ago).

In my view, this change represents a spammer’s charter for Third Party marketing.

Transfers outside the UK: these transfers are legitimised via powers granted to the Secretary of State (SoS) without direct reference to Parliament (as it follows negative resolution procedures). The provisions allow the SoS to identify specific controllers in a certain country as adequate, even though the country itself is not deemed to be adequate.

This also could threaten the Adequacy Agreement if transferred personal data from the UK contains personal data that has originally been transferred from the European Union.

Data subject rights: the presumption that automated decision-taking is prohibited, is removed. This means that automated decisions using Artificial Intelligence (AI) techniques are likely to become the norm in the UK.  There is very little protection for UK data subjects except for making complaints after an AI decision has had an effect on them.

In addition, DPDI specifies that a data subject complaint is first directed to the controller. This will add a further month and a half delay before the data subject can complain to ICO (who often takes 4-5 months to allocate a case-worker).

This means delays of half a year or more concerning an automated decision can be expected.  Such a time delay does not protect the data subject’s interests; it protects the controller’s interests.

Research (RAS) processing: it becomes easier to share personal data for RAS purposes, in the absence of transparency to data subjects, so long as certain safeguards apply (see next bullet). Consent as the lawful basis for RAS is likely to be replaced by “legitimate interests” or “public task”. Existing databases can be used and disclosed for RAS purposes and the “scientific research” definition is expanded to cover AI research and development.

There is a considerable risk that, to facilitate AI research and development,  there will be disclosures of personal databases in the legitimate interest of Third Parties and onward to further Third Parties in their legitimate interests, again in the absence of transparency.  This “Wild West” approach to data-sharing is likely, in my view, to result in major data breaches or significant AI harm to individuals.

Research (RAS) Safeguards: The safeguards for data subjects associated with RAS purposes (mentioned above) are not particularly “safe”. For example, one safeguard is that the RAS disclosure does not cause “substantial damage or substantial distress”; this means that moderate damage or distress is perfectly acceptable to Government.

The Regulator: the ICO becomes an Information Commission where voting members of the Commission are all selected by SoS. Such self-selection puts at risk the regulatory independence of the UK and has knock on implications for the Adequacy Agreement.

Codes of Practice: Codes are still not produced in an independent manner in the UK. Although the SoS does not to approve the final text of a Code (as originally intended), it is possible for the SoS to recommend that Parliament vote down the Code.  As the SoS’s political party form the majority of MPs, the SoS veto over the text of Codes of Practice is maintained.  (btw the ICO thinks the veto has gone).

National security: the SoS can designate personal data processed by the police as being of interest to GCHQ. MI5 or MI6. The result is that the personal data, once designated, move from Part 3 of the DPA2018 to Part 4.  This then means that any processing of designated personal data fall outside the DP enforcement regime.

This reason for this designation mechanism has never been explained. However, it provides an alternative, for example, that could permit a bulk ANPR database that the police use to monitor traffic on UK roads being subject to national security rules for data protection purposes.

Forget bulk data transfers and the statutory restrictions and protections found in Investigatory Powers legislation; instead think designated databases under DPDI Bill and total freedom from ICO regulation.

Codes of Conduct: Law Enforcement Codes of conduct can be produced by expert Law enforcement bodies covering their own processing. If approved by a (SoS compliant) Information Commission, these Codes can specify that the processing described in a Code complies with Part 3 data protection obligations.

The prospect of controllers establishing that their own processing is compliant with DP law, by reference to a Code of Conduct they produced for themselves, is pure Alice in Wonderland.  It obviously risks reducing the protection afforded by data subjects

DWP Powers: the Department for Work and Pensions (DWP) want to obtain financial details from financial bodies to use AI techniques to identify whether any payment to any claimant is correct (e.g. benefit, pension, allowance).  As powers to demand these details when there is suspicion of fraud already exist, these new powers do not need any suspicion of fraud.

An “account information notice” from the DWP can demand details from accounts of those connected to a benefit recipient (e.g. of a family members).  So potentially these powers involve half the UK population (e.g. child benefits; OAPs, benefit recipients).

Even the ICO has identified a likely A.8 ECHR problems (ICO says “I do not think the current drafting is sufficient to ensure this [proportionality]”.  Note the ICO does state the obvious:  that there is lack of an A.6 lawful basis that could be subject to his enforcement powers.

