Hawktalk

Definition of “personal data” in DPDI No 2 Bill results in non-compliance with CoE Convention No.108

The press release associated with the DPDI No.2 Bill proudly states that the Bill ensures “that the new regime [is] built on the UK’s high standards for data protection and privacy”.

These new “high standards”, evidently, includes adopting a definition of “personal data” that fails to meet the data protection standards established by the text of the Council of Europe (CoE) Convention No. 108, as published in January 1981.

In other words, the most enduring international binding agreement on data protection is likely to be breached by the enactment of the No.2 Bill’s definition of personal data, some 42 years later.

Because this definition of personal data is deficient (see below), it follows all the substantive provisions (e.g. data subject’s rights, Principles, obligations) changed by the No.2 Bill also breach CoE No.108 requirements (as they are all couched in terms of this defective definition).

Additionally, as the No.2 Bill is at odds with CoE No.108, it follows that the No.2 Bill definition of personal data is also inconsistent with the GDPR (and perhaps has a knock-on impact with the Adequacy Agreement – not discussed here).

Note that meddling with the definition of personal data (in the way the No.2 Bill does) creates fundamental changes across ALL of the DP regime.  Quite simply, if the information is not personal data, then none of the UK_GDPR obligations apply.

Changes to “personal data” definition

The new definition of personal data distinguishes between two types of personal data depending on whether identification of a living individual is “direct” or “indirect” at “the time of the processing”.

With indirect identification, there is an additional “reasonable means” test to be passed before the information is treated as personal data (e.g. “the living individual is identifiable … by the controller or processor by reasonable means at the time of the processing”).

The two types of personal data, involving direct and indirect identification, mentioned above are:

• Direct “personal data” which relates to a living individual where, at the time of the processing, identification of the individual is by a controller or a processor without the use of any other information (e.g. the identification is directly contained in a database).

If you think about it, there is no need for a “reasonable means” test if there is direct identification of the data subject (as the identification information is sitting in the database!).

• Indirect “personal data” which relates to an identifiable living individual where the identification of the individual is by a controller or a processor but requires other information to be available to the controller or processor, using “reasonable means”, at the time of the processing.

In this case, the identification is indirect as other additional information is needed to complete any identification of a living individual (e.g. pseudonymisation of personal data creates an example of indirect identification).

By implication there are two types of information are not personal data.  These are:

• “not quite-personal data” which is my term for information which concerns a living individual but where identification of that individual at the time of the processing cannot be undertaken by a controller or by a processor without the expenditure of unreasonable effort to obtain the other additional information to complete the identification.
• anonymous data which is data or information that cannot be attributed to any specific living individual.

For anonymous data, the UK_GDPR recognises that because the living individual is not identifiable (i.e. attributable) in anyway, there are no obligations arising from the UK_GDPR, apart from the limited transparency requirements in Article 11.

The definitional change to personal data extends the “no obligations” approach of anonymous data to “not quite-personal data”.  This is made clear in the Explanatory Notes to the No.2 Bill  “the legislation does not apply to non-personal or anonymous data” (paragraph 101).  The important point here is that the Notes clearly separate anonymous data from non-personal data.

No examples of “non-personal data” (or not quite personal data to use my term for these data) are provided in the Explanatory Notes, nor in the Press Release mentioned above. This kind of omission is unforgivable; the public should not be left guessing what Government means here when its proposals put their privacy at risk.

Hence, my best guess for not quite-personal data is something like the following.  Imagine a set of pseudonymised personal data where the pseudonymising personal data linked to the identification details are removed from the set.

This leaves a set of attributes, each of which is derived from a specific living individual, but where that individual cannot be re-identified without, so the theory goes, the expenditure of unreasonable means. (But of course in my guess example, one can keep details to reverse this process quite easily).

Definition of “anonymous data”

The No.2 Bill definition of personal data overlooks the fact that Recital 26 of the GDPR explicitly contains a definition of  “anonymous information”  (e.g.  “information which does not relate to an identified or identifiable natural person”).

In further detail, Recital 26 states “The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information.”. (My emphasis to bring out the definition of anonymous information).

“Not quite personal data” could be equated with “anonymous data” if, for example, Recital 26 had stated something like: “This Regulation does not apply to data where identification of an individual is only possible by the expenditure of unreasonable effort on the part of the controller or processor at the time of the processing”.

But Recital 26 makes no such statement, so anonymous data and not quite personal data are different species of data (which, importantly, are also not personal data according to the No.2 Bill).

“Reasonable means”

Major problems arise from the definition of “reasonable means” as applied to the definition of personal data.

“Reasonable means” is defined as a non-exhaustive (illustrative) list which includes “among other things: (a) the time, effort and costs involved in identifying the individual by that means, and (b) the technology and other resources available to the person”.

Note that if an organisation (e.g. one that has few resources) assesses that there are no “reasonable means” are available to it, then that organisation can process that information as if it were not personal data (i.e. no UK_GDPR obligations such as transparency, security or rights etc).

However, at the same time, a well-resourced organisation (e.g. perhaps an organisation that has benefited immensely from the obvious Brexit dividends) can come to the opposite conclusion.

Thus a set of not quite personal data in the hands of one organisation could be personal data in the hands of another organisation as a controller or processor, both at the [same] time of the processing.

By contrast, at any particular time, anonymous data by the Recital’s definition remains anonymous irrespective of the nature of the organisation processing the data, because the data cannot be attributed to an identifiable living individual.

So if a “resources poor” organisation and a “resources rich” organisation used the same pool of “not quite personal data”, the latter is likely to be a controller processing personal data whilst the former would not.  This inconsistent position is extolled by the Explanatory Notes as “providing greater clarity” about the definition of personal data.

Also note that if an organisation gets its assessment of reasonable means wrong  (e.g. it assesses that the identification of living individuals needs unreasonable means), the default position is that the organisation is not a controller and the data are not personal data.  This is the position of greatest risk for data subjects because the data are not subject to the UK_GDPR.

This partly explains why the No.2 Bill’s ill-conceived meddling with the definition of personal data is likely to be detrimental to the interests of all data subjects.

The Bill's default position is not the privacy enhancing one (e.g. as espoused in data protection by design and by default); it’s the privacy busting one (e.g. as practiced by Facebook or Clearview AI Inc).

“At the time of the processing”

As already stated, indirect identification of the data subject for the No.2 Bill has to be at “the time of the processing” (e.g. “the living individual is identifiable … by the controller or processor by reasonable means at the time of the processing”).

Suppose personal data are processed at the time of the processing then a controller can inform the data subject of the intended future processing purposes of his/her personal data and the relevant A.6 lawful basis as required by A.13(1)(c) and A.14(1)(c) of the UK_GDPR.  So far, so good.

However, suppose at the time of the processing an organisation is processing not quite personal data.  Then there is no obligation at the time of the processing to be transparent to any data subject as the data are not personal data and the organisation is not a controller.  A.13 and A.14 only apply when actual personal data are processed (e.g. when indirect identification is completed).

So it can be now be seen that sets of not quite personal data can be legitimately processed without any data protection obligation (e.g. perhaps transferred to the USA, or possibly to Russia or China).

Suppose an organisation has obtained not quite personal data and transferred such data to the USA (for example) and re-identification occurs in the USA (perhaps via a number of other organisations dotted around the world to confuse any audit trail).

As such organisations are established well outside the jurisdiction of the UK_GDPR (or any EU version of the GDPR), then data subjects and regulators would be powerless with respect to such personal data once re-identification has occurred.

Such a loophole is only possible by changing the current definition of personal data so that it depends on the time of the processing (and in the case of indirect identification, the reasonable means needed to identify a living individual).

It is interesting to note that the definition of personal data in the GDPR does not contain these qualifications (e.g. “at the time of the processing”) so the definition in the No.2 Bill does not meet GDPR standards.

As stated above, the Government claims that there are “high standards for data protection and privacy”.  In practice, any consideration of the Bill’s new definition of personal data exposes that claim as highly suspect.

Identification by “controller or processor”

Now consider why the definition of personal data specifies that the identification of a living individual has to be  “by the controller or a processor”.  To explain this, consider the processor definition:  “the natural or legal person … which processes personal data on behalf of the controller”.

Note that to be a processor, an organisation has to process personal data (as defined in the No.2 Bill) on behalf of a controller.  Hence the organisation is not a processor when it processes not quite personal data.

It follows that for not quite personal data there are no contractual conditions, security or transfer obligations, no data breach procedures or reporting (even when the risk of re-identification could be potentially high) and minimal risk of effective sanction from the UK’s ICO (not even a Reprimand!).

So if an organisation based in the USA somehow obtains a copy of a set of not quite personal data and then re-identifies the data to become personal data, such an organisation becomes a controller outside the jurisdiction of the GDPR (the No.2 Bill negates the need for a Representative in the UK).

Quite simply, the words “by the controller or a processor”  appear in the definition of personal data is to ensure that not quite personal data can be shared with anybody without interference by the UK’s data protection regime.

Surprisingly, this is left unexplained in the Explanatory Notes that accompanies the No.2 Bill.

Comparison with CoE No 108

The text of the 1981 Council of Europe Convention 108 on data protection states in Article 2(a) that “personal data” means “any information relating to an identified or identifiable individual (“data subject”).   Article 3(1) requires “The Parties [e.g. UK Government) undertake to apply this convention to automated personal data files and automatic processing of personal data in the public and private sectors.”

I contend that the No.2 Bill’s definition of personal data is in clear breach of the text of CoE No. 108 as published in 1981; the same clear breach goes for the definition of personal data in the latest version of 2018 (CoE No. 108+).

This is because there is no concept of “direct” or “indirect” identification of individuals,  “reasonable means of identification” and “at the time of the processing” in the CoE’s definition of personal data.

It follows that the definition of personal data in the No.2 Bill does not meet the CoE requirements and that, if enacted, the UK will “fail to undertake to apply this convention to automated personal data files and automatic processing of personal data in the public and private sectors” (as all the substantive protection for data subjects is couched in terms of CoE’s definition of personal data).

Question: if the above happens, would you advise the transfer of personal data to the UK?

Concluding comment

CoE No. 108 was first published on 28 January 1981, a date now celebrated annually as Data Protection Day. The No.2 Bill, if enacted as described above, would make such celebrations unique for UK data protection people.

Instead of organising a party, they will organise a wake.

 

Data Protection Courses (Summer 2023)

An all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill. Will be held on Thursday 13 July  2023 hopefully to include changes made during the Committee stage of the Bill.  The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection PRACTITIONERCourse is in London on Monday, 22 May 2023 to Friday, 26 May 2023 (5 days: 9.30am to 5.30pm).
• The next Data Protection FOUNDATION Course is on Zoom only (June 20-22, 2023 (Tuesday to Thursday, 3 days: 45am to 5.00pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing [email protected].

New DPDI Bill savings inflated by 324%; loss of Adequacy Agreement would cost UK over £2 billion

Many commentators have remarked how very similar the Data Protection and Digital Information (DPDI) (No.2) Bill is to the original DPDI Bill published last June.  If this is the case, how is it that the No.2 Bill’s projected “Best Estimate” savings is £4.7 billion over a decade, whereas the “Best Estimate” savings for the original DPDI Bill (the “No.1 Bill”) is a mere £1.45 billion over a decade?

Given the fact that there is no official comparison document, explanation or Keeling Schedule to explain these differences, nobody knows.  I know inflation is high, but it is not running at 324%.

As an aside, the Impact Assessment Update also estimates the likely “annual export revenue loss” of the Adequacy Agreement with the EU (if it fails) as between £210 million and £378 million per year. Assessed over a decade (the standard unit of time preferred by the Update), that is between £2.10 billion and £3.78 billion.  In other words, if the changes in the No.2 Bill lead to a discontinuation of the Adequacy Agreement with the EU, about half the “Best Estimate” savings are lost.

Some readers might recall I did a deep delve into the savings associated with the No.1 Bill.  I have reworked these using the new financials reported by Government.

Hence this blog provides an alternative financial analysis, based on verifiable figures which are easy to obtain unlike the Mystic Meg approach adopted in the 230 page “Impact Assessment Update” published to justify the No.2 Bill (see references).

Real numbers used

I am using six additional facts which are missing from the “Impact Assessment Update”.

1. Fact 1: Companies House has over 4 million companies registered in the UK (from Companies House website).
2. Fact 2: The total number of controllers on the ICO’s public register is 1,066,929. The breakdown of registration is: Tier 1: 966,587 (90.6% of the register): Tier 2: 93,604 (8.8%);  and Tier 3: 6,738 (0.6%). (Information from the ICO on 12 May 2022).
3. Fact 3: Approximate registration revenue per year is: Tier 1: £33.8 million; Tier 2: £5.6 million; Tier 3: £19.5 million. The  total ICO revenue collected is £59.0 million per year which is calculated by multiplying the number of controllers in each Tier, by the annual notification fee  for each Tier (Tier 1 (£35); Tier 2 (£60); Tier 3 (£2,900)).
4. Fact 4: The Annual Report (2020/21) indicates the cost of running the ICO is £56.4 million.
5. Fact 5: There are 67.1 million data subjects resident in the UK as per July 2020 (ONS website).
6. Fact 6:  The “Impact Assessment Update” states the true net benefit is between £1.27 billion per decade and £8.53 billion with the “Best Estimate” in the middle at £4.7 billion.  Note that the “best estimate” of the No.1 Bill is more or less the “low estimate” of the No.2 Bill (hmmm – how convenient!).

