Hawktalk

Government prepares to wave two fingers at UK’s Adequacy Agreement?

I have come to the conclusion that the Government does not care whether or not the UK’s Adequacy Agreement with the European Commission continues after its expiry (latest in mid-2025).

This conclusion is based on the well-publicised deficiencies in the two consultation exercises of the DCMS (on data protection) and MoJ (on human rights) and the recent report of Joint Parliamentary Committee on Human Rights into the MoJ proposals.  This latter Report carries many warnings concerning the Government’s intent to diminish individuals’ rights (see references).

This blog explains how I have arrived at my two fingered conclusion. It is not a deep analysis full of minutiae; the text is more a reflection on the current nature of the UK Government.

The UK’s Adequacy Agreement

In theory, Article 3(4) of the UK’s Adequacy Agreement allows for termination by the European Commission at any time.  However, there can be a long convoluted consultation process and I suspect that if the UK made significant changes to its data protection and human rights regime (as proposed), then the Commission will want to assess the impact of these changes on the rights and freedoms of European data subjects.

Such an assessment will take time (e.g. up to mid 2025).  However, a shorter timescale is more likely to be followed if the UK Government determines its post-Brexit trading partners (e.g. India; Australia) are adequate when the European Commission has made no such determination.  This shortening arises from the risks to European data subjects from onward transfers of personal data, from the UK, to these Third Countries.

Equally, the timescales could shorten if there are changes to the UK Human Rights regime as proposed by the MoJ (as these are more drastic than the DCMS proposals for change).

Important observations

There are four considerations:

• It is the European Commission that really decides on the status of its Adequacy Agreements with Third Countries; Countries like the UK do not apply for adequacy – it is more or less in the gift of the Commission (after a convoluted process). This could explain why the DCMS and MoJ Consultations do not mention the UK’s Adequacy Agreement in their respective consultations as there is nothing the UK could do if the Commission rescinded the UK’s Agreement tomorrow.
• The Adequacy Agreement with the UK contains expectations that the UK’s data protection and human rights regimes have specific characteristics; if the UK no longer wants to attain these expected standards, it is the European Commission that has to decide what to do.  Its choices are essentially limited to three options:  (a) maintain, (b) modify, or (c) rescind the current Agreement with the UK.
• The Government is arguably calling the Commission’s bluff. In effect it is saying: “the UK is going to change its privacy regime; if you Europeans don’t like what we are doing, then you can rescind the UK’s Adequacy Agreement if you want, but that might hurt trade and general co-operation with the UK on matters of mutual interest”.
• The Commission when making any assessment of the Adequacy Agreement will be looking at the protection of European data subjects, under the UK’s new DP/Human Rights regime, when their personal data is processed in the UK. It will NOT be looking at the protection afforded to UK data subjects; these rights and freedoms can be safely degraded, without any risk to Adequacy (e.g. in the way the DCMS and MoJ consultations propose).

Proposals for change: absence of evidence

The DCMS proposals for change in the UK’s data protection regime have been discussed in detail in previous blogs (see references); these proposals are characterised by omission (e.g. from Rosemary Jay), incomplete detail (e.g. from the ICO) and a lack of evidence for the proposed changes (e.g. from the DCMS consultation document itself).  As I have stated before, I am not the only person who is “harping on” about these failings.

Similarly, the DCMS and MoJ consultations ignored the link between data protection and Article 8 of the European Convention on Human Rights.  For what it is worth, the MoJ proposals have just been heavily criticised by the Joint Parliamentary Committee on Human Rights (JPCHR); it concluded that, contrary to the assertions of the MoJ, its proposals would “weaken human rights” and that there was “no real case for changing the HRA …” (see references; paras 25&26 of the JPCHR report).

As an aside,  I reported in the blog on the MoJ’s misrepresentation of ML v Slovakia and Ellis v Essex Police judgements in its consultation document.  The JPCHR Report similarly (politely) trashes most of the cases quoted by the MoJ; this is something I find shocking, especially as MoJ arguments for change depend on its view of these cases.

With respect to all qualified rights (e.g. A.8), the JPCHR have a stark warning which should be heeded by all:

“Giving undue priority to freedom of expression in primary legislation could undermine the ability of individuals to enforce their rights to privacy, a fair trial and freedom of assembly and upset the balancing exercise the courts currently undertake when competing rights are engaged” (para 210).

and

“The Government’s proposals …would limit the ability of individuals seeking to enforce their rights, for example, to private and family life…” (para 212).