International Agreement: there is a new lawful basis of “necessary for the purposes of responding to a request made in accordance with the Agreement … [between UK and USA Governments] … on Access to Electronic Data for the Purpose of Countering Serious Crime signed 3 October 2019”. This sets a precedent for other similar International Agreements having a similar lawful basis.

Again the ICO is on record as saying this change is unnecessary.

Conclusion

For the above reasons(and more), the data protection elements of the DPDI Bill should NOT be subject to the Parliamentary “wash-up” mechanism.  The Bill should be killed off.

This is especially the case as Government Ministers still claim that this DPDI Bill maintains a high level data subject protection and at the same time eases the load of controller compliance, when this is demonstrably wrong.  Quite simply, this Government cannot be trusted with data protection.

However, before you rest easy, the Tony Blair Foundation has plans for the wider use of NHS data to make large financial gains for UK Plc whilst maintaining the highest degree of patient confidentiality.

“Hang on a second; haven’t I heard this before?”  I therefore suspect that a further DP legislation is on the horizon after the Election.

Forthcoming Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture.

• Data Protection FOUNDATION Course is in London on (July 2-4: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Data Protection PRACTITIONER Course is in London on Monday, 8 July to Friday, 12 July (5 days: 9.30am to 5.30pm).
• Remember our specialist DP qualification for those in Education. Next course on June 11th, 12th & 18th 2024

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].

DPDI Codes of Conduct allow competent authorities to write their own DP rules

If, on April 1^st,  I reported that a cabal of controllers could club together and draft a Code of Practice that establishes their legal compliance with the UK’s data protection regime, you would probably say that this was too far-fetched to be true. Yet this is the procedure that has been put in place by our the Government for all law enforcement processing of personal data.

The grim detail can be found in Clause 68A of the Data Protection and Digital Information (DPDI) Bill.  The production of law enforcement Codes of Conduct (as they are called) does not have to involve any data protection expertise, nor the ICO, nor does the text require Parliamentary approval nor does a Code have to consider its impact on data subjects.

Yet, law enforcement processing often comprises the most sensitive of processing.

In addition, the DPDI Bill’s procedure for Codes of Conduct compares starkly with Codes of Practice (which does involve, by law, data protection expertise, impact on data subjects and the approval of the ICO and Parliament).

How Codes of Practice are produced

The DPDI Bill specifies that the ICO has to reissue the Data Sharing Code of Practice, the Age Appropriate Code, and the Journalism Code to accommodate the changes in the DPDI Bill.  As is well known, the Direct Marketing Code has been held up until the range of non-consensual marketing rules of the DPDI Bill become law.

Additional Codes of Practice can be produced on the instructions of the Secretary of State (SoS).

All these Codes follow the same procedure.  This first involves consultation with the SoS and other specified parties that have an interest in the production of a Code. This could involve a preliminary scoping document covering the need for a Code.

For example, a revised data sharing Code will have cover the voluntary data sharing arrangements for disclosures of personal data from the private sector to public sector controllers arising from the introduction of the “Recognised Legitimate Interest” lawful basis.  The revised Code also has to accommodate the weakened data subject’s right to object to such disclosures using this lawful basis.

The text of Code is first drafted by the ICO.  This is then considered by a panel of experts, chosen by the ICO for their knowledge of the subject; this panel then produces a report on the draft Code.  The panel of experts includes representatives of “persons likely to be affected by the Code” as well as representatives from data subject facing organisations.

This expert panel report can suggest modifications to the draft Code; the ICO can reject or accept some or all of the suggestions. Details of any rejection from the panel of experts has to be made public.  The Code (if modified) is then subject to an impact assessment.

This procedure is also followed for significant amendments to existing Codes.  However, for reasons unexplained, the analysis of a panel of experts can be dispensed with, if the Code is an additional Code produced following instructions of the SoS.

The Code is then submitted to the SoS for comments which are made public (if the SoS has any).  The ICO has a choice: he can reject SoS’s comments;  withdraw the Code, or submit a “revised” Code to accommodate them. The Code is then laid before Parliament by the SoS.

Note that if the ICO rejects the SoS commentary, the SoS can ask Parliament not to approve the Code.  In this way, the SoS still retains the “whip hand” if there is disagreement over the Code’s content.

How Codes of Conduct are produced

Let’s assume there is a need for a Code of Conduct covering facial recognition cameras as used by law enforcement agencies.  How would such a Code of Conduct be developed?