So what kind of questions do Facts like the above this raise?  Three spring to mind immediately:

• From Facts 1 and 2, it can be seen that only 1 in 4 companies at Companies House is registered with the ICO. So could the ICO garner more in notification fees (e.g. by looking for active companies registered at Companies House but not registered with the ICO)? This improved revenue stream could help the ICO generate more resources to provide clear advice to controllers.  This would be better than changing the law to improve the clarity of the UK_GDPR as claimed by the Government (see para 2 of the Explanatory Notes to the No 2 Bill).
• From Facts 3 and 4, could any future surplus in notification fees be earmarked by the ICO to employ more staff to deal with complaints? This better than the proposal in the No.2 Bill to deal with the ICO’s complaints system by allowing the ICO to dismiss, or not investigate, complaints from data subjects (e.g. in Clause 40).
• Should the notification fee (fixed in 2018) be increased? For example, increasing the notification fee for Tier 2 to £100 and Tier 3 to £3,500 increases ICO resources by over £10 million. An increase in fee that adjusts for inflation since 2018 (about 20%) would do something similar.

It is well known that the ICO has a significant backlog of cases; the last Annual Report (2021/22) shows that 57% of cases often take over 6 months to resolve.  The three options above give the ICO more resources to clear that backlog.  However, increasing ICO resources fails to get a mention in the “Impact Assessment Update”.

Notification – who pays?

Fact 4 shows that notification to the ICO costs £0.6 billion per decade. So, abolishing notification fees would provide significant saving for all controllers; it would also a release a cohort of staff at the ICO to do things other than pen-pushing notification work (e.g. redeployed to reduce any backlog of complaints).  Evidently there are over 900 staff at the ICO!

It is well known that data protection is a balance between the interests of controller and of data subjects.  So why should controllers be faced with 100% of the costs of data protection compliance, when UK data subjects benefit directly from provisions in the UK_GDPR that protect them.  Surely, data subjects should contribute to the costs of data protection?

Historically, notification is a relic from the DPA1984. It was created at a time when most organisations did not have a main-frame computer and those that did have a computer, had only one.  Hence charging the minority of single computer owners (via notification fees) for the cost of regulation is understandable.

Now every citizen processes personal data as a controller (e.g. on social media) and is also a data subject.  So there are stronger arguments that the cost of data protection regulation should be drawn from general taxation with the ICO being a Parliamentary Officer like the Parliamentary Ombudsman (to maintain ICO independence).

Any consideration of the cost of notification or its abolition is missing from the “Impact Assessment Update”.

Savings? The real comparison

I am using the “Best Estimate” of £4.70 billion of savings over 10 years; this represents £470 million of savings per year over all controllers (£1 billion =£1,000 million).   As there are 1.07 million controllers (Fact 2), the average saving for each controller can be calculated at £439 per year per controller.  This is about £8.40 per week per controller; about the price of a bottle of plonk.

The conclusion one reaches is that such savings are insignificant.  Even a small business in Tier 1 (turnover up to £632K) is not going to get into financial difficulty because it does not save £8.40 per week.  The statement in the Press Release announcing the No.2 Bill (“new common-sense-led UK version of the EU’s GDPR will reduce costs and burdens for British businesses and charities”) is exposed to be palpably false and, dare I say it, “rubbish”.

So, suppose the UK_GDPR were unaltered; what would be the cost of maintaining the high level of GDPR protection for each data subject?  As there are 67.1 million data subjects in the UK (Fact 5), the savings of £470 million per year infer an cost of maintaining current UK_GDPR standards is £7.00 per year per data subject.  This equates to 13.5 pence per data subject per week, or just under 2p per day.

In other words, the Government are prepared to abandon the high level of UK_GDPR protection for all data subjects in order to save tuppence per day for each data subject. There is a well-known phrase “to spend a penny”; it appears the Government does not want to spend two.

Even if the £470 million yearly savings were all allocated to the 6,738 large controllers in Tier 3, the average annual saving is £69,753 per large controller.  This is an amount that would be unlikely to be identified in the balance sheet of a such controller as its revenues are in excess of £36 million per year.

The £69,753 figure is also below the cost of employing a DPO (which most large controllers are likely to employ, but not for much longer as the DPO role is being abolished as a savings measure).

Even if the £470 million were allocated to all the larger controllers in Tier 2 and Tier 3, the annual savings would be £4,683 per controller. There again pifflingly small for companies with turnover up to £36 million.  Even if all controllers were on the minimum turnover for Tier 2 (£632K), the savings represents 0.7% of turnover.  Again such comparison shows that the financial savings associated with the “burdensome paperwork” are negligible.

Remember all these numbers (e.g. 2p per day) are, according to the figures a best estimate; they could be much less.

Finally, suitably buried on page 218 of the “Impact Assessment Update”, are the annual costs that arise from the loss of trading with the European Union if the Adequacy Agreement is lost.  Over a decade, this loss is somewhere between £2.1 billion and £3.8 billion; the Update calculates that between 2817 and 9601 firms trading with the EU will also go bust.

Is the loss of Adequacy described in the Press Release or any relevant Ministerial statement about the No.2 Bill?  Of course not;  Brexit is a roaring success as we all know.

Concluding comments

Also missing from the “Impact Assessment Update” is any acknowledgement that large firms trading into Europe have to comply with the EU_GDPR as well as the No.2 Bill.  Such firms have to additionally appoint a Representative and adsorb the cost of EU_GDPR compliance.

Many private sector controllers in Tier 3 are likely to have to comply with twin data protection compliance regime (i.e. guesstimate around 4,000 controllers).

In summary, the press release headlined: “British Businesses to Save Billions Under New UK Version of GDPR” is pure spin.   Of course, that is the point of spin.  This headline figure in the Press Release has been parroted unthinkingly by the press and some DP observers (who really should know better).

However, it is a relief that the Secretary of State has not repeated her non-sensical claim made at the Party Conference last November that the UK_GDPR compliance cost 8% of company profits  - or £23 billion (see references).

In summary, it is difficult to avoid the conclusion that the figures presented in “Impact Assessment Update” and Press Release are of a quality best displayed on the side of a red Brexit bus (as driven by “honest” Boris Johnson).

Data Protection (Courses:Spring/Summer)

An all-day Zoom workshop (10.00-4.30)  on the Data Protection and Digital Information No 2 Bill. Will be held on Thursday 18 May 2023.   The fee will be £250+VAT.  Email [email protected] for workshop agenda or to reserve a place on this session.

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection PRACTITIONER Course is in London on Monday, 22 May 2023 to Friday, 26 May 2023 (5 days: 9.30am to 5.30pm).
• The next Data Protection FOUNDATION Course is in London on June 20-22, 2023 (Tuesday to Thursday, 3 days: 45am to 5.00pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing [email protected].

References

DCMS fails to spend a penny to protect data subjects: https://amberhawk.typepad.com/amberhawk/2022/05/dcms-fails-to-spend-a-penny-to-protect-data-subjects.html   (old financial analysis of the DPDI No.1 Bill)

GDPR cost UK £23 billion says Minister in charge of data protection https://amberhawk.typepad.com/amberhawk/2022/11/gdpr-cost-uk-23-billion-says-minister-in-charge-of-data-protection.htm  (completely bonkers)

The Press Release associated with DPDI No.2 Bill: https://www.gov.uk/government/news/british-businesses-to-save-billions-under-new-uk-version-of-gdpr

DPDI Impact Assessment and other DPDI documents: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1140162/Data_Protection_and_Digital_Information_Bill_Impact_Assessment_-_June_2022.pdf

The DPDI No 2 Bill: https://bills.parliament.uk/bills/3430

DPDI No 2 Bill should be paused until the UK Bill of Rights position is resolved

The new Data Protection and Digital Information (No 2) Bill (“No.2 Bill”) has been published, minus any Keeling Schedule, and minus any indication of how the new Bill has diverged from the old.  The Department for Science, Innovation & Technology (DSIT) has this information to hand; its failure to publish it performs an unnecessary public disservice.

The press release accompanying the No.2 Bill says the legislation has been “Co-designed with business from the start, this new Bill ensures that a vitally important data protection regime is tailored to the UK’s own needs and our customs”.  It does not take an expert to guess that the No.2 Bill is likely to contain provisions tailored to diminish the protection for data subjects.

What about human rights (again)?

However, the first matter is that should be raised is a matter of procedure.  The No.2 Bill should not proceed to any further Parliamentary stage because the UK’s Bill of Rights is still awaiting its Second Reading.

The problem arises because the UK Bill of Rights is likely to have fundamental impact on the UK’s data protection regime (evidence from the ICO – see references) so much so, it is likely undermine completely any Parliamentary consideration of the data protection aspects of the No.2 Bill.

Quite simply, it is a waste of valuable Parliamentary time to consider this No.2 Bill, if the Bill of Rights devastates the data protection landscape to the extent that any Ministerial statement concerning data protection made during No.2 Bill debates (e.g. in relation to the principles or lawful basis) is rendered worthless.

Although the No. 2 Bill is accompanied with a Human Rights Memorandum,  this document is also wholly irrelevant.  It assumes the UK will follow Strasbourg Jurisprudence (e.g. it even quotes from several European cases and explains that voluntary data sharing by public bodies would fall within the UK’s “margin of appreciation”).  In addition, there is a statement on the face of the No.2 Bill saying it is ECHR compliant.

In other words, the No.2 Bill gives the impression that the UK follows the ECHR, when DSIT/Government knows that this is completely misleading if the UK Bill of Rights commences its Second Reading.

This can be seen from the Bill of Rights itself.  In clause 1(2) it says “that it is the Supreme Court (and not the European Court of Human Rights) that determines the meaning and effect of Convention rights for the purposes of domestic law”.  Clause 1(3) states “judgments, decisions and interim measures of the European Court of Human Rights (a) are not part of domestic law…..”. In other words,  the basic assumption towards human rights compliance is the complete opposite to that promulgated by the No.2 Bill.

Further evidence for the negation of human rights arises from the aptly named “Illegal Immigration Bill” (IIB);  this explicitly raises the idea that the UK will not follow ECHR.  Indeed, many human rights commentators have suggested that the IIB creates a vast smorgasbord of ECHR non-compliance.  This includes breach of: the right to life;  freedom from torture and from slavery;  the right to a fair trial and the risk of detention without trial;  the lack of respect for family and private life;  the prospect of discrimination, and finally removal of the right to seek a legal remedy.

As an aside, the IIB sets a dangerous precedent in that it is an example of Government enacting legislation that it knows is likely to breach the ECHR.  Just imagine data sharing legislation being enacted (via a large majority Government that has a minority of the popular vote) that included something like: "The minister unable to confirm the data sharing law is compatible with A.8".

In addition, the UK’s  Adequacy Agreement with the European Commission mentions compliance with ECHR judgements and refers to the Human Rights Act over 80 times.  There is no point Ministers saying the Adequacy Agreement “is safe with the No.2 Bill”, if the risk of trashing it arises from the implementation of the UK Bill of Rights.

Finally, look at the Transfer Risk Assessment published by the ICO, in particular Q4 which deals with a human rights assessment.  The expected bonfire of human rights, consequent on the passage of the IIB, would probably mean, using the ICO’s own risk assessment methodology, that the UK would become a dodgy, no-go area for certain transfers from the EU.

The Bill of Rights subjugates the No.2 Bill

The UK Bill of Rights fundamentally changes the interpretation of the word “necessary” which is integral to the application of: any lawful basis (A.6 of the UK_GDPR); the Data Protection Principles (A.5); the Special Category of Personal Data conditions (A.9); the processing of Criminal Offence personal data (A.10); the understanding of Schedule 1 (DPA2018);  the exemptions from rights (A.23), and finally, transfers outside the UK (A.49).

This is confirmed by the ICO’s evidence to the MoJ (see references). For instance, the ICO writes:

• “Changes in how the concepts of necessity and the public interest are assessed in human rights law will inevitably have an knock on effect on their assessment in data protection  law”.
• “The concept of necessity is fundamental across the DPA/UK_GDPR (Article 5 principles, Article 6 lawful bases, Article 9 conditions for processing special category data, Article 23 exemptions, and Schedule 1)”.
• “…likely impact could make it more difficult for the ICO to protect individuals data” (e.g. “if public authorities are be able to rely on public interest grounds in a presumptive way”: (para 3.27).

The human rights challenges arising from the No.2 Bill as explained in the Memorandum are a mere pinprick compared with the privacy wasteland promised by the UK Bill of Rights.

Concluding comment

In short, Parliament needs protecting from a Government that presents one Bill for detailed consideration, when it knows that these considerations are made redundant by other legislation, also before the Parliament at the same time (in this case, the UK Bill of Rights).

An honest Government would progress, or ditch, the UK Bill of Rights first, and then second, move on to the No.2 Bill so the data protection changes can be properly debated.