Despite the lack of evidence, the Government published a Brexit Paper associated with the ‘Brexit Freedoms’ Bill” which promised legislation to enact major reform to the UK’s data protection regime.  This was followed by the Secretary of State for Brexit Opportunities, Jacob Rees Mogg, in the Sun Newspaper (9 Feb 2022);  he wrote that “….there will be a new approach to data, removing the EU’s cumber-some one-size-fits-all policy..”

Note that these statements promising legislation were made well in advance of the outcome or analysis of the DCMS or MoJ public consultations.

This explains why I think the consultations are largely irrelevant and the changes to the human rights and data protection proposals are being promoted as matters of political dogma.  Both the DCMS and MoJ “consultations” have been exposed as failed attempts to give its proposals a veneer of rationality and respectability.

Refreshing “Operation Save Big Dog”

This dogmatic approach to individual rights has coincided with Operation Save Big Dog (the name given last January to the effort expended to ensure the Prime Minister survived the fallout from several, alcohol-fuelled, “office-gatherings” at 10 Downing Street).

Over time, Saving Big Dog has taken the form of a wall-to-wall publicity concerning the actions of Big Dog himself: headlines and photo ops covering the Ukrainian war; the fuel and cost of living crisis; ending COVID restrictions; parking lorries on the M20 because there is no space in Dover; and the decision to send asylum seekers to Rwanda etc.

Such activity “justifies” the argument that because we are so dependent on the current (highly active) Big Dog making important decisions for all of us; appointing another Big Dog to make such decisions, just because of “a little local difficulty” over a few lockdown parties, is a distraction that the country can ill-afford.

Concluding comment

However, nothing has happened to remind the British public of the brilliance of the UK’s “oven ready” Brexit deal as implemented by our trustworthy Prime Minister.  For instance,  there has been very little of the promise to “take back control of our laws”.

But by pure happenstance, two committed Brexit Ministers (Nadine Dorries, Dominic Raab), who owe their political careers to the Prime Minister, happen to be in charge of the DCMS and MoJ.  They are responsible for their Departments’ defective consultation exercises and it is well known that a lack of evidence does not give such Ministers sleepless nights.

What better opportunity for symbolic action than to throw some red-meat to ardent Brexiters to indicate that the UK has taken back control of its data protection and human rights laws: “Let us show those Europeans how the UK protects its own citizens, and if that means waiving two fingers at that Adequacy Agreement, then so be it”.

Forget the paucity of evidence, the lack of detail, all the omissions and the erroneous analysis; these are unimportant.

And if need be, the Ministers can blame those Europeans for rescinding the UK’s Adequacy Agreement (just as the UK is doing with the fishing paperwork fiasco, lorry queues at Dover and the Northern Ireland protocol).

Summer Data Protection Courses

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next two Data Protection Practitioner Courses are in One starts Monday, May 16 (5 days) and the other on Tuesday July 5-7; July 19-21 (6 days); full details on www.amberhawk.com/StandardDP.asp or by emailing info@amberhawk.com
• The next Data Protection Foundation Course is in London, and starts Tuesday, July 12-14 (3 days); full details on http://www.amberhawk.com/DPFoundation.asp or by emailing info@amberhawk.com

References

The Joint Committee of Human Rights Report into the MoJ proposals (a must read): download available from https://committees.parliament.uk/work/6404/human-rights-act-reform/publications/

The Adequacy Agreement with the UK: https://ec.europa.eu/info/sites/default/files/decision_on_the_adequate_protection_of_personal_data_by_the_united_kingdom_-_general_data_protection_regulation_en.pdf.

The Benefits of Brexit: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1052148/benefits-of-brexit-document.pdf

Rosemary Jay’s Independent evidence that the DCMS data proposals could undermine adequacy (and the like the ICO, where the DCMS Consultation is unclear or wrong-headed) https://amberhawk.typepad.com/amberhawk/2022/01/independent-evidence-that-the-dcms-data-proposals-could-undermine-adequacy.html

My response to the DCMS Consultation (with links to my 7 blogs on different parts of the DCMS Consultation at the end of this link): https://amberhawk.typepad.com/amberhawk/2021/11/data-a-new-direction-amberhawks-response-to-the-dcms-consultation.html

The link to four blogs and details of the MoJ human rights Consultation (see end of): https://amberhawk.typepad.com/amberhawk/2022/03/omissions-in-human-rights-proposals-degrade-privacy-and-freedom-of-expression.html

Does the new Information Commissioner’s speech offer reassurance?