First the ICO identifies “expert bodies” who are “encouraged” to produce a Code.  Note that the identification is of expert bodies and not expert individuals.  In other words, there is no obligation placed on expert body, to choose from its ranks, an individual who has requisite expertise in data protection.  Note also, the expert bodies can reject the ICO’s encouragement.

These expert bodies are then also “encouraged” to submit their Code of Conduct to the ICO in draft.  In other words, the drafting of the content of a Code of Conduct can emerge without any submission of its text to the ICO.

If a draft Code of Conduct is submitted to the ICO, the ICO can express an opinion on a Code, decide to approve the Code, and publish the Code if approved.  Of course, this provision does not apply if the Code is not submitted to the ICO.

There is no requirement for the ICO to publish his or her opinion on a particular Code of Conduct (e.g. to explain why approval was not granted).  Codes that have not been submitted to the ICO for approval can still be published without any commentary from the ICO.

There is no requirement for an Impact Assessment (e.g. impact on data subjects) nor is there a requirement to seek Parliamentary approval of a Code of Conduct’s content.

One can easily see a situation where the ICO does not like a Code of Conduct and expresses some contrary views on its proposals.  The response of the expert bodies could well be to press ahead with that Code of Conduct without any further involvement of the ICO.

This could especially be the case with, for example, if a populist Government wanted to skew law enforcement policy in a specific direction (e.g. wanted facial recognition cameras to target those who have pre-booked seats on flights to Rwanda).

Remember the ICO is to be replaced by a Commission where all the voting members of the Commission are appointed by the SoS.  Additionally, the SoS might express a view that a strong emphasis on law enforcement should be a strategic priority for the Commission.

All these possibilities could put pressure on the Commission to approve the Code of Conduct produced by the law enforcement agencies.

Once a Code is “approved” by the ICO, then the text may be used to demonstrate compliance with the law enforcement requirements (see Clauses 56(4) and 59(7A) of the DPDI).

In this way,  public bodies producing a Code of Conduct effectively are drafting text that determines how data protection law applies to their controversial area of law enforcement processing. This "lawfulness" is without any reference to the Courts, Parliament, Impact assessment on data subjects nor any detailed privacy analysis from the ICO.

The ICO has not objected to such a prospect.

Forthcoming Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• All-day Zoom workshop (10.00-4.30)  on the DATA PROTECTION AND DIGITAL INFORMATION BILL held on Thursday 9 May.
• Data Protection PRACTITIONER Course is in London on Monday, 13 May to Friday, 17 May (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (July 2-4: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education. Next course on June 11th, 12th & 18th 2024

More details on the Amberhawk website: www.amberhawk.com  or email [email protected] (e.g  for. DPDI workshop agenda).

Government extends privacy protection to bequests made to the Conservative Party

Late on Good Friday (a very good time to bury “bad” news), the Government quietly tabled an amendment to the Data Protection and Digital Information Bill  (DPDI Bill) which extends the definition of personal data to include bequests and comments, made by a deceased, in his or her will.  The ICO has welcomed this amendment as a positive change to the law.

Although the amendment makes a somewhat quirky change to the Wills Act 1837,  an impeccable sauce has indicated that its main motive is to protect the privacy of bequests of large financial donations to the ruling Conservative Party.

Because the amendment is to a later Schedule of the Bill, it is expected to be debated towards the end of Committee stage in late April.

Amendment to Wills Act 1837

In further detail,  the unassuming amendment reads as follows:

At Schedule 12, page 270, line 8, insert new paragraph 29  (into the DPDI Bill)

29        WILLS ACT 1837

Insert into section 1 of the Wills Act, after the words “section 8 of the Human Transplantation (Wales) Act 2013…”, the following:

All personal information contained in a will shall be treated as if it were personal data (as defined in Section 3 of the Data Protection Act 2018) except when applied to the rights granted to data subjects as specified in Articles 12 to 22 of the UK_GDPR.

Following the amendment, there is a brief explanation of the impact of the change in the law.  This reads:

Minister’s explanatory statement

This amendment protects personal statements and bequests made by a deceased person in a will.  It ensures the deceased, when drafting a will, can be assured of the confidentiality of any bequest, after death.  The amendment also clarifies the law so that the recently deceased cannot exercise their data subject rights under the UK_GDPR.