Data Protection Courses (Spring 2023)

Because of the uncertainty (e.g. transport, strikes etc), the following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection PRACTITIONER Course is in London on Monday, 22 May 2023 to Friday, 26 May 2023 (5 days: 9.30am to 5.30pm).
• The next Data Protection FOUNDATION Course is in London on June 21-23, 2023 (3 days: Wednesday to Friday 9.45am to 5.00pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing info AT amberhawk.com.

References

The ICO’s evidence re the Bill of Rights is summarised/accessible from my blog at:  https://amberhawk.typepad.com/amberhawk/2022/05/ico-confirms-human-rights-changes-undermine-uk_gdpr.html

Blog post: UK Bill of Rights set to undermine UK_GDPR : https://amberhawk.typepad.com/amberhawk/2022/07/uk-bill-of-rights-set-to-undermine-uk_gdpr-and-adequacy.html

Press release and Human Rights commentary is accessible at https://www.gov.uk/government/news/british-businesses-to-save-billions-under-new-uk-version-of-gdpr

Bill of Rights: https://bills.parliament.uk/bills/3227

Government’s digital identity proposals ignore obvious privacy concerns

There is an adage (disputed by Transport for London) that if one waits at a bus-stop for more than half an hour, three or four buses will then turn up, almost in a convoy.  Curiously, this adage appears to apply to the management of digital identity.

There are four recent proposals recent proposals relating to ID which have overlapped. They are:

• the parts of the legislation in the dormant Data Protection and Digital Information (DPDI) Bill that relates to digital information. These parts take the form of a paving Bill where many of the details of how digital identity works in practice is reserved for Ministerial powers.  It is focused on enabling digital identity use in the wider economy.
• Proposed legislation based on the public consultation on “Consultation on draft legislation to support identity verification” which the Government intends to enact by Statutory Instrument (again leaving important detail to Ministers). These proposals are a pre-cursor to a digital identity scheme operating in the public sector and aims to facilitate data sharing within the public sector and thereby establish such a digital identity scheme.
• The proposals from Tony Blair’s Institute for Global Change, co-authored by Lord William Hague (ex leader of the Conservative Party), which require a “single digital-ID system for all residents” (which by implication is a compulsory digital ID scheme).
• The ID requirements for voting in elections. Conspiracy theorists will no doubt claim that these “No specified ID – No Vote” provisions  “soften-up” the public for general acceptance of the idea of presenting some form of ID when dealing with public authorities.

This blog is limited to the public consultation on proposals to support data sharing for the purpose of digital identity verification as specified in the second bullet.

Summary of the problems

The problems with the Consultation’s proposals are as follows:

• There is no detailed information on the protection afforded to data subjects (other than the UK_GDPR provisions). In practice, although data sharing is voluntary and transparent to the data subject, there is no way of returning a data subject to the position prior to that data sharing, should the data subject wish this. The data subject thus loses control of what is supposed to be in that subject’s interests.
• Data sharing is likely to include unexplained and unspecified items of special category of personal data.
• There is no reference the Government’s promised changes to the data protection and human rights legislation (e.g. the DPDI Bill). The Consultation’s assumptions on the level of protection afforded to data subjects by the UK_GDPR are likely to be incorrect.
• There is no reference to the risks associated with data sharing (and the potential to resurrect the equivalent of the National Identity Register which was at the centre of the Identity Card Act 2005).
• There is no reference to Nine Identity Assurance Principles which were officially published to guide Government on a privacy friendly approach to the introduction of a digital identity scheme.

In summary, the Consultation has too much missing for it to be treated as a reliable representation of what is being proposed.

Identity Assurance Principles

As background, I refer to the “Nine Identity Assurance Principles” that were published in 2015 for inclusion in any Governmental future digital identity project (see references).  The objective was to avoid a repeat of the ID Card debacle a decade earlier; the Government asked a number of privacy experts (including the ICO and yours truly) to debate and draft a set of objectives.

As a result, these Principles emerged to provide a benchmark for all digital identity schemes. It allows one to identify which Principle is not being considered and the consequences of that lack of consideration.  In this Consultation, none of the Principles have been considered.

In summary, these Principles are:

• The User Control Principle (Identity assurance activities can only take place if the data subject consents or approves them).
• The Transparency Principle (Identity assurance can only take place in ways a fully informed data subject understands).
• The Multiplicity Principle (The data subject can use and choose as many different identifiers or identity providers).
• The Data Minimisation Principle (Any request from the data subject or identity assurance transaction only uses the minimum personal data that is necessary).
• The Data Quality Principle (The data subject chooses when to update their records).
• The Service-User Access and Portability Principle (The data subject is provided a copy of all personal data on request and can move/remove their personal data on request).
• The Governance/Certification Principle (There is public confidence in any Identity Assurance System because all the participants have to be accredited).
• The Problem Resolution Principle (If there is a problem there is an independent arbiter who can find a solution).
• The Exceptional Circumstances Principle (Any exception to the above Principles has to be approved by Parliament in new legislation to ensure the law is subject to scrutiny in the context of the operation of a digital identity scheme).

Note that together, these Principles set out the circumstances which maintain public confidence in any digital identity proposal.   Such confidence is achieved by placing the data subject in control and at the centre of any processing of their digital identity details.

Although the Principles are ignored with the current Consultation,  some Principles partially arise as a result of the implementation of the UK_GDPR  (e.g. data minimisation, limited transparency).  Other omissions, however, raise matters of concern. For example, there is only to be one identity available, contrary to the Multiplicity Principle.

In addition, an individual whose identity has been established is not fully in control of when public authorities reveal their identity details.   This is because any associated identity database held by a public authority falls foul of the  Exceptional Circumstances Principle  and access to digital identity information could be lawful, when that law allowing access did not have any Parliamentary scrutiny or consideration of its impact on a digital identity scheme.

Attributes for a National Identity Database?

The Consultation states that “Public authorities will process the minimum number of data items, known as attributes, necessary for verifying the identity of an individual”. Remember these data items are then potentially available to any other public body involved within the proposed data sharing scheme, or accessible via any other legislation that allows access to these identity attributes.

Examples of attributes include: “user’s full name; date of birth; home address; email address; photographic images; various identifiers such as passport number or driving licence number; attributes held by government departments necessary for verifying the identity of an individual; the outcome of identity checks previously performed on a user; and transactional data, for example, income”.

It is not obvious to me that “income” and “email address” are attributes that identify an individual.

The Consultation also adds that “other data items may be processed as identity verification services develop. This may include special category data….”.  Obvious examples of special category of personal data, used in the context of identity includes facial recognition, fingerprints and DNA profiles. So are these going to be used?

Sadly, the Consultation dumbs down on the detail here,  when in practice it should have been crystal clear what is intended with the processing of special category of personal data in the context of digital identity. This resultant lack of clarity raises more questions than answers (and is likely to engender mistrust of the proposals themselves).

Finally, just imagine if these personal data items held by each public authority for establishing a digital identity scheme were collated in one database;  this would essentially replicate the National Identity Register (NIR) specified in the ID Card Bill of 2005 (and resurrect all the horrendous privacy issues discussed two decades ago).

The only difference with the Consultation? Each public body now has its own database which it can share with other public bodies.  In effect this is a proposal for new NIR, distributed across participating public bodies.

Data subjects are unprotected

So what protects the data subject? According to the Consultation, protection arises from the fact that data sharing occurs subject to the UK_GDPR (e.g. the data sharing code) and other data ethics guidance.

In practice, the data subject is not in control. There is no way that the data subject, having agreed to data sharing, can recover to the position which applied prior to that data sharing; this is contrary to the Service-User Access and Portability Principle.

Although the data subject is fully informed, there is little the data subject can do with that information because:

• withdrawing consent to the data sharing does not work. Consent is irrelevant as any data sharing is justified in terms of the public task of participating public bodies.
• the right of erasure does not apply as the processing is made lawful by being part of the public task of participating public bodies.
• the right to object to the processing is going to be very difficult as the data subject has to demonstrate grounds in relation to his position and these grounds are likely to contested.

What about DPDI or Human Rights changes?

The Consultation ignores the potential impact of the Government’s proposed changes to the data protection and human rights regimes.

For example, in an earlier blog, I showed that the DPDI Bill allowed HMRC to lawfully obtain personal data for its purposes via voluntary disclosure from any controller even when there is no “public interest” component to a particular disclosure of personal data to HMRC (see references).

Indeed a particular disclosure did not need to be associated with any specific HMRC investigation (i.e. a failure to disclose does not prejudice HMRC’s collection or assessment of tax).   HMRC is specified in the Consultation as a participant in data sharing (but one suspects that data sharing occurs only in one direction).

With respect to Human Rights changes, I raised the issue that the British Bill of Rights changes who interprets the meaning of necessity, public interest and proportionality and thereby changes the nature of the link between the UK_GDPR and A.8 of the European Convention of Human Rights (right of respect for private and family life etc).

In general, the Bill of Rights changes the ultimate arbiter of what data sharing is “proportionate”, “necessary” or  “in the public interest”.  These terms are to be specified by Ministers; so if Ministers says certain data sharing with HMRC is “necessary”, then it is necessary and almost impossible to challenge (see references).

For clarity, I am not picking on HMRC.  I am using HMRC to show that the proposed changes in data protection and human rights law fundamentally alters the data protection analysis presented to the public by this Consultation.

Concluding comment

I am convinced the Consultation has little to do with protecting the data subject; it is designed to assist data sharing between public bodies at their convenience.  The omissions in the Consultation  means that it should be reworked, with the Nine Identity Assurance Principles at their heart.

Data Protection Courses (Early Spring 2023)

Because of the uncertainty (e.g. transport, strikes etc), the following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• The next Data Protection PRACTITIONER Course is in London on Monday, 27 March 2023 to Friday, 31 March 2023 (5 days: 9.30am to 5.30pm).
• The next Data Protection FOUNDATION Course is in London on Tuesday April 18-20, 2023 (3 days: 30am to 5.30pm).

Full details on the new  Amberhawk website (www.amberhawk.com) or  obtained by emailing info AT amberhawk.com.

References

Consultation on draft legislation to support identity verification . https://www.gov.uk/government/consultations/draft-legislation-to-help-more-people-prove-their-identity-online/consultation-on-draft-legislation-to-support-identity-verification

Tony Blair’s Institute report which suggests for digital ID for everyone as a consequence of a push for growth:  https://institute.global/policy/new-national-purpose-innovation-can-power-future-britain

The Nine Identity Assurance Principles: https://www.gov.uk/government/publications/govuk-verify-identity-assurance-principles/identity-assurance-principles

Blog post: Voluntary disclosure to HMRC? Always lawful and always compatible: https://amberhawk.typepad.com/amberhawk/2022/08/voluntary-disclosure-to-hmrc-always-lawful-and-always-compatible.htm

Blog post: UK Bill of Rights set to undermine UK_GDPR : https://amberhawk.typepad.com/amberhawk/2022/07/uk-bill-of-rights-set-to-undermine-uk_gdpr-and-adequacy.html

GDPR cost UK £23 billion says Minister in charge of data protection

Three important facts have survived the political psycho-drama of the last two months.

• Despite approaching austerity, the Government remains committed to the removal or modification of all EU Regulations such as the GDPR by the end of 2023.
• The re-appointment of Suella Braverman (Home Office) and Dominic Raab (Ministry of Justice) increases the risks to the UK’s Adequacy Agreement, courtesy of these Ministers’ desire to fundamentally alter the Human Rights Act.
• Michelle Donelan returns to the DCMS as data protection supremo; she made the £23 billion costs-claim during her speech to the Conservative Party faithful (on October 3^rd, see references).

The omens are that the Data Protection and Digital Information (DPDI) Bill will be further modified. During her conference speech, Ms. Donelan told delegates:

“Our new data protection plan [i.e. other than the plan in the DPDI Bill] will focus on growth and common sense, helping to prevent losses from cyber-attacks and data breaches, while protecting data privacy. This will allow us to reduce the needless regulations and business-stifling elements, while taking the best bits from others around the world to form a truly bespoke, British system of data protection”.

Warming to her theme, Ms Donelan added: “We inherited GDPR from the EU, and its bureaucratic nature is still limiting the potential of our businesses. So much so that researchers at Oxford University estimated that it has directly caused businesses to lose over 8% of their profits” (my emphasis).

There are two comments to make:

• Wow!! Over 8% of profits! How much did that cost the economy?  Donelan failed to give the number;  this blog does.
• Donelan has ditched the previous Secretary of State’s inflated claims that the DPDI Bill saved over £1 billion.

In relation to that 8% claim, for companies registered in the UK, all profits are currently subject to 19% corporation tax;  the HMRC website states that for each of the last four years, corporation tax has raised about £55 billion approximately for the Treasury (see references).

It follows that if £55 billion equates to 19%,   the total taxable profits subject to corporation tax (i.e. the 100% of profits) is about £290 billion and the loss of “over 8% of profits” is a loss of over £23 billion.  Hence the headline.

So, the Secretary of State wants us to believe that not implementing the UK_GDPR would have reduced the self-inflicted, Trussian, £40-£50 billion black hole in the UK economy by about half.

It does not take a genius to realise the 8% is an error – yet Ms. Donelan used it as if it were correct.