This blog reviews the new Information Commissioner’s speech at the end of March to a group of IAPP data protection specialists.  The speech contained statements that I don’t recognise as being consistent with the DCMS proposals for changing the UK_GDPR.

One passage in the speech related to the general importance of the need for a lawful basis for many actions; whether that lawful basis relates to stop and search by the police, or the processing of personal data by a controller.  The Commissioner also stressed the importance of maintaining strong data subject rights and stated that this is a commitment found in the DCMS proposals.

Sadly, this and other blogs have pointed out (see references), the importance for a lawful basis is likely to be much degraded by the DCMS proposals to change the UK_GDPR; further significant degradation arises from the MoJ’s proposals to change the UK’s human rights regime.

Similarly, rights of data subjects could well be significantly diminished if the DCMS proposals are enacted whilst the MoJ proposals offer diminished respect for private and family life.

I have also come across published information from the Human Rights and Equality Commission, which indicates that the MoJ’s proposals for changes in the UK’s Human Rights Act is very likely to place the Adequacy Agreement with the European Community at considerable risk.

Human Rights and Adequacy

Like most commentators on the DCMS proposals, the Commissioner’s speech does not mention how the MoJ proposals, for changing the UK’s human rights regime, impacts on data protection.  This omission does not surprise as the MoJ itself makes no reference to data protection in its consultation document.

This is despite the fact that data protection is integrally linked to Article 8 of the European Convention on Human Rights (explicitly stated in Recital 1 of the old Directive 95/46/EC) and the fact that UK has signed an international agreement to submit to the judgements of the European Court of Human Rights (ECHR).

By contrast, the MoJ’s consultation document explains that submission to ECHR judgements is NOT on the menu (see references).  However, such submission is assumed by the Adequacy Agreement that guarantees the free flow of personal data from the European Union to the UK.  It follows that the Adequacy Agreement, which mentions the term  “human rights” more than 80 times,  is at risk if this standoff is enacted as part of UK law.

This risk is confirmed by the Equality and Human Rights Commission.  In it its evidence to the MoJ, the Commission states that its proposed changes that impact on data protection also comprise a “likely breach” of international human rights law (see full quote below) including that Adequacy Agreement.

The risk is not only to data subjects. For instance, would your company purchase “GDPR compliant” software or IT services from an organisation, established in the UK, when the UK has had its Adequacy Agreement withdrawn by the European Commission?

I suspect that, like the hedge fund associated with Mr. Jacob Rees-Mogg, such a software or IT services company would relocate to within the EU – thus reducing the attractiveness of the UK as a technology base.

Lawful basis

In his speech, the Commissioner referred to the case of Entick and Carrington from 1765, although the legal principles can be traced back to paragraphs 39 and 40 of Magna Carta 1215.

In Entick and Carrington, bailiffs from the king, without lawful authority, entered the plaintiff’s house looking for seditious material; they conducted a thorough search of private papers,.  The Court found in favour of the plaintiff, finding that for such an intrusion, the King himself, and his agents needed a clear legal authority that was absent in their search.

The Commissioner concluded: “…These concepts, that form the basis of our law, that you must have a lawful basis for rifling through my papers and information, that an individual is entitled to assert and exercise agency, and autonomy over his or her domain and personal affairs …”.

The MoJ’s human rights proposals (if enacted) would undermine the lawful basis for processing personal data.  They require the Courts to give “great weight” to the fact that Parliament enacts legislation that states that the processing is “necessary” or that the processing is in the “public interest”.  This requirement (e.g. to give great weight), will also applies to the Commissioner when enforcing relevant parts of the DPA2018 or the UK_GDPR.

As these words (especially necessary) are used in three Principles in A.5, A.6, A.9, A.23 (of the UK_GDPR) and Schedules 1 to 4 (of the DPA2018), it follows that enforcement of those provisions (e.g. the lawful bases in A.6) becomes far more difficult for the ICO.  A regulator whose enforcement (e.g. of lawful basis) which is fettered in this way has to be in a weaker position to protect data subject rights or interests.