Speaking on the new GBNews, Sunday breakfast, talk-show (“In The Pub with Lee Anderson MP”),  ex-GBnews presenter Esther McVey MP,  known by the tabloid press as the Minister for Common Sense, expanded on the amendment. She said:

“The amendment is a total realisation of the benefits of Brexit.  The UK is seizing back control of its laws by extending privacy protection to the wills of the newly departed.  The deceased will sleep more serenely in Heaven, secure in the knowledge that their privacy is maintained on Earth, from the moment they leave”.

Lee Anderson MP added a more practical observation:

“The text of wills can be very controversial, especially if the recently deceased leaves, in a will, a “parting shot” at his or her partner or another member of the family.  Such information is rightly protected from the do-gooders, neigh-sayers and anti-Brexit re-moaners who are jealous that their trivial political pursuits do not attract large financial donations from the dead”.

He added “where I come from, up North, we recognise the dead know a thing or two”.

ICO has also welcomed the clarity of the new amendment.  In a statement on his website, the ICO said:.

“I  heartily support the spirit of this amendment and I assure the British public that I shall enforce the new provision as robustly as I enforce the UK_GDPR and DPA2018 currently”.

“As a New Zealander, I am well attuned to a cultural tradition that embeds immense respect for ancestral history: “Hanga koa i taku gin me te tonic”, he added in Māori.

And finally…

Remember my Petition requesting the Government to implement the EU’s AI Act as part of the DPDI Bill is on that Parliamentary web-site: https://petition.parliament.uk/petitions/652982.  Please consider signing it and passing it to your colleagues to consider signing.

Details  reasons why you should sign the Petition are on my Hawktalk blog: https://amberhawk.typepad.com/amberhawk/2024/03/petition-calls-for-implementation-the-eu-data-act-to-protect-data-subjects-from-ai-abuse.html

Forthcoming Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• All-day Zoom workshop (10.00-4.30)  on the DATA PROTECTION AND DIGITAL INFORMATION BILL held on Thursday 9 May.
• Data Protection PRACTITIONER Course is in London on Monday, 13 May to Friday, 17 May (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (July 2-4: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our new specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected] (e.g  for. DPDI workshop agenda).

UK Government abandons Precautionary Principle and tolerates AI abuse risks to data subjects

Speakers at the Data Protection Forum in early March reinforced my reasoning that the Data Protection and Digital Information Bill  (“DPDI Bill”) should be used as a vehicle to implement the EU’s AI Act.  [Obviously my Petition which states this should also be supported: so please sign it! – see references].

One speaker, at the end of her presentation, made several personal comments about the risks associated with the fragmentary, “wait and see” approach of the UK Government towards AI regulation.

She pointed out that, in the UK, this meant that the five pillars of AI trustworthiness (Fairness, Robustness, Privacy, Explainability, Transparency: see references) could all to be interpreted differently by about 90 Regulators.

In further detail, these “trusty” five pillars, largely developed by the AI industry itself, can be summarised thus:

• Fairness: ensure that AI models don't exhibit biased behaviour when considering factors such as age, gender and ethnicity.
• Robustness: focus on the ability of AI models to perform well under exceptional conditions and adapt to changing circumstances.  Comment:  I assume this covers the change in AI functionality if there were to be another pandemic (the latter being the exceptional condition which could vary society’s usual modus operandi).
• Privacy: ensures that data used for training AI models remain protected and that insights derived from the models are under the control of the model builder. Comment: protected from whom? Does “under the control of the model builder” exclude data subjects (e.g. their rights)?
• Explainability: involves being able to understand and explain the decisions made by AI models to end users and decision makers. Comment: does this include data subjects?
• Transparency: emphasises making all relevant information about AI models easily accessible and inspectable. Comment: accessible and inspectable to data subjects?

The point being made in the “Comments”, is that any reference to “data subjects”, whose personal data are likely to be at the centre of much AI processing, is notably absent, especially with respect to the pillars relating to  Privacy, Explainability and Transparency.

Precautionary Principle

Given the obvious risks to data subjects, the Government’s laissez-faire approach to AI regulation abandons the Precautionary Principle towards its governance.

This Precautionary Principle arises when the risks of an action on society is high and the evidence about the future impact on that society of that action is uncertain.  I would argue that this fits the circumstances surrounding the development or use of AI to a tee.

It is this Principle which explains why the EU has enacted the Data and AI Acts that apply to the processing of all forms of data by AI.  By contrast, the Government’s approach sees this Principle as an obstacle to progress.