The Oxford research

The research is the first attempt to calculate the impact on firms’ profitability arising as a result of the implementation of the GDPR; this is a very valid objective.  This objective is completely different to the publication of (bogus) DCMS numbers to justify the savings (about £1.5 billion over a decade) made by the Government’s implementation of the DPDI Bill (see references for my blog post on this false accounting).

To be fair to the Oxford research, it is a “Working Paper” (see references for URL); the research is not a finalised, peer reviewed, academic article.  This alone is reason enough to say that the Secretary of State was very premature to quote a headline result from this Paper  (the 8% loss of profits) without explaining its preliminary status.

One suspects, however, that more selective quotations will emanate from the Secretary of State about this research; hence the reason for this blog.

If this happens, the real problem is not the research (which is discussed below), it is the provenance of the research – Oxford University (see references for URL).  Quite simply, the University’s prestige risks being used to cloak Ms. Donelan’s data protection changes with an aurora of respectability.

Research methodology

In summary, the research methodology looked at 3 million balance sheets, predominantly of companies with more than 500 employees, from 2011 to 2017;  these have been collated by the OECD across 62 countries. This is compared with a second grouping containing the OECD balance sheets for the same companies from 2018 to 2020.  The GDPR was agreed in 2016 and became law in 2018.

As the balance sheets contain information relating to sales, profits and employment, the basic idea is that any significant divergence in profitability from year to year (like an economic shock to the system) can be put down to the costs of implementing the GDPR if, as the researchers claim,  other significant effects/shocks such as COVID can be excluded (e.g. by an extensive data cleaning process).

Because the raw data include sales, the research estimates that the GDPR implementation has also reduced sales by 2%.

However, the important point is this: the approach calculates the financial impact of the GDPR directly from these balance sheets.  There is no data protection input into the econometrics – only the assumptions underpinning the econometrics.

Questions: three assumptions

The research assumes the major difference between the two sets of balance sheets from OECD countries (i.e. from 2011-2017 and from 2018-2020) arises from the implementation of the GDPR.  This assumption is unreliable.

As is well known, many OECD countries have data protection laws with standards that approximate to the GDPR standards.  For example, compliance with Principles (e.g. security, accuracy, transparency) and the data subjects’ rights (e.g. of correction, erasure or access) often form important parts of national legislation based on OECD’s data protection guidelines (e.g. in New Zealand, Australia).  This has been the case since 1980 when the OECD Guidelines were first published.

Therefore, to lay 100% of these costs (e.g. of dealing with security, data subject rights or auditing compliance etc) at the feet of the GDPR, when they also arise in legislation based on OECD Guidelines,  is likely to over emphasise the GDPR implementation costs.

The second assumption relates to the APEC Privacy Framework; these APEC privacy rules follow the OECD Guidelines and were published 2015, and their implementation in the Asian-Pacific region would be at the same time as the GDPR (published in 2016).  As the research makes no reference to APEC, what could have been measured by the research is APEC plus GDPR implementation costs together.

The third assumption is that OECD companies have not implemented the GDPR until it came into effect in 2018.  However, large OECD companies often establish in the European Union; this means they would be required to meet the GDPR obligations (or even perhaps obligations under the earlier data protection Directive 95/46/EC) at a much earlier stage.

One suspects, therefore, the size of the second cohort of balance sheets used in the research to identify divergences is too short a range.  It should also have considered APEC implementation costs.  If these two statements are correct, their combined effect would be to over-emphasise the headline GDPR costs on firms – hence the 8% is an over-estimate of the GDPR costs alone.

Questions: USA high tech companies

The researchers report that USA high tech companies experience no variation in profit or sales as a result of the implementation of the GDPR.

A likely explanation of this is because many of them (e.g. Google, Facebook) are established in Eire and were required to implement the GDPR much earlier.  Indeed,  because of the controversial Google Spain judgement in 2012, processing by Google in the USA was considered by the CJEU to be processing subject to the Data Protection Directive 95/46/EC.

In other words, this zero result recorded in the research could well be as a result that the cost of data protection compliance for USA high tech companies commenced from 2012 (and not in 2018 as assumed by most of the research).

As an aside, a “small” company as defined in the research has less than 500 staff (i.e. twice the size of the European Commission’s definition for a Small to Medium sized Enterprise).  I suspect this point has been missed by Ms. Donelan, whose speech quoted above referred to a small business as one employing a handful of staff.

Questions: GDPR assumptions

Similarly, there is unsatisfactory commentary to explain the 8% figure in terms of GDPR implementation costs.  For example, OECD firms trading with data subjects in the EU have “to appoint a DPO to oversee data management activities” or “are required to encrypt and anonymise any personal data it stores”.

This explanation is incomplete. DPOs are needed by firms but only when their processing presents high risks to data subjects (which is not the case for all firms).  Encryption and anonymisations are not mandatory requirements; they need to be considered for implementation if their use would be both technologically appropriate and cost-effective.

Data breach reporting, picked out in the research, is a common feature of international data protection law, and is not unique to the GDPR.

Questions: consent

Also, the research places 2% of the loss of sales down to GDPR “consent” procedures (e.g. with respect to data sharing and third party marketing),  thus overlooking the data protection implications of this conclusion.

As is well known, “consent” in Directive 95/46/EC was much degraded to such an extent that practices, employed by Cambridge Analytica (and in the UK Referendum) emerged.  This created a scandal that still threatens to undermine or polarise the democratic process.

In the DPDI Bill, Ms Donelan is bent on replacing “data subject consent”  (e.g. where the individual can control marketing and research options) and replacing it with “legitimate interests of the controller” (where the controller is in charge). She has yet to describe how these changes will protect individual privacy from the pervasive internet surveillance practices, which will increasingly depend on “legitimate interest”.

Concluding comment

In her speech to Conservative Conference, Ms Donelan concluded: “I am an evidence-based politician and over the coming months you will see that I am not afraid to make tough decisions”.

By relying on these preliminary research results,  it appears that Ms. Donelan’s evidence for data protection change is of a kind displayed on the side of that red Brexit bus.

Data Protection Courses (Winter 2023)

I am holding a day workshop on the changes arising from the Data Protection and Digital Information Bill on Thursday, January 12^th, 2023 (by Zoom only).  The fee is £250 + VAT per delegate.  Program available from:  info AT amberhawk.com

Because of continued uncertainty (e.g. weather, transport, COVID), the following BCS Partitioner courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance) just in case “stuff happens on the day”.

• The next Data Protection PRACTITIONER Course is in London on Monday 30th January 2023 - 3rd February 2023 (5 days: 9.30am to 5.30pm).
• The next Data Protection FOUNDATION Course is in London on Tuesday February 7-9, 2023 (3 days: 30am to 5.30pm).

Full details (as we are upgrading our Amberhawk website), details of all the above courses can be obtained by emailing info AT amberhawk.com

References

Ms.Donelan’s speech: https://www.conservatives.com/news/2022/our-plan-for-digital-infrastructure--culture--media-and-sport

The Oxford University research: https://www.oxfordmartin.ox.ac.uk/publications/privacy-regulation-and-firm-performance-estimating-the-gdpr-effect-globally/

Government savings from the DPDI Bill: see DCMS fails to spend a penny to protect data subjects on https://amberhawk.typepad.com/amberhawk/2022/05/dcms-fails-to-spend-a-penny-to-protect-data-subjects.html

Google Spain CJEU Case C 131/12.  The important point is that processing by Google USA became subject to Data Protection Directive 95/46/EC in 2012; costs of implementation of data protection can be assumed to start from that date and not from 2018 as the Oxford research assumes.  Hence the zero result reported by the research.

Corporation tax receipts average about £55 billion over the last 4 years: see https://www.gov.uk/government/statistics/corporation-tax-statistics-2022/corporation-tax-statistics-commentary-2022

Expansive RAS exemption in DPDI Bill encourages unethical research

It is well publicised that the Liz Truss Government wants rid of all that Euro-“red tape” by the end of 2023.  The Data Protection and Digital Information Bill (the “Bill”) does just that for the GDPR.

Previous blogs have explained the Government has used its “Brexit Freedoms” to define “personal data” below DPA1984 standards, and to legitimise widespread data sharing across the public sector (e.g. to permit disclosure to HMRC when disclosure is not necessary for its functions).

This blog covers the removal of another layer of data subject protection; the exemption that applies to the processing of personal data for “RAS purposes”.  “RAS purposes” is the Bill’s shorthand for scientific research, archiving in public interest, historical research and statistical research.

The idea underpinning the Bill’s RAS exemption is as follows.  If all the statutory safeguards associated with RAS are implemented, then there is no privacy risk to data subjects or impact on them.  In these circumstances, their personal data can be lawfully used and shared for public and private sector RAS purposes, often without informing the data subject about the RAS purposes.

In addition, if these safeguards apply, then the Bill makes any further processing for RAS purposes always compatible with the purpose of obtaining.

As is explained later in the blog, if the RAS exemption applies, the data subject’s right to object to the processing does not apply in practice.  In addition, in many instances, it would be “disproportionate effort” to inform the data subject about the RAS purposes.

The Bill also relaxes the definition of “consent” in the context of scientific research (Clause 3 of the Bill).  However,  reliance on data subject’s consent for RAS purposes is likely to decrease in importance as the legitimate interests lawful basis becomes more attractive for private sector RAS.

Meanwhile,  public sector RAS processing can avoid consent by using the lawful basis of necessary for a public task  or RAS that is in “the pubic interest”.

Note that the safeguard of withdrawal of data subject’s consent for RAS purposes is diminished, as many controllers can switch their lawful basis from consent.

If Special Category of Personal Data is processed for a RAS purpose, that purpose has to be in the “public interest” (see Schedule 1, para 4, DPA2018);  medical research, additionally, is likely to be subject to the approval by an ethics board.

However, these protections are limited if a Secretary of State is determined to specify where the “public interest” lies (e.g. use powers under S.251(1)(a); NHS Act 2006) or to influence or reverse any medical ethics board decision (e.g. by appointing “supportive” members: see S.19(4)(b) and S.19(5); DPA2018).

RAS safeguards

The Bill defines Scientific Research (one of the RAS purposes) to include “any research that can reasonably be described as scientific, whether publicly or privately funded, including processing for the purposes of technological development or demonstration, fundamental research or applied research”.

It can be seen that the definition can include, for example, private sector processing of personal data for proof of concept in new software designs,  AI techniques or the development of leading edge technologies (e.g. a new internet surveillance technology).

The RAS purpose exemption set outs a number of safeguards (in new A.84B and A.84C of the UK_GDPR which overlap with S.19 of the DPA2018).  Combined, these require that for the RAS exemption to apply, the processing of personal data:

• protects the rights and freedoms of data subjects;
• does not permit the identification of a data subject (apart from the initial obtaining of personal data);
• does not cause substantial damage or substantial distress to any data subject;
• does not take decisions with respect to any particular data subject, and
• uses data minimisation or pseudonomisation techniques.

The application of the above RAS safeguards explains why the following proposition can be promoted:

 “As there is no impact on a particular data subject or risk to any specific data subject’s privacy interests, controllers can be safely permitted untrammelled use and disclosure of personal data for RAS purposes”.

Disproportionate effort

Central to keeping data subjects out of the loop is the definition of “disproportionate effort” in the Bill.  This applies when personal data are obtained by a controller:

• from a source who is NOT the data subject, or
• from data subjects who do not know about the controller’s further intention to process their data for RAS purposes, because these purposes did not exist at the time of the original collection of the data from them.

The question then is: “should data subjects, in these circumstances, be informed concerning the RAS purposes?”.

New A.13(6) and A.14(6) defines “ disproportionate effort” as a non-exhaustive list that “depends on, among other things, the number of data subjects, the age of the personal data and the appropriate safeguards applied to the processing”.  Amongst the “other things” could include: “impact on the data subject” or “what resources are needed to contact all data subjects”.

Now consider the following. Suppose a controller discloses an existing database of ordinary personal data concerning 20,000 people to another controller for a RAS purpose.  As the “appropriate safeguards” mentioned previously apply,  there is no privacy risk, no threat to rights and freedoms, no harm, no damage, no distress and no impact on data subjects etc.

So, would it constitute “disproportionate effort” to contact 20,000 data subjects to provide each with the following Privacy Notice, which includes something on the lines of:

“Controller X is processing your personal data for RAS purpose. There are no privacy risks to you, no threats to your rights and freedoms, no harm, no damage, no distress and no impact on you whatsoever.  Indeed this big load of nothing also applies to everybody else.”?

In short, I think the “disproportionate effort” test is passed and data subjects have no need to be informed about the RAS purposes.

Note that the more data subjects there are (e.g. disclosure of a database of one million), the easier the disproportionate effort threshold is passed.  In other words, the way disproportionate effort is defined in the Bill is counter-intuitive: “the more data subjects there are, the easier it is to keep them in the dark about the processing”.

Finally, disproportionate effort  does not mean the Privacy Notice omits details of the RAS processing.  Clearly, these details must be presented in any up-to-date Notice when personal data are collected (or recollected) directly from data subjects.  The exemption merely means that the Notice specifying the RAS purposes is not sent to data subjects, who do not know about these RAS purposes, at the time of the processing.