The Equality and Human Rights Commission, in its evidence to the MoJ (see references), criticises this fettering in the following way. It states (my emphasis):

• “The proposed reform would require the courts to accept that the existence of the law is “determinative of Parliament’s view that the legislation is necessary in a democratic society” (as in Option 1) or “give great weight to the fact that Parliament was acting in the public interest in passing the legislation” (as in Option 2). “…We do not consider it necessary or appropriate to bind the courts in these ways…” and “….Courts are best placed to make such considerations on a case-by-case basis”.
• “We do not support Options 1 or 2 of the proposed clauses, and recommend that the Government avoid legislating in this area. An attempt to prescribe how UK courts should balance competing interests across different situations is likely to breach Article 1 and/or Article 13 of the ECHR and therefore fail to comply with the UK’s international legal obligations. Balancing human rights requires careful consideration of various factors”. (Answer to Q23 of the MoJ Consultation).

Note the Equality and Human Rights Commission strongly infer that the MoJ proposals would also comprise a “likely breach” of the Adequacy Agreement which is dependent on UK “submission” to the ECHR judgements.

In addition, the Commission infer that provisions that “bind” the Courts will also “bind” the ICO enforcement of provisions that depend on “necessary” or “in the public interest”  (e.g. enforcement of three Principles in A.5, A.6, A.9, A.23 and Schedules 1 to 4 of the DPA2018).

I should add, that under the DCMS proposals, there is something similar: certain processing will be deemed to be necessary in the public interest,  or certain processing can be designated to be necessary in the legitimate interests of the controller without consideration of any overriding legitimate interests of the data subject.  In other words, the processing is pre-ordained for the lawful basis in A.6(1)(e) or A.6(1)(f) and this position might have to be given “great weight” by the ICO.

In summary, the Commissioner’s comments in support of legal basis are most welcome; however, they do not reflect the Government’s proposals as described above and in the DCMS and MoJ consultation documents.

Weakened data subject rights?

The Commissioner, in his speech, states “If anything, I can see a clear intention to reduce regulatory burdens, in order to create a streamlined law that more effectively protects people’s rights”.

I can see how a streamlined law reduces the regulatory burdens; I have great difficulty seeing how this reduction “effectively protects peoples’ rights”.  If anything, with respect to data subject rights, the DCMS (and MoJ) proposals are likely to do the precise opposite.

For example, looking at both consultations together only in relation to data subject rights, they:

• do not consider the chilling effect on the right of subject access (A.15) if an access fee is introduced (e.g. the DCMS consider impoverished data subjects could use the services of unspecified Third Parties); the introduction of a fee is also a clear breach of A.12(5).
• do not consider the how the “right to object” (A.21) works in practice (e.g. when the DCMS Consultation proposes Ministerial powers to determine that processing that was “in the public interest“, “necessary for a public task” or always “necessary” in the controller’s legitimate interest).  The right to object is also negated if there were to be a “research lawful basis”; the DCMS fail to consider this link to rights in their consultation.
• do not consider the impact on the right not to be profiled in A.22 (e.g. where the DCMS consultation refers to legislation allowing more profiling and automated decision taking to be undertaken); instead the DCMS refers to the prospect of removing the right not to be profiled.
• do not consider the impact on the right to erasure, as expressed in A.17(3)(a), when there is a need to balance of interests between individual privacy and the freedom of expression and to impart information.   In fact the MoJ proposals intend to tilt the current balance in favour of the latter.
• do not consider the impact of the introduction of new exemptions from rights from any UK_GDPR right as being “necessary” or “in the public interest” merely because the exemption has been approved by Parliament in secondary legislation (e.g. an example is provided by “The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022”).
• do not consider the impact of the introduction of new justifications for processing health records, other special category of personal data and criminal offence personal data on the right to respect for private and family life (e.g. any law that states the processing is “in the public interest” (or “necessary”) merely because these terms are found in a law that has been determined by Parliament.
• do not consider the impact of the enforcement of data subject rights in a revised data protection regime, if the Commissioner has to consider issues that have nothing to do with data protection (e.g. the requirement for the Commissioner to consider economic matters or public safety issues on the ability to enforce the rights of data subjects).

By contrast the Commissioner believes that the DCMS proposals, if enacted, would allow a EU data subject to enjoy “the same level of protection in Manchester as it does in Munich” ; he struggles “to see how the legal protections will be less in Cardiff than is afforded to those in Copenhagen”.  Given the above, I find it hard to justify such statements.