Indeed, the Government has deliberately weakened this Principle to accelerate such “progress”, by reducing the protection afforded to data subjects.

Data subjects at risk

For example, the A.22 UK_GDPR prohibition on profiling or automated decision taking is reversed.  Under the Bill, AI profiling/automated decisions can take place, in general, subject to a few exceptions usually associated with the processing of special category of personal data.

Yes there safeguards, but these all apply post automated decision when the decision has been taken effect and has impacted on the data subject.  There has been very little consideration of implementing safeguards prior to that AI induced, automated decision.

Secondly, much AI testing and development is also likely to fall within a revised “scientific research” definition.  Thanks to the Bill’s new transparency exemption for scientific research, such research can allow databases of personal data to be exchanged with Third Parties for their AI development purposes without existing data subjects knowing, so long as some (dodgy) “appropriate safeguards” apply.

One such appropriate safeguard is that substantial damage/distress to any data subject is unlikely; this merely means that moderate damage/distress to data subjects is acceptable to this Government!

There are impacts on data subjects’ rights.  How can data subjects exercise their right to object to the processing if they’re kept ignorant of who processes their personal data because of the new transparency exemption associated with scientific research?

Finally, such personal data exchange for scientific research purposes (i.e. AI development; algorithm testing) is also deemed “compatible” with the purpose of collection by the DPDI Bill.  In this way,  the Bill throws precautions to the wind, and legislates its way around the provisions in Article 6 (lawfulness of processing) that could prevent unlawful processing of personal data for AI development purposes.

Concluding comment

The Precautionary Principle, if followed, would add AI clauses to the DPDI Bill  which were aligned with the EU Data and AI Acts (both of which  maintain the GDPR standard).  Such amendments could be tabled for the Bill’s Report stage in the House of Lords (e.g. expected to be over five-days in May/June).

This Bill, once enacted (e.g. before the summer recess) will preserve the ability of the UK’s AI businesses to develop services that meet the requirements of the only available, recognised, international legal (and precautionary) standards that apply to AI.

These AI legal standards might not be the best, but they establish an important safety break in UK law.  That is what the Precautionary Principle is all about.  In addition, as the UK is no longer an EU state, the next Government can tweak these provisions if they do not work as intended.

The alternative is to adhere to this Government’s policy towards AI and put UK’s data subjects in harms’ way.

Forthcoming Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London on Monday, 18 March to Friday, 22 March (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (April 9-11: Tuesday to Thursday, 3 days: 9.45am to 5.00pm)
• All-day Zoom workshop (10.00-4.30)  on the DATA PROTECTION AND DIGITAL INFORMATION BILL held on Thursday 9 May.  Email [email protected] for workshop agenda or to reserve a place on this session.

References

Regulation 2023/2854 (Data Act} on “Harmonised rules on fair access to and use of data” (published in the OJ on 13 December 2023).  See also my updated Hawktalk blog dated 5 Jan 2024 (DPDI Bill combines with EU's Data Act and AI Act to strangle the UK’s AI industry?).

The Petition is on: https://petition.parliament.uk/petitions/652982.  Please consider signing it and passing it to your colleagues to consider signing.

Details  reasons why you should sign the Petition are on my Hawktalk blog: https://amberhawk.typepad.com/amberhawk/2024/03/petition-calls-for-implementation-the-eu-data-act-to-protect-data-subjects-from-ai-abuse.html

Chapter and verse on the relationship between scientific research and AI: https://amberhawk.typepad.com/amberhawk/2023/10/dpdi-no-2-bill-undermines-transparency-of-artificial-intelligence-development-and-training.html

Example used is IBM’s five pillars: https://www.toolify.ai/ai-news/the-five-pillars-of-trust-for-ai-a-guide-to-building-reliable-and-ethical-ai-systems-2584388

Petition calls for implementation the EU AI Act to protect data subjects from AI abuse.

I am asking readers to sign my Petition on the Parliamentary web-site (see end of this blog); most of the blog's text explains why you should sign.

In summary, the Petition states that the Government would be negligent if it failed to draft clauses for the Data Protection and Digital Information Bill  (“DPDI Bill”) to protect data subjects from the harmful impact of Artificial Intelligence (AI).