Right to object

The right to object to the processing applies to RAS processing if it is legitimised by using an A.6(1)(e) or A.6(1)(f) lawful basis.  However, the data subject has to show overriding “grounds in relation to his or her situation” if the right is to prevail (unless the research is in the public interest; A.21(6)).

Now if the “appropriate safeguards” that apply to disproportionate effort apply to this right, then the “grounds in relation to his or her situation”  do not involve a privacy risk, a threat to other rights and freedoms, harm, damage, distress or impact on data subject.  I short, I am struggling to find an overriding ground that the data subject could present.

Of course there might be the odd rare exception of a successful use of the right to object, but the right, in general, would not apply to RAS processing en-masse.

My own view is that if the Bill’s RAS provisions go ahead, the right to object to the processing for RAS purposes should be the equivalent to that applying to direct marketing.  The data subject should not have to declare appropriate grounds in order to exercise the right to object, and the right should always prevail, if exercised.

This is an essential protection for data subjects if data subjects loose trust in the researchers or the research; in addition, it will encourage researchers to earn the trust of data subjects.

Policy issues of concern

There are several policy areas of concern that have yet to be debated in public.  They are as follows:

• Private and public sector processing for RAS purposes can occur without the knowledge of the data subject so long as RAS safeguards apply.

Is the exclusion of the data subject’s wishes in connection with RAS processing the correct stance to take? Does the exclusion accord with those research ethical standards which hitherto often rely on informed consent, especially RAS using special category of personal data? Should the data subject approve such processing even though the risk to the data subject is very low? (This last question was a key issue in Source Informatics: see references).

• Is there a false separation between the development of an idea and its implementation? For example, does “the development of leading edge, internet surveillance technology” cause substantial distress?

The safeguards in the Bill ensure its answer is “NO”.  The actual technology once employed might be very harmful to data subjects indeed, but the development phase of the processing  (e.g. to see whether the idea works) does not impact on any data subject nor challenge their rights and freedoms etc.

• RAS could be very profitable for private sector concerns as it potentially provides access to huge amounts of personal data to improve/ generate new services which benefit them directly. It is not at all clear whether the UK economy will benefit.  For instance, what is to stop the processing for RAS purposes, initially commenced in the UK, where the profits of new product lines are accrued outside the UK (e.g. in the USA).
• With public sector RAS, the tax payer gets the benefits (e.g. in improved services or enhanced efficiency); with private sector RAS, the senior managers and shareholders reap the rewards.  The tax payer or customer, whose personal data are being processed by the private sector, gets ….. well your guess is as good as mine!?  (A discrete “thank you” donation to a political party, perhaps).
• There appears to be an assumption that RAS safeguards will actually be maintained. How does the data subject or ICO retrieve the situation if a controller, based outside the UK, obtains personal data for RAS purposes but does not maintain the specified safeguards?
• Does the Bill foster a climate of trust between the researcher and data subjects if the latter has no choice in relation to RAS?

Grim detail of RAS exemption

What follows is a step by step fully referenced guide to the RAS exemption, assuming that all the statutory safeguards are implemented (see above).  There are three separate situations to consider:

• When a controller decides to use existing personal data for RAS purposes.
• When a controller decides to disclose existing personal data to a Third Party for its RAS purposes.
• When that Third Party obtains the disclosed personal data for a RAS purpose.

RAS exemption (USE)

Further use by a controller for RAS purposes, concerning personal data that have already been collected by that controller, can occur without informing data subjects.  Clause 9(1)(b) of the Bill introduces new provisions in A.13(5) which negates the right of a data subject to obtain transparency information about a “further RAS purpose” (in A.13(3), subject to the disproportionate effort test being passed – which it is, as RAS safeguards apply).

In the private sector, this further use would have as its lawful basis “legitimate interests of the controller” (e.g. to make pots of money) which has to be balanced against the existence of overriding “interests or fundamental rights and freedoms of the data subject” (A.6(1)(f)).

As each data subject’s legitimate interests are protected by all the safeguards (see above), then the controller’s processing is lawful and, like the right to object, it is difficult to establish that there is an overriding interest on the part of the data subject to protect.  As stated above, there might be a rare exceptional case where the data subject’s position prevails.

In the public sector the lawful basis is likely to be “public task”  (e.g. University research) or “in the public interest” (e.g. Ministerial powers); there again the right to object does not, in practice, apply.

In addition, the controller’s further use for RAS purposes is deemed to be compatible with the purpose of obtaining. (See A.8A(3)(b) of the UK_GDPR introduced by Clause 6(5) of the Bill; interpret the word “processing” at the beginning of A.8A(3) as “use”).

If data subjects find out about the RAS purposes, they can do very little about it as the right to object to the processing does not apply, in practice (see above).  Data subjects could refuse to provide any personal data to the controller, but this step is likely to result in them forgoing the controller’s services.

Finally, the controller’s Privacy Notice has to be updated to reflect the RAS purposes.

RAS exemption (DISCLOSE)

Suppose our controller who is using personal data, already collected from the data subject, sells personal data for a RAS purpose.  Here there is a disclosure from the selling controller and obtaining by the separate buying controller; it’s the same transaction viewed from different ends of the telescope.

As the purpose of the disclosure to other controllers is for the RAS purposes, the lawful basis remains “in the legitimate interests of the controller” (making money from the disclosure).  One could even argue that it is also in the “legitimate interest of Third Party” to whom personal data are disclosed, as the disclosure allows the Third Party to perform the RAS purposes (i.e. A.6(1)(f) applies).

As there is no impact or privacy risk to any data subject, there is “no legitimate interest” of the data subject to protect because RAS safeguards apply.  Similarly the right to object to the disclosure for RAS purpose does not apply in practice (as explained above).

So as explained in the previous USE section of this blog, there is no need for the disclosing controller inform existing data subjects of the further disclosure for RAS purpose as personal data have already been obtained from the data subject. (A.13(3) excluded by A.13(5) as introduced by Clause 9 of the Bill).  However, the disclosing Controller’s Privacy Notice has to be changed to reflect the disclosure for RAS purposes.

The disclosure for a RAS purpose is also deemed to be compatible. (See A.8A(3)(b)) introduced by Clause 6(5) of the Bill, but this time read “processing” in A.8A(3) to mean “disclosure”).

RAS exemption (OBTAIN)

Note that the obtaining controller has not obtained personal data from the data subject unlike the disclosing controller as described above.

The lawful basis of the obtaining  controller remains “legitimate interests” and this covers future processing (e.g. use and onward disclosure) so long as the processing is for RAS purposes and the statutory safeguards protect the data subject’s interests.

The obtaining controller has no need to inform data subjects of the RAS purpose because informing the data subject would constitute “disproportionate effort”.  This is because there is no impact on the data subject from the processing as the safeguards protect the data subject’s interests. (We have already covered this ground in relation to A.13,  but the relevant detail here is in A.14(5)(e) and A.14(6) of the UK_GDPR as introduced by Clauses 9(2)(a)(v) and 9(2)(b) of the Bill).

The processing is compatible (A.8A(3)(b);  Clause 6(5) of the Bill).   However, this time obtaining controller has to make a public statement about processing for RAS purposes (new A.14(7); Clause 9(2)(b) of Bill).  This can be easily done via an update of the relevant Privacy Notice in the public domain.

Concluding comments

If the safeguards apply, RAS processing is lawful and compatible and often unknown to the data subject.  And this applies to onward disclosures to, and uses by,  other controllers for RAS purposes.

Several Secretaries of State have espoused, as part of their post Brexit “rush for growth”, the notion that personal data is the “new oil”.  The Bill intends to make that oil available on tap, for any RAS purpose of any kind, undertaken by any controller anywhere, often without any reference to each data subject’s wishes.

I am looking for a word to describe this situation; “unethical” readily comes to mind.

In this Wild West “free for oil”, it is only a matter of time before there is the data protection equivalent of the catastrophic spills of the Exxon Valdez or Torrey Canyon.

Autumn Data Protection Courses

I am holding another day workshop on the changes arising from the Data Protection and Digital Information Bill on Tuesday, September 27 (by Zoom only) and Thursday, October 27 (by Zoom only).  The fee is £250 + VAT per delegate.  Program available from:  info AT amberhawk.com

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection PRACTITIONER Course is in London on Monday October 31-November 4 (5 days)
• The next Data Protection FOUNDATION Course is in London on Tuesday November 15-17 (3 days).

Full details (as we are upgrading our Amberhawk website), details of all the above courses can be obtained by emailing info AT amberhawk.com

References

Under the common law of confidence, should patients consent if their medical records are to anonymised? The lower Court said “yes” reversed on Appeal.

• Source Informatics - Court of Appeal: Neutral Citation Number: [1999] EWCA Civ 3011
• Source Informatics v DoH: v [1999] EWHC 510 (Admin) (28 May 1999)

A BIG THANK YOU for Hogan Lovells for producing a Keeling Schedule for the UK_GDPR: this should be the job of DCMS. https://www.engage.hoganlovells.com/knowledgeservices/news/uk-data-protection-reform- how-the-uk-gdpr-may-change

DPDI defines “personal data” below DPA1984 threshold: https://amberhawk.typepad.com/amberhawk/2022/08/new-data-protection-bill-defines-personal-data-below-dpa1984-threshold.html

Voluntary disclosure to HMRC? Always lawful and always compatible: https://amberhawk.typepad.com/amberhawk/2022/08/voluntary-disclosure-to-hmrc-always-lawful-and-always-compatible.html

Voluntary disclosure to HMRC? Always lawful and always compatible

This blog questions how the Data Protection and Digital Information Bill (the “Bill”) impacts on the lawfulness and compatibility of any further processing by a controller, in particular, a controller that voluntarily discloses personal data to HMRC.  This worked example illustrates how this Bill further undermines the current level of protection afforded to data subjects.

In summary, the Bill allows HMRC to lawfully obtain personal data for its purposes via voluntary disclosure from any controller;  such disclosures can occur even when:

• there is no “public interest” component to a particular disclosure to HMRC and
• where a particular disclosure is not associated with any specific HMRC investigation (i.e. a failure to disclose does not prejudice HMRC’s collection or assessment of tax).

If these changes are enacted, it will become difficult for the data subject (or ICO) to claim that there has been unlawful processing of personal data by HMRC.

Although the example used is a disclosure to HMRC,  similar issues arise with voluntary disclosures of personal data to any law enforcement agency pursuing a criminal investigation, especially those agencies which bristle with information collecting powers (e.g. DWP).

As usual, the Explanatory Memorandum to the Bill does not touch on the subject matter of this blog (e.g. why is voluntary disclosure to be expanded in this way?); perhaps it is designed to be an Unexplanatory Memorandum.

The current compatibility test

Before describing the changes made by the Bill, it is worth understanding how the Purpose Limitation Principle and the compatibility assessment work together when disclosures to public bodies (e.g. to HMRC) occur under the current UK_GDPR regime.

The Purpose Limitation Principle requires personal data to be “collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes” (my emphasis).

So if a controller has collected personal data and is then asked to disclose such data to HMRC for its purposes, the relevant “further” processing specified by the Principle is the controller’s disclosure to HMRC for its tax purposes.

The key issue in this Principle is whether such a disclosure is “incompatible” or not.  This question is answered using the provisions of Article 6(4) which provides three options as to whether that further processing is incompatible.

In our example (voluntary disclosure to HMRC for tax purposes), the further processing is NOT incompatible if the processing:

• has the consent of the data subject
• constitutes “a necessary and proportionate measure … to safeguard …. any of the objectives referred to in Article 23(1)” (this is a reference to the possibility that a disclosure can satisfy an exemption specified in Schedule 2 to 5 of the DPA2018), or
• passes the compatibility assessment test (also detailed in A.6(4)). This considers, for instance, the nature of the personal data disclosed, the relationship between the disclosing controller and data subject, the impact on the data subject of the disclosure etc.

As there is an applicable exemption in Schedule 2, paragraph 2 of the current DPA2018 that covers all HMRC’s tax processing, it is the second bullet point that applies.

In further detail, this tax exemption can exempt any data subject right, the Lawfulness, Fairness and Transparency Principle and the Purpose Limitation Principle,  if application of any of these rights or Principles would “prejudice the assessment or collection of tax or duty”.

Thus before a controller volunteers disclosure to HMRC, HMRC would have to assert that a failure to disclose would prejudice these matters (e.g. collection of tax).  Once this assertion is documented, then the Purpose Limitation Principle is exempt and compatibility does not need to be considered by the disclosing controller.

Note that if there is “no prejudice” (i.e. the exemption does not apply) and in the absence of data subject consent, then the disclosure is likely to be incompatible in breach of the Purpose Limitation Principle.  It is this restriction that the Bill seeks to lift (i.e. make all voluntary disclosures of personal data compatible, in the absence of data subject consent and, without the application of the taxation exemption).

For completeness, the voluntary disclosure by the controller to HMRC has a lawful basis if the exemption applies. It is in “the public interest” as the HMRC are investigating (it’s in the public interest to catch tax evaders) and the disclosure is to another person (the HMRC) who has a function conferred on it by an enactment; namely Article 6(1)(e).  The gory detail of this position can be found in my previous blog.

What are the Bill’s changes?