Concluding comments

In her evidence to the DCMS,  Elizabeth Denham pointed out she could not comment in detail on many of the DCMS proposals, because she did not know the detail of what was being proposed.  Indeed, I have documented 30+ incidences where the previous Commissioner effectively said – “no comment; I don’t know what the DCMS intend” (see references).

In other words, the previous Commissioner was not in a position to make the claims made by the new incumbent.  For instance, when the new Commissioner asserts that “… DCMS have committed to maintaining high standards of protection….”, I have to point out there is a dearth of evidence to support this assertion.

Finally, I should state that is not the position of the Commissioner to campaign against or overtly criticise DCMS and MoJ proposals to change the law; that is the role of Parliament unless there is an invitation to comment as in a public consultation.

Equally, it is not the role of the Commissioner to open himself to the accusation that he is supporting official proposals for change when they are palpably characterised by omission (e.g. Ms. Denham’s evidence), incompleteness (e.g. omitting concerns over A.8 and A.10 human rights) and defective analysis (e.g. see Rosemary Jay’s evidence to the DCMS).

See, you don’t have to take it from me (see references).

BCS Qualification Courses in DP (May/July 2022)

Because of continued COVID uncertainty, the courses below,  leading to the relevant BCS qualification in data protection, can be attended in person, or via Zoom, or as a mixture if you something untoward happens (e.g. you have to isolate mid-course).

• The Data Protection Foundation Course is in London, and starts Tuesday, May 9-11 (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing info@amberhawk.com
• The Data Protection Practitioner Course is in London, and starts Monday, May 16-20 (5 days each 9.30-5.30); Same syllabus as 6 day course but longer days; details on amberhawk.com/StandardDP.asp or by emailing info@amberhawk.com. The next 6 day Data Protection Practitioner Course is in London on 5-7 July and 19-21 July.  Details from the links already given.

References

1. Entick v Carrington [1765] EWHC KB J98.
2. ICO’s speech to the IAPP, 24 March 2022: https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2022/03/iapp-data-protection-intensive-uk/
3. The Equality and Human Rights Commission evidence to the MoJ on Human Rights in the UK (click 2022): https://www.equalityhumanrights.com/en/legal-responses/consultation-responses
4. My MoJ views are based on the text of my blogs:

18 Jan 2022: UK’s human rights proposals significantly weaken protection for all data subjects https://amberhawk.typepad.com/amberhawk/2022/01/uks-human-rights-proposals-significantly-weaken-protection-for-all-data-subjects.html

26 Jan 2022: Human Rights proposals undermine Data Protection and Adequacy https://amberhawk.typepad.com/amberhawk/2022/01/human-rights-proposals-undermine-data-protection-and-adequacy.html

28 Feb 2022: Proposals to strengthen journalists’ freedom to report is based on a fundamental misreading of ECHR judgment https://amberhawk.typepad.com/amberhawk/2022/02/proposals-to-strengthen-journalists-freedom-to-report-is-based-on-a-fundamental-misreading-of-echr-j.html

8 March 2022: Omissions in Human Rights proposals degrade privacy and freedom of expression https://amberhawk.typepad.com/amberhawk/2022/03/omissions-in-human-rights-proposals-degrade-privacy-and-freedom-of-expression.html

5. The blog where I identify 30+ proposals where the previous ICO said she did not know what the DCMS was proposing. https://amberhawk.typepad.com/amberhawk/2022/02/outcome-of-dcms-data-protection-consultation-pre-determined-it-helps-to-save-big-dog.html
6. My blogs on the DCMS proposals themselves that show many of the DCMS proposals are defective or make serious omissions: see the list of 7 blogs at the end of: https://amberhawk.typepad.com/amberhawk/2021/11/data-a-new-direction-amberhawks-response-to-the-dcms-consultation.html
7. Rosemary Jay’s evidence to the DCMS (download at end of): https://amberhawk.typepad.com/amberhawk/2022/01/independent-evidence-that-the-dcms-data-proposals-could-undermine-adequacy.html
8. Unlike the Equality and Human Rights Commission, the ICO has yet to publish its response to the MoJ.  I will put a URL here when it is published.

Omissions in Human Rights proposals degrade privacy and freedom of expression

A brief blog to encourage readers to submit comments to the MoJ's Human Rights consultation that ends today at a minute to midnight.  I also make available a copy of my evidence to the MoJ (see references).