I have suggested that these AI clauses should be aligned with the EU Data/IA Acts (both of then apply; see references) and added to the DPDI Bill at Report stage in the House of Lords.  This will preserve the ability of the UK’s AI businesses to develop services that meet the requirements of the only available, recognised, international legal standard that applies to AI.

If the Government misses this legislative boat, any AI legislation in the UK will be delayed until after the next General Election (that is assuming a new incoming Government sees AI legislation as a major priority after the next General Election).

This, in turn, means the earliest that UK legislation is likely to be enacted is in 2025, coming into force by 2027.  By contrast, the EU Data Act becomes law beginning September 2025 - the AI Act soon after.

The current position of the UK Government is for an “AI Safety Institute” to make recommendations to Government.  January’s official announcement of the Institute describes its functions as follows.

“The Institute is not a regulator and will not determine government regulation. It will collaborate with existing organisations within government, academia, civil society, and the private sector to avoid duplication, ensuring that activity is both informing and complementing the UK’s regulatory approach…”

I am sure such collaboration and academic debate will be very worthy.  Sadly, however, the urgent requirement is for legislation governing the current risks arising from unregulated AI as of now, and not a “talking shop”.

Diminished protection from AI abuse

The EU Data/AI Acts maintain the EU_GDPR (or the current UK_GDPR) as setting the standard of privacy protection for data subjects.

This is unlike the DPDI Bill which weakens that privacy protection in the following areas relevant to AI processing: personal data, lawful processing, scientific research, automated decision taking and the Information Commission.

The problems associated with each of these areas are summarised below with reference to longer blog items.

Definition of “personal data”.

The DPDI uses a definition of “personal data” that does not meet the standards described in the DPA1984, the Council or Europe Convention No 108 nor the GDPR itself.  In other words, what is personal data in France might not be personal data in the UK.

Such a reduction in the reach of “what is personal data?” has the potential to have a significant impact on how the Principles, obligations and rights of the UK_GDPR apply in practice.  How can one assess, for instance, that an AI algorithm processes personal data “fairly”, if the meaning of personal data in the UK differs from that used in the rest of Europe.

The UK has been here before.  The defective Durant decision in the Court of Appeal in 2004 concerning “what is personal data?” caused a decade of confusion in the UK; just Google “Durant decision data protection” to find that out.

This judgment caused the European Commission to start infraction proceedings against the UK, and the issue is still so sensitive that information associated with these proceedings are still not accessible by FOI. (I tried 2 years ago).

This continuing refusal to release information about a 20 year-old historical event,  helps explain why the risks to the Adequacy Agreement between EU and UK, arising out of the DPDI Bill’s inadequate definition of personal data are very real.

A complete description showing why the UK’s definition of personal data does not meet European standards (or the 40 year old standard set by the DPA1984) can be seen from Hawktalk blogs dated 4 Aug 2022 and 13 Apr 2023.

Lawful and compatible processing

The DPDI gives the Secretary of State powers to:

• define certain AI processing as lawful by changing Annex 1 of DPDI;
• ensure that such AI training and algorithm development is compatible with the original purpose of the processing by changing Annex 2 of DPDI; and
• provide powers to introduce exemptions based on economic grounds to protect AI training and development from interference by the application of data subject rights (e.g. the right to be informed: see powers in A.23(1)(e) of the UK_GDPR).

These powers are extremely broad.  They can be used to ensure that any Minister’s pet processing project, in future, is defined as lawful, compatible with the purpose of obtaining and exempt from transparency obligations.  They can also be used to ensure that AI economic priorities prevail over measures that protect privacy.

I should add the House of Lords Committee on Delegated Powers (HL Paper 60; 14 February 2024) have called for these powers to be removed from the Bill as they are so general that they are “capable of being exercised more broadly to give effect to changes in policy”.

Detail of these data sharing powers is in my blogs dated 18^th and 31^st August 2022.

Secrecy and “scientific research”

The DPDI defines scientific research to include AI development and testing.  Additionally there is a new exemption from transparency if certain (dodgy) ”appropriate safeguards” apply and any further processing of personal data for such scientific research is deemed to be compatible with the purpose of obtaining, again if these safeguards apply

For example, one safeguard proffered by the DPDI Bill is that the processing is unlikely to cause substantial damage or substantial distress to any data subject.  This merely means that any moderate damage or moderate distress to data subjects (i.e. anything short of substantial), is acceptable as far as this Government is concerned.