In summary, the Bill introduces two Annexes:

• Annex 1 provides an A.6 lawful basis for a disclosing controller to make these voluntary disclosures (e.g. to HMRC); the new construction avoids the application of a “public interest” test to a particular disclosure of personal data (also explained in my previous blog).
• Annex 2 exempts the Purpose Limitation Principle in all circumstances (e.g. even when there is no prejudice to HMRC’s tax functions).

First, however, new Article 8A introduced into the UK_GDPR by the Bill, states that the processing is automatically compatible if “the processing meets a condition in Annex 2”.  Annex 2 comprises a list of 11 conditions including taxation and law enforcement.

In the context of a voluntary disclosure to HMRC, Annex 2 provides two options for this disclosure.

Option 1 disclosure

The first option occurs when:

• “the processing is necessary for the purposes of making a disclosure of personal data to another person in response to a request from the other person” (e.g. in our example, the HMRC is the “another person” asking for a controller to disclose to it).
• “the request states that the other person (in our example, this is HMRC) needs the personal data for the purposes of carrying out processing that”—
  • “is described in Article6(1)(e)”  (e.g. for HMRC’s public task)
  • “has a legal basis that satisfies Article6(3)”  (e.g. HMRC’s public task is the functions bestowed on it by enactment), or
  • “is necessary to safeguard an objective listed in Article23(1)(c) to (j)”.  (Article 23(1)(e) explicitly refers to exemptions needed for “taxation matters”).

As there is an applicable exemption covering taxation matters in Schedule 2, paragraph 2 of the current DPA2018, one can see that Option 1 covers disclosures to HMRC in circumstances similar to the current arrangements but in the absence of “public interest” considerations.

So any controller volunteering personal data to HMRC via Option 1 does not need to consider the compatibility arrangements.

Option 2 disclosure

The second option is in Annex 2, paragraph 10.  Under the heading “Taxation”, the paragraph states that “This condition is met where the processing is carried out for the purposes of the assessment or collection of a tax or duty or an imposition of a similar nature”.

So why have two conditions that apply to disclosures to HMRC?  Well, if one condition applies when an exemption applies to the disclosure (Option 1), the Option 2 condition becomes relevant when the exemption cannot be applied.   Remember Annex 1 negates the need for a “public interest”  test to be applied to the disclosure to HMRC.

Hence the availability of an Option 2 disclosure confirms my conclusion that HMRC is seeking to lawfully obtain personal data from controllers even when (a) there is no public interest in the disclosure and (b) where such a disclosure is not associated with any specific HMRC investigation  (i.e. a failure to disclose does not prejudice HMRC’s collection or assessment of tax).

Note the taxation condition (paragraph 10) does not even require the disclosure to be “necessary” for HMRC functions, unlike the paragraph 5 which requires disclosure to be “necessary” for law enforcement processing.

Mind you, if the Government’s proposed Human Rights changes are implemented, the ICO and Courts will be required to give “great weight” to what Prime Minister Liz Truss decides as “necessary” and “proportionate”.  So, in practice, any “necessary” safeguard is likely to be significantly degraded (see references).

Concluding questions

The combined effect of Annex 1 and Annex 2 is to provide a huge exemption from the provisions that best protect the data subject from unlawful and incompatible processing.

The Annexes also provide an alternative mechanism for HMRC to obtain personal data without reference to its wide powers (e.g. under Schedule 36 of the Finance Act 2008).  These powers allows HMRC to demand any information or any document related to tax matters from almost anybody.

This raises three important policy questions which should be considered by Parliament prior to approving legislation that promotes the expansion of the proposed voluntary disclosure route.

• Are HMRC powers fit for purpose? If the answer is “no” why can’t Ministers approach Parliament with an argument for an upgrade of HMRC powers rather than expand the reach of voluntary disclosures to HMRC?
• Should HMRC be required to use its powers (e.g. Schedule 36) to demand personal data before it adopts a voluntary request for the disclosure of personal data?
• Should HMRC be required to state when using a voluntary disclosure arrangement that there is no obligation for a controller to disclose and if there were to be a refusal to disclose personal data there would be no detriment to the controller?

These questions certainly need answering in the context of HMRC and dare I say it, certain law enforcement processing and national security.  Perhaps the ICO could do the honors?

Autumn Data Protection Courses

I am holding another day course on the changes arising from the Data Protection and Digital Information Bill on Tuesday, September 27 (by Zoom only;  £250 + VAT per delegate).  Program available from:  info AT amberhawk.com

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection PRACTITIONER Courses are in London on Monday September 19-24 (5 days) and on Monday October 31-November 4 (5 days)
• The next Data Protection FOUNDATION Course is in London on Tuesday November 15-17 (3 days).

Full details (as we are upgrading our Amberhawk website), details of all the above courses can be obtained by emailing info AT amberhawk.com

References

How the Human Rights changes impact on data protection: https://amberhawk.typepad.com/amberhawk/2022/07/uk-bill-of-rights-set-to-undermine-uk_gdpr-and-adequacy.html  (see other references at the end of the blog)

I have produced a “Keeling Schedule” for the changes to A.5, A.6, A.13, A.14: you can download it from the References at the end of: https://amberhawk.typepad.com/amberhawk/2022/08/dpdi-bill-removes-public-interest-test-in-push-to-legitimise-general-public-sector-data-sharing.html

 

DPDI Bill removes “public interest” test in push to legitimise general public sector data sharing

This blog considers how the Data Protection and Digital Information Bill (the “Bill”) impacts on the lawful bases used in the context of voluntary data sharing with public bodies.

It explains how the Government is building a legal infrastructure that provides Ministerial powers to legitimise voluntary and general data sharing across the public sector which does not need to consider whether data sharing is in the “public interest”.

For instance, is it “in the public interest” to disclose personal data to protect vulnerable individuals? If your answer is “yes”, then the blog explains why there is no need for many of the new proposed lawful bases or for the abolition of the “public interest” test.  Indeed, one new proposed lawful basis can be developed to legitimise data sharing in general, also in the absence of any public interest consideration.

This blog is limited to how such expansive data sharing becomes lawful under the revised A.6 proposed in the Bill.  The blog also serves as a reminder of the significant impact of the proposed replacement of the Human Rights Act on this Bill; something that remains absent from all DCMS documentation on this Bill.

Current data sharing

Before describing the changes made by the Bill, it is worth understanding how voluntary disclosure/data sharing of personal data occurs under the current DP regime.

So suppose a Social Work department of a Local Authority (Controller A) wants to obtain personal data held by another body to protect a vulnerable person in its care.  So it asks another body (Controller B) to disclose the relevant personal data.  Assuming Controller B has no role or function in respect of protecting the vulnerable, how is such a disclosure made lawful under the current UK_GDPR/DPA2018?

Note there is a disclosing controller (Controller B) and an obtaining controller (Controller A) where obtaining and disclosure are both processing operations.  So Controller B’s disclosure is Controller A’s obtaining; it’s the same processing operation viewed from different ends of the telescope by each Controller.

This data exchange uses the lawful basis in A.6(1)(e) of the UK_GDPR/DPA2018 regime. This lawful basis requires that the “processing is necessary” for one of two options which are either:

(i)  “necessary for the performance of a task carried out in the public interest”  or

(ii)  necessary for “the exercise of official authority vested in the controller”.

Second, the expansion of the A.6(1)(e) lawful basis by Section 8(1)(c) of the current DPA2018 states that either requirement (i) or (ii) above can be satisfied if the processing is for “…the exercise of a function conferred on a person by an enactment…”.  Note that, in our example,  the use of the word “person” could refer to Controller A or Controller B.

The above identifies the questions that need to be asked prior to disclosure by Controller B: if the answers are “yes” then the disclosure can occur lawfully.   So:

• Is a disclosure to protect the vulnerable a “task in public interest”?
• Is that disclosure for “…the exercise of a function conferred on a person by an enactment…”? In this case, does the person (i.e. the Local Authority via its Social Work Department) have a function conferred by enactment to protect the vulnerable?

Note that Controller’s A processing  (i.e. the obtaining) does not need “a public interest test”; that is performed by Controller B prior to disclosure.  Clearly Controller A’s obtaining is part of the “official authority vested in the controller” because it is in “…the exercise of a function conferred on a person by an enactment…”  (where the person is the Local Authority again).

So both obtaining and disclosure are lawful – and in the public interest.

Now consider the following.  Do you think that: (a) disclosure of personal data to the police for a criminal investigation; (b) a disclosure to the relevant national security agency for a national security purpose, or (c) a disclosure to public bodies dealing with a national “emergency” (e.g. a large area flood) are also disclosures “in the public interest” in the same way as “protecting the vulnerable”?

I am convinced the answer is “yes”. And this is before one considers an alternative lawful basis (i.e. A.6(1)(f): disclosure from Controller B is in the legitimate interest of the Third Party (Controller A)).

I say this because, if you agree that the above options are all “in the public interest” then the conditions presented in Annex 1 after the first paragraph are redundant.

Indeed, I suspect that these later paragraphs in Annex 1 are included to act as a smokescreen to mask the real change in its first paragraph.

Lawful basis under the Bill

The Bill introduces the following changes with respect to lawful basis:

First, the task specified in A.6(1)(e) is amended so that it is specific to the controller performing the processing.  This lawful basis now reads that the “processing is necessary for the performance of a task [of the controller] carried out in the public interest or a task carried out in the exercise of official authority vested in the controller;

Second there is a new A.6 lawful basis where the “processing is necessary for the purposes of a recognised legitimate interest” where the “recognised legitimate interests” are  listed in Annex 1 of the Bill.

Apart from the first paragraph, the Annex 1 list is as follows:  “National security, public security and defence”, "Emergencies“, "Crime", “Safeguarding vulnerable individuals” and a revised Democratic engagement purpose (which is not discussed here).

With respect to the Social Work example used above {disclosing Controller B to obtaining Controller A),  Controller B’s disclosure uses the Safeguarding vulnerable individuals” lawful basis whilst Controller A’s lawful basis remains “a task carried out in the exercise of official authority vested in the controller”.

So both obtaining and disclosure become lawful,  in the absence of any public interest consideration.

The absence of any consideration of a “public interest test” prior to disclosure will eventually mean that disclosures under the Bill are likely to occur where no public interest arises.  This position is aggravated by the Human Rights changes where “necessary” means “what the Government has determined as necessary” (see references for the reason why).

Even with respect to disclosures for crime prevention and detection etc, the DPA1984 and DPA1998, provided a test that prior to disclosure a disclosing controller had to assess whether a failure to disclose personal data would prejudice the crime prevention purpose etc.

This is not replicated in the Bill.  I leave it to readers to determine whether this is another example of data protection standards falling to reach those established by the DPA1984.

Any disclosure for any public sector task?

The first paragraph of Annex 1 is captioned:  “Disclosure for purposes of processing described in Article 6(1)(e)”; that is where any disclosure, any public body, any public task comes from.

In further detail, this paragraph states that a disclosure is lawful when:

“the processing is necessary for the purposes of making a disclosure of personal data to another person in response to a request from the other person”, and

“the request states that the other person needs the personal data for the purposes of carrying out processing described in Article 6(1)(e) that has a legal basis that satisfies Article 6(3)”.

Note the very weak wording in the above; the word “necessary” should have been linked to the disclosure purpose and NOT the purpose of making a disclosure (i.e. the mechanics of the disclosure procedure).  The fact that a controller “needs the personal data”  for any purpose for any public task in is far lower threshold than one that describes the disclosure as being “necessary” for a specific purpose.

However, as previously stated,  these weaknesses are aggravated when the proposed Human Right Act changes click in (i.e. “necessary” means “what the Government decides is necessary”).

So, what does A.6(3) do?

Note the reference that the legal basis has to satisfy A.6(3);  this is a reference to the requirement that the prospect for disclosure has to be laid down by UK domestic law.  For example, Part 5 of the Digital Economy Act 2017 specifies, in law, a host of disclosure arrangements.

If such a law exists, A.6(3) then allows the Secretary of State “to adapt the application of rules of this Regulation”  (i.e. modify the UK_GDPR) in the following areas:

• “the general conditions governing the lawfulness of processing by the controller”;
• “the types of data which are subject to the processing”;
• “the data subjects concerned”;
• “the entities to, and the purposes for which, the personal data may be disclosed”;
• “the purpose limitation” and “storage periods”; and
• “processing operations and processing procedures”.

Some of the powers to “adapt” the above are found at Clauses 5(4), 8A(5), 8A(6), 8A(7) and 8A(8) of the Bill.  For example, many disclosures are made exempt from the Purpose Limitation Principle via Annex 2 of the Bill.

Potentially these Ministerial powers can adapt any Principle, A.6 lawful basis (and A.9) to ensure that data sharing can proceed, relatively untroubled by the data protection concerns of data subjects.  It is these provisions that establish the legal infrastructure to legitimise voluntary and general data sharing across the public sector in the absence of  “public interest” considerations.

Although A.6(3) adds that “…domestic law shall meet an objective of public interest and be proportionate to the legitimate aim pursued”,  these requirements should not be considered reliable safeguards for data subjects.

When the Human Rights changes come into effect, the “public interest” effectively means “the interest of the Government of the day” and “proportionate/legitimate” means “what the Government considers proportionate/legitimate”.