The DPDI Bill anticipates that much “scientific research” (i.e. AI development) will be made lawful in terms of “legitimate interests” of controller or a Third Party.  This means that large databases can be lawfully used by controllers (or disclosed to Third Parties) for AI development purposes.

Additionally, if the appropriate safeguards apply, the exemption from transparency means that existing data subjects described in the database are not informed about this further AI use or Third Party disclosure.

Such secrecy also applies to any onward data sharing of databases to any Third Party AI development, subject to the “appropriate safeguards” applying.

The Government say this liberal exchange of personal data is an example of it allowing personal data to become the oil that fuels economic dynamism.  Others may  view it differently: the Government is transporting this fuel in oil-tankers such as the Torrey Canyon or Exxon Valdiz.

Details of the risk from data sharing for scientific research is in my Hawktalk blog dated 31 Oct 2023.

AI automated decision taking

The DPDI reverses A.22 and the right not to be subject to automated decision taking or profiling.  Instead of few exceptions when automated decisions can be taken (e.g. authorised by law),  the DPDI permits automated decision taking in general, subject to a few exceptions (e.g. involving special category of personal data).

In other words, the DPDI Bill opens the door to untrammelled automated decision taking using AI techniques on UK’s data subjects.

There are safeguards, but these all apply after the automated decision has been taken and the significant effect on the data subject has impacted. There is nothing in the DPDI Bill that relates to safeguards prior to that automated decision being taken.

I think this position tells you something about the Government’s priorities here.

Independent Regulator

The DPDI Bill reduces the independence of the Regulator (e.g. when enforcing AI best practice).

The Secretary of State appoints all the voting non-executive members to the new Information Commission and sets the Commission’s strategic direction which includes economic, law enforcement and national security priorities.

Note that all these priorities set by the SoS are likely to apply to the Governments future exploitation of AI techniques.

For instance, the DWP are seeking powers to demand bulk personal databases from banks for its own AI purposes to identify those associated with any erroneous benefit claim or pension payment  – which of course means processing personal data relating to millions of pensioners and claimants and those related to them.

The DPDI Bill therefore reduces confidence in an independence of the Regulator when enforcing the data protection rules in the context of AI. Detail in my Hawktalk blog dated 19 Oct 2023.

Common theme

The common theme in all the above, is that the DPDI Bill allows for AI development practices to proceed, in the presence of deliberately weakened legislative protection for data subjects.

Given that all USA high tech are large players in the AI Industry and given these companies do not have a proud tradition in the field of privacy protection, the Government’s policy amounts to “a wing and a prayer” that its “wild west” approach to the free flow of personal data for AI purposes will not result in any significant misuse.

In short, the Government has knowingly and recklessly abandoned the Precautionary Principle associated with the governance as applied to AI.

That is why I have tabled this petition; please consider signing it (and pass it to your colleagues to consider signing).  First target 10K signatures.

The Petition

The text is as follows:

Amend the DPDI Bill to protect us from harmful Artificial Intelligence (AI)

The Data Protection and Digital Information Bill (now in the Lords) is a vehicle that allows the Government to legislate to protect against misuse of AI. The Bill should be amended so that it mirrors EU's AI/Data Act, which we believe provides better data protection with regards to AI.

The Prime Minister has said he wants “guard rails” to protect society from the misuse of AI.

We believe there is no excuse for Government inaction, and that failure to implement protective clauses on the lines of the EU's AI Act may risk damaging AI innovation and development in the UK.

The Petition is on: https://petition.parliament.uk/petitions/652982.

Forthcoming Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London or Zoom on Monday, 18 March to Friday, 22 March (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London or Zoom on (April 9-11: Tuesday to Thursday, 3 days: 9.45am to 5.00pm)
• All-day Zoom workshop (10.00-4.30)  on the DATA PROTECTION AND DIGITAL INFORMATION BILL held on Thursday 9 May.  Email [email protected] for workshop agenda or to reserve a place on this session

Finally, we have launched a specific qualification for data protection specialists in the Education sector. 

Further details of all the above on the Amberhawk website (www.amberhawk.com)

References

Regulation 2023/2854 (Data Act} on “Harmonised rules on fair access to and use of data” (published in the OJ on 13 December 2023).  See also my Hawktalk blog dated 5 Jan 2024

Details of AI Act: https://www.europarl.europa.eu/news/en/press-room/20231206IPR15699/artificial-intelligence-act-deal-on-comprehensive-rules-for-trustworthy-ai