Concluding comment

As specified in previous blogs, the proposed changes to the UK’s Human Rights regime infects the Bill like a malevolent virus.  Like all embarrassing diseases, the DCMS (and ICO) do not refer to the consequences of the proposed modifications on this Bill.

The requirement that the Courts and ICO give “great weight” to the Government’s determination of what is “necessary”, “proportionate” or “in the public interest” undermine the protections afforded to data subjects especially when public bodies are able to share their personal data without any consideration of the public interest.

Any allegation of “unlawful disclosure” under the Bill will become very difficult to prove, if the argument is reduced to one about the “weight” given to a particular disclosure.

The effect is to give public authorities a “Get Out of Jail Free Card” even when data sharing, not in the public interest, goes pear-shaped.

Autumn Data Protection Courses

I am holding another day course on the changes arising from the Data Protection and Digital Information Bill on Tuesday, September 27 (by Zoom only;  £250 + VAT per delegate).  Program available from:  info AT amberhawk.com

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection PRACTITIONER Courses is in London on Monday September 19-24 (5 days).
• The next Data Protection FOUNDATION Course is in London on Tuesday November 15-17 (3 days).

Full details (as we are upgrading our Amberhawk website), details of all the above courses can be obtained by emailing info AT amberhawk.com

References

How the Human Rights changes impact on data protection: https://amberhawk.typepad.com/amberhawk/2022/07/uk-bill-of-rights-set-to-undermine-uk_gdpr-and-adequacy.html  (see other references at the end of the blog)

I have produced a “Keeling Schedule” for the changes to A.5, A.6, A.13, A.14: download it here Download A6 changes DPDIB Aug

 

New Data Protection Bill defines “personal data” below DPA1984 threshold

This is the first in a series of blogs on the Data Protection and Digital Information Bill (the “Bill”) published just before the Parliamentary recess.  This blog explains:

(a) how the Bill’s new definition of “personal data” works;

(b) why the definition is very problematic for data subjects;  and

(c) how, after nearly four decades of data protection law in the UK, the Government is promoting a definition of personal data that is demonstrably weaker than that in the DPA1984.

The proposals in the Bill to change the definition of “personal data” did not feature in the DCMS original Consultation Document. This omission raises serious questions about whether or not other undisclosed horrors lurk in the depths of this Bill.

Remember as you read on, what is being proposed exists to “provide greater clarity about which type of data is in scope of the legislation” (p26 of the “Explanatory Memorandum”).  I should add, that this blog provides all the clarity absent from that Memorandum.

Why change the definition?

The purpose of the new definition of personal data is to distinguish between three types of data. These types are:

(a) personal data which relates to an identified or identifiable living individual where identification is usually by a controller or a processor using reasonable means. Such identification could be by name, address, location, social characteristics, identification numbers etc;

(b) non-personal data which is information that is likely to have been derived from personal data (or which is currently treated under the UK_GDPR as personal data),  but where a data subject is no longer identifiable without the expenditure of an unreasonable amount of effort on the part of a controller or a processor; and

(c) anonymous data which is data that cannot be attributed to a specific living individual.

The basic idea is that organisations that process “non-personal data” or “anonymous data” cannot be a controller or a processor as the data cannot be related to a particular living individual without unreasonable effort on the part of that controller or processor.

In other words, non-personal data and anonymous data are both free of any data protection concern (i.e. no obligations arise from the UK_GDPR).  The Bill’s objective is to widen the scope of these two categories by narrowing the scope of those data that are classified as “personal data”. That in summary is the name of the game.

What has changed in the definition?

The Bill splits personal data into two further types by introducing the concept of “direct” and “indirect” identification of a living individual in the context of the personal data being processed. So, for example:

• “Direct identification” occurs when a living individual is identifiable from the data “directly” without the use of any “additional information”. An example would be a normal database that contains records such as the data subject’s surname,  address, date of birth, policy number as well as other data attributes.
• “Indirect identification” occurs when a living individual is identifiable from the data plus some other “additional information” which might be held by another person. An example would be a database of phone numbers where the identification of data subjects is known to be in a separate list (e.g. a telephone directory) held by the controller, processor or another person.  Pseudonymised personal data is expressly defined to be a class of data where indirect identification occurs.
  

In the case of “direct identification”, identification of a data subject has to be “by the controller or a processor by reasonable means at the time of the processing”.  More or less the same goes for indirect identification where such identification requires “additional information” to be held (or likely to be held) by a controller, processor or “another person”.

“Reasonable means” is defined as a non-exhaustive (illustrative) list which includes “among other things: (a) the time, effort and costs involved in identifying the individual by that means, and (b) the technology and other resources available to the person”. In other words, there could be other factors to consider (see Case 2 below).

Note that “at the time of the processing” in the context of “direct identification” is likely to be the time the controller or processor first obtains the personal data either from the data subject or from another source.  The same more or less applies if indirect identification is completed by a controller or a processor (i.e. data protection obligations kick in as soon as the additional information is obtained or is likely to be obtained).

Note also that in the context of “indirect identification” and before the additional information is obtained (or is likely to be obtained), the data processed by a controller or a processor is not personal data and is free from data protection obligations.

In the context of “indirect identification” by another person, the time of the processing is likely to be when the controller or processor knows (or should know) that the “additional information” has been obtained (or is likely to be obtained) by that “another person” who has expended “reasonable means” to identify a data subject.

Additionally, both “direct” and “indirect” identification of a data subject under this Bill requires an assessment, by the controller, of the “reasonable means” used to perform the identification.  This implies that if the means of identification are “unreasonable” for whatever reason, then the data are not personal data and no data protection obligations arise.

It can be seen that what “reasonable means” are available is very important to the personal data definition.   Note that if the controller assesses that the “reasonable means” are unreasonable, that controller will process the information as if it were not personal data (e.g. no transparency, security or rights).

In conclusion, if a controller gets its assessment of reasonable means wrong, the default position is that the processing occurs, in secret, until it is stopped by the ICO using his powers (which is increasingly unlikely).  As will be seen, this places too much power in the hands of the controller.

Finally,  identification (directly or indirectly) can be “by the controller or a processor”  (emphasis on “or”).  This opens up three possibilities which are (to me, very confusing):

• First that identification details are held by the controller but not by the processor. If this possibility is valid,  the processor’s data protection obligations do not apply as the processor is not processing personal data;
• Second that identification details are held by the processor but not by the controller. If true, the controller obligations do not apply (!!!).   But if this were true then the processor that performs the identification would become a separate controller or joint controller (surely!?);
• Finally, identification details are held by either controller or processor (or is known to be held by another person etc) then both controller and processor would be subject to data protection obligations This possibility obviously contradicts the first two.

I haven’t a clue what is going on here or why.  I find the use of “by … a processor” inexplicable and unnecessary; it is miles away from the “clarity” promised in the Explanatory Memorandum.

Illustrative scenarios: CCTV

Now we have a feel for what is going on with the definition of personal data, can we consider two cases. I have made these up to illustrate why the definition is problematic, so forgive any artificial construct.

Case 1: Consider a controller who employs CCTV operators in a City Centre. One operator is directing a police officer to intercept and arrest a thief who is wearing a red hat, orange shirt and blue jeans as the thief is dipping into shoppers’ handbags.

Now which of the following statements best “clarifies” whether the identification of a living individual is direct or indirect? Remember, you have to consider the “reasonable means” expended by the controller to perform this identification.

• The thief is directly identified via specific criteria (e.g. by monitoring a particular individual wearing a red hat, orange shirt and blue jeans).  Is this sufficient to deliver direct identification even though the CCTV operator does not know other important identification details (e.g. the thief’s name, date of birth, home address, National Insurance Number etc)?
• The thief is indirectly identified. Once apprehended, the police become the “another person” who completes the identification through the use of “additional information” easily collected by the police after arrest (i.e.  the “reasonable means” test is passed).  Note that with indirect identification, a key factor is that the “another person” obtains the “additional information” for identification; it does not matter that the CCTV operator does not obtain the “additional (identification) information” from the Police.

So which did you prefer?  Which option is more certain: direct or indirect identification?  Remember you should not muddy the waters by choosing both (as these concepts have been introduced to provide more “clarity” – Ha Ha).

If you chose indirect identification, now consider what happens if the police do not obtain the “additional information” for whatever reason (e.g. the thief disappears)? Because the “additional information” is not obtained, the CCTV operator is not processing personal data. ( I know that’s a rubbish conclusion but that is what this Bill does).

Research & Pseudonomisation

Case 2: Now assume a NHS Trust Hospital shares pseudonymised health personal data with a University for medical research purposes (i.e. the Trust keeps the identities; the University has all the medical details except identification).  Because pseudonymisation is involved, only indirect identification is relevant.

The University and Trust sign a legally binding data sharing agreement which states the Trust will never release the identity of any patient to the University.  To protect the identification personal data further, and unknown to the University, the Trust stores the only copy of the identity personal data with a secure Trusted Third Party. This Party is tasked with encrypting the data using techniques unknown to the Trust.

In summary, this scenario is constructed so that any access to identifying details is a “very last resort” matter and aimed at precluding general access to the identifying details in a large number of circumstances.

The question I am driving at is as follows: “Is the University processing pseudonymised personal data or is it processing “non-personal data”?”. The answer depends on your assessment of the “reasonable means” that could be used to perform the indirect identification by the University, Trust or Third Party?  

Although the “additional information” exists, does its existence as a very last resort matter, impact on “another person’s” ability to complete the identification using “reasonable means”?

Or does the complex construction, specified by the scenario, provide a sufficient barriers to preclude the general obtaining of “additional information” by “reasonable means”?  Is it possible that the University or Trust could reasonably argue, given that the definition of “reasonable means” is non-exhaustive, they have arranged matters so there were no reasonable means of identifying a living individual?

If so, then the University is not a controller;  it follows that it has no data protection obligations as a controller.  The patient cannot withdraw consent to the research, object to the processing, seek subject access and the University has no security, retention or transparency obligations and the data protection elements of the data sharing agreement are irrelevant.

Such processing will continue until the ICO intervenes  (unlikely in my view).  Quite simply the data subject risks being written out of the research equation. And that is before you get into the Research proposals in the Bill.

In conclusion, once this definition is enacted, there is a considerable risk that lawyers are likely to set to work creating circumstances for their clients where data subject protections vanish through the use of complex organisational structures, data sharing exchanges and contracts.

These will start with personal data, somehow produce “non-personal data”, which then can be scattered to the four corners of the Earth without any data protection concern.

Comparison with DPA1998/DPA1984

The Bill’s definition of personal data is completely different to the DPA1998 which also required identification of a living individual either to be direct (i.e. “from the data”) or “indirect” (i.e.  “from those data and other information which is in the possession of, or likely to come into the possession of, the data controller”).

Note that for indirect identification under the DPA1998, the main test was: (a) whether the controller held the identification details in his possession, or (b) was the controller likely to obtain those identification details later on, or (c) the controller did not hold any identification details.  Only in the latter case did the DPA1998 not apply.

Under the Bill,  identification of the living individual has to be by “reasonable means”.  In other words, the identification details can be in the possession of the controller but it takes unreasonable effort to join the dots to a living individual.  In this case, the data are not personal data (even though the identification detail “is in the possession of the data controller” – the DPA1998 test).

This explains how the new definition of personal data in the Bill does not even elevate itself over DPA1998 standards. The DPA1998, I remind readers, were subject to infraction proceedings with the European Commission commenced in 2004. The Commission thought the DPA1998 was a defective implementation of Directive 95/46/EC and this included its definition of “personal data”.

Indeed, the definition of “personal data” in the DPA1998 was almost word for word taken from the DPA1984 (i.e. personal data was data that related to a “living individual who can be identified from that information (or from that and other information in the possession of the data user”(“data user” was the 1984 term for a controller).

In other words, from the data subject’s perspective, the Bill’s definition of personal data is even inferior to that found in the DPA1984

Concluding comment

So if the definition of personal data falls below DPA1984 standards, what is the Commission’s likely view of the Bill’s new definition in the context of Adequacy?

Send your answers on a post-card or email either to Auntie Nadine Dorries at the DCMS (before September 5th) and perhaps Uncle John Edwards at the ICO (before his next speech as he “believes the proposals strike a good balance in making improvements”).

Autumn Data Protection Courses

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• I am holding a day course on the changes arising from the Data Protection and Digital Information Bill on Thursday, September 15 by Zoom only (£250 + VAT per delegate).
• The next Data Protection PRACTITIONER Courses is in London on Monday September 19-23 (5 days);
• The next Data Protection FOUNDATION Course is in London on Tuesday November 15-17 (3 days)

Full details (as we are upgrading our Amberhawk website), details of all the above courses can be obtained by emailing info AT amberhawk.com

UK Bill of Rights set to undermine UK_GDPR and Adequacy

A fortnight ago, the Government published its UK Bill of Rights to replace the Human Rights Act 1998 (HRA).

My main conclusions concerning the Bill of Rights relevant to data protection are:

• The Bill changes who interprets the meaning of necessity, public interest and proportionality and thereby changes the nature of the link between the UK_GDPR and A.8 of the European Convention of Human Rights (right of respect for private and family life etc).
• The Courts do not undertake the balancing tests associated with “proportionality”, “necessity” and what is “in the public interest”; these tests are undertaken by Ministers if a Government has a Parliamentary majority.
• The Bill is a significant risk to the Adequacy Agreement with the European Commission.
• The Bill protects the powers of the State from challenge, rather than protecting the individual from the misuse of State powers.
• The Bill is intellectually flawed with respect to its treatment of A.8 issues.
• The Bill allows Government to fashion wide ranging exemptions from the UK_GDPR, not listed in A.23 of the UK_GDPR; it also explicitly permits processing that breaches A.8.
• The Bill neither addresses nor resolves the serious data protection issues identified by the ICO in his evidence to the MoJ Consultation.
• The Commissioner might have misled Parliament in his recent Oral Evidence.

The Bill is intellectually flawed

Suppose legislation requires a public body to disclose specific items of personal data with another controller.  Under the current data protection regime, such a disclosure would be “necessary for a legal obligation” (the controller’s A.6 legal basis for the disclosure).

Additionally, such legislation that demands disclosure would also have to be justify its interference of the A.8(1) right in terms of  “necessity”  and “proportionality” as required by A.8(2).

Note that currently the two regimes (DP & ECHR) are firmly linked through the word “necessary” which has the same meaning in both regimes.  So, in our example above, the ICO can consider whether the test of necessity in human rights terms, applies to the disclosure of personal data in data protection terms (i.e. whether the disclosure is really necessary for a legal obligation).

Under the Bill of Rights, this is not possible. Processing becomes “necessary” because Ministers have used their Government majority to enact legislation, approved by Parliament.  The Courts have to give the greatest possible weight to the assumption that Parliament has balanced all the factors associated with necessity (and proportionality and in the public interest) when enacting that legislation.

In summary, under the Bill, Parliament determines the balancing concepts such as of necessity,  proportionality or the public interest in legislation as it passes through its Parliamentary stages.  This contrasts with the current position where the Courts (or ICO) consider such concepts, once legislation has been enacted.

The difference in timing exposes an intellectual shortcoming in the Bill of Rights.  The Bill’s position is that Parliament considers concepts such as “necessity” as the legislation passes through its Parliamentary stages (i.e. the legislation is not yet an Act of Parliament).

This is to be compared with the current position where legislation has been enacted, but its operation in practice has created a human rights difficulty which is being considered by the Courts.

In other words, balancing the concept of “necessity” etc is currently considered by a Court in the context of knowledge of all relevant facts.  Under the Bill, Parliament considers such concepts in the absence of any fact.

This is hardly a rational approach towards enacting trouble-free legislation.

Unlawful processing is OK!

Suppose a future piece of legislation, passed by Parliament, requires a public authority to process specific items of personal data items it already holds for a new purpose Z, disclose them another organisation for purpose X.  Assume further the Bill of Rights is an Act of Parliament.

All these processing activities are lawful, necessary, proportionate and in the public interest because the provisions of Bill of Rights requires the courts to assume Parliament has considered all the relevant balancing factors.

Indeed the Bill of Rights goes further, as it allows a public authority to process personal data in a way that is incompatible with a Convention right.

Although the Bill states that “it is unlawful for a public authority to act in a way that is incompatible with a Convention right” (e.g. the act in question being to process personal data as described above), this prohibition does not apply “as a result of one or more provisions on primary legislation, the authority could have not acted differently” (See Clause 12(2) of the Bill). 

As the processing in the above example is required by law, the public “authority could have not acted differently”. It follows that, if processing of personal data is required by law, it does not breach A.8 and never can be an unlawful breach of A.8.

If this interpretation carries over to the UK_GDPR, it serves as an exemption from the lawfulness requirements of the UK_GDPR and permits unlawful processing.

Why call it an exemption?

Suppose Parliament enacts a law which states that personal data have to be retained for seven years, when in practice the retention time should be one year.  The text of the Storage Limitation Principle states that personal data shall be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”.

Note that the current test of “necessity” is linked to the “purpose of the processing”.  Because the word necessary has the same meaning in the human rights and data protection regimes, the question the ICO could explore under the current regime is: “In the context of this seven year retention period, is the law that requires such retention, proportionate and necessary?”.

Under the Bill of Rights this question is not even asked. This is because it is presumed that Parliament has struck an appropriate balance between competing factors (e.g. proportionality, public interest, necessity) in approving this seven year retention period.  Indeed, the ICO is obliged to give Parliament’s balance “the greatest possible weight” if he were to enforce the Storage Limitation Principle.

In other words,  the prospect of enforcement for seven-year-retention is remote.  If an UK_GDPR provision cannot be enforced, then the provision itself is effectively exempt.  In the case above, the Storage Limitation Principle is effectively exempt for seven years.

In general, the Bill’s impact on the UK_GDPR is profound: any legislation if it contains provisions that relate to the processing of personal data, fashion future exemptions from the data protection regime, far beyond the requirements of A.23 of the UK_GDPR which requires any exemption to be “a necessary and proportionate measure in a democratic society”  (where it is assumed the Courts assess the underlined words).

If you want an example of legislation that contains many such processing provisions which are likely to conflict with the UK_GDPR, see S.12 of the Childrens Act 2004.  The ICO will have obvious difficulties in enforce UK_GDPR standards if the standards set out in S.12 differ.

Protecting powers not humans

It is important to understand, the UK Bill of Rights does not grant rights to protect individuals from the abuse of powers by the State.  Instead the Bill protects the powers of the State from individuals who currently argue in Court that such powers have been unlawfully exercised.

This objective is achieved by making it more difficult for an individual to commence a Court case under the UK Bill of Rights.  If, for example, Ministerial or public authority powers are misused, the complainant has first to show “significant disadvantage” from the misuse of powers.

Then the individual has to overcome the very strong presumption that the Minister (or public authority) is acting lawfully, proportionally, in the public interest etc.  If the issue under scrutiny accords with legislation enacted by Parliament (which has considered all relevant balancing factors remember!) and if the controller is a public authority that has no choice, then the use of these powers is not a breach of A.8. (See the section on Unlawful processing is OK above).

If, perchance, an individual complainant then took the case to the Strasbourg Court of Human Rights and won, the Bill of Rights ensures the UK Courts and Government can effectively ignore that Strasbourg jurisprudence (see next section).

That’s why the Bill protects the powers of the State from interference from data subjects and does not protect data subjects from the excessive use of State power.

How the Bill protects state powers

There are three procedural changes, targeted at the courts, that also protect the powers of Ministers or of the State from scrutiny.  These are set out in Clause 1 of the Bill of Rights.

• “it is the Supreme Court (and not the European Court of Human Rights) that determines the meaning and effect of Convention rights for the purposes of domestic law” (Comment: this allows future “Strasbourg jurisprudence” concerning the use of powers to be ignored);
• “courts are no longer required to read and give effect to legislation, so far as possible, in a way which is compatible with the Convention rights” (Comment: this permits UK Bill of Rights to diverge from existing human rights precedents and existing Strasbourg jurisprudence; it also removes the requirement to ensure that an interpretation of any legislation is supportive of human rights);
• “courts must give the greatest possible weight to the principle that in a Parliamentary democracy, decisions about the balance between different policy aims… are properly made by Parliament” (Comment: this allows Government, via its Parliamentary majority, to constrain further the Courts drawing a conclusion that a particular right has been infringed when powers are used).

The Explanatory Notes to the Bill state that a court must understand that “judgments, decisions and interim measures” of the ECHR “are not part of domestic law” and that the Principle of Parliamentary democracy (i.e. what Parliament enacts) is expected to prevail unless a case before the Court is exceptional.

As Government is in control of the Parliamentary agenda (e.g. Government Bills tabled before Parliament are usually enacted), another way of summarising the Bill’s impact is as follows:  “the powers that Ministers specify for themselves in legislation is what Parliament decides in terms of the Bill of Rights”.  And “what Parliament decides is what the Courts must give the greatest possible weight”.

A shorthand for this is:  under the Bill, “Ministers propose; the Courts dispose”.

Adequacy down the tubes?

The Adequacy Agreement between the UK and European Commission mentions the current Human Rights Act over 50 times and assumes that the:

• “… United Kingdom’s adherence to the ECHR … as well as its submission to the jurisdiction of the European Court of Human Rights” is assured. (my emphasis).  Comment: as can be seen from the Bill of Rights, the UK will be no longer “submitting” to the jurisdiction of the European Court.
• “….any person that considers that his or her rights, including rights to privacy and data protection, have been violated by public authorities, can obtain redress before the UK courts under the Human Rights Act 1998”. Comment: this is no longer true as the Bill of Rights imposes a significant threshold on the person seeking redress to show that he/she is a “victim” of an action that results in “significant disadvantage” to that person (Clause 15(3) of the Bill).
• there is “continued adherence to such instruments” (e.g. “submission to the jurisdiction of the European Court of Human Rights”). ”. Comment: The Bill of Rights ensures that “continued adherence…”  is no longer the case.

So what are the implications of the above for Adequacy?

• Does the above mean that the UK will lose the Adequacy Agreement immediately? Answer: “NO” as the Bill has yet to pass through Parliament.
• Does the above mean that the European Commission could argue that the UK is set to renege on the Adequacy Agreement? Answer: “YES”, and at any time.
  
• Could the European Commission set in motion the steps needed to revoke the Adequacy Agreement? Answer: “YES”, and at any time.
  

You don’t need to take my word for it:  the ICO could not be clearer in his evidence to the MoJ: “In order to maintain EU adequacy decisions, the Government should ensure its proposals continue to effectively implement the ECHR in British law”; para 4.23).

How necessity etc is determined

Article 8 of the ECHR contains the balance between the right to respect for private life (A.8(1)) versus the lawfulness of any interference with that right (A.8(2)).  This raises the question of whether or not any interference is  “in the public interest”, “necessary” or “proportionate”.

Clause 7 of the Bill of Rights sets out the role of Parliament in assessing these concepts when balancing different objectives (e.g. in A.8)).  It states that when a Court is a considering whether there is a breach of a right, it must “strike the appropriate balance” between:

• “different policy aims” (e.g. as in A.8(1) and A.8(2) ECHR). Comment: the Explanatory Notes says this also “includes weighing up competing social and economic considerations”;
• “different Conventions rights” (e.g. as with A.8 and A.10 ECHR);
  
• “the Convention rights of different persons”; or
• “a combination of matters mentioned in (i) to (iii)” Comment: the Explanatory Notes says this, includes balancing “a person’s Convention rights” against “the interests of society at large”.

In striking that “appropriate balance”, a Court must (i.e. NO flexibility here):

• “regard Parliament as having decided, in passing the Act” (i.e. the Act under scrutiny by the Courts), “that the Act strikes an appropriate balance” between the matters as set out in (i)-(iii) above; and
• place “the greatest possible weight” on the principle that “in a Parliamentary democracy, decisions about how such a balance should be struck are properly made by Parliament”.

In the context of A.8, the Courts must assume Parliament has considered different policy aims (e.g. whether the law enforcement authorities can access a database of personal data).  Such consideration will naturally include concepts such as necessity, in the public interest and proportionality.

It can be seen that the courts will find it very difficult to diverge from this “appropriate balance” as it has to give this balance “the greatest possible weight”.

This difficulty also applies to the ICO when enforcing the UK_GDPR.

Conclusion

The ICO published a trenchant criticism of the MoJ Consultation document of the impact of the Bill of Rights on the UK_GDPR (see references).  Since then Information Commissioner has gone quiet on this impact.

The Commissioner might think that the problems he raised in his submission to the MoJ about “in the public interest”, “necessary” and “proportionality” have gone away.  They haven’t.  Whilst these were explicit in the MoJ Consultation, they are implied in any detailed analysis of Clause 7 above.

Indeed, when the Information Commissioner was last before MPs, he said the following in relation to a direct question about the Adequacy Agreement:  “As I say, when the European Commission comes to look at the law and examine it, I hope that it will see everything that guarantees a sufficient level of protection of Europeans’ data in the United Kingdom” (Q287; see references).

I can’t see how the Commissioner has reached this conclusion.  The statement to Parliament is, in my view, misleading.

Autumn Data Protection Courses

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection PRACTITIONER Courses is in London on Monday September 19-24 (5 days); full details by emailing info AT amberhawk.com
• The next Data Protection FOUNDATION Course is in London on Tuesday, July 12-14 and November 15-17 (3 days); full details by emailing info AT amberhawk.com

References

Link to all UK Bill of Rights documents: https://www.gov.uk/government/publications/bill-of-rights-bill-documents  (you will need the Bill & Explanatory Notes)

Link to ICO’s Human Rights response to the MoJ (a must read): https://ico.org.uk/about-the-ico/consultations/ministry-of-justice-consultation-human-rights-act-reform-a-modern-bill-of-rights/

The link to my four blogs on the MoJ human rights Consultation (see end of): https://amberhawk.typepad.com/amberhawk/2022/03/omissions-in-human-rights-proposals-degrade-privacy-and-freedom-of-expression.html

All the draft Oral evidence transcripts (the ICO one quoted above is 8^th June) can be found on: https://committees.parliament.uk/work/1733/the-right-to-privacy-digital-data/