This Consultation has slipped through the net relatively unnoticed as it is aimed at “legal practitioners”, “experts”, “academics” and “advocates of human rights law”. The Consultation is NOT aimed at the 60 million data subjects who are directly affected by the proposed changes.  Although the consultation period closes tonight there is an extended period of 19^th April date for those who need Easy Read or audio versions of the consultation documents.

It is also alarming that the former appeal judge who led a government-commissioned review of the Human Rights Act has told MPs he does not consider that the government’s consultation on reforming the 1998 legislation reflects his report.

The major problems with the Consultation can be summarised by what it does NOT state.  These omissions can be listed as follows:

• Absence of any consideration or analysis of the impact of the human rights proposals on the current UK_GDPR data protection regime in the UK or how they impact on data subjects (60 million in the UK alone them).
• Absence of any consideration or analysis of the impact on the proposals for changing the UK Data Protection Regime as proposed by the DCMS in a separate consultation “Data: a new direction”.
• Absence of any consideration or analysis of the impact of these proposals on the Adequacy Agreement agreed with the European Commission, resulting in the likely cessation of that Agreement.
• The lack of evidence for rebalancing Articles 8 and 10 (private and family life versus freedom of expression and to impart information) as proposed in the Consultation.
• Absence of any consideration or analysis of the impact of these proposals on the provisions that relate to the Special Purposes in the DPA2018.
• Absence of any consideration or analysis of the impact of these provisions on the FOI/FOISA or EIR/EIRSA regimes (e.g. the data protection/FOI interface).
• Misrepresentation of case law that relates to the processing of personal data mentioned in the Consultation (e.g. ML v Slovakia; Ellis v Essex Police) and omission of relevant case law (e.g. Stanley et al v Met. Police and L.B. Brent; Marper v UK)
• The lack of due process in Parliament to ensure changes to the human rights of UK citizens are subject to detailed scrutiny. The proposals include the use of secondary legislation (i.e. via Ministerial powers) to deliver changes to individual human rights with minimal involvement of Parliamentary scrutiny (this use of secondary legislation is wholly unacceptable in my view).

I should add, there is no reference in the Consultation to the proposed changes arising from the Judicial Review and Courts Bill that is intend to restrict Judicial Review and certain decisions of the Upper Tribunal.  Given that with respect to A.8 and data protection, Judicial Review is a major safeguard for data subjects (e.g. in facial recognition CCTV; immigration exemption) this omission is also surprising.

How can you have a public consultation with these gaps?  However, I conclude, in data protection terms that:

• the Consultation, if its proposals are enacted, is likely to result in weaker protection for data subjects whenever a controller’s processing of personal data is “necessary” or “in the public interest”; this weakening can extend to private sector controllers via A.6, A.9 and A.5 Principles.
• The fact that the DCMS Consultation did not discuss the impact of its proposed changes on the Adequacy Agreement (e.g. lack of an independent regulator) nor on the relationship between data protection and human rights is astonishing.
• The fact that the Consultation did not discuss the knock-on effect of the proposed human rights changes on data protection enforcement (e.g. via processing that is “necessary” or “in the public interest”) is also astonishing.
• The Adequacy Agreement is likely to be revoked. This is a subject is also deemed unworthy of mention in the Consultation.

Data Protection Courses (Spring 2022)

Because of continued COVID uncertainty, the course can be attended in person, or via Zoom, or as a mixture if you something untoward happens (e.g. you have to isolate mid-course).

• The Data Protection Practitioner Course is in London, and starts Tuesday, March 22-25; March 29-31 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing info@amberhawk.com
• The Data Protection Foundation Course is in London, and starts Tuesday, May 9-11 (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing info@amberhawk.com

References

Appeal Court judge's comment on MoJ proposals: https://www.lawgazette.co.uk/news/human-rights-act-consultation-not-a-response-to-my-report-gross/5111359.article

MoJ Consultation details on: https://www.gov.uk/government/consultations/human-rights-act-reform-a-modern-bill-of-rights

Link to Hawktalk's evidence to the MoJ: Download Response to MoJ HRA changes

That evidence is based on the text of my blogs:

• 18 Jan 2022: UK’s human rights proposals significantly weaken protection for all data subjects https://amberhawk.typepad.com/amberhawk/2022/01/uks-human-rights-proposals-significantly-weaken-protection-for-all-data-subjects.html
• 26 Jan 2022: Human Rights proposals undermine Data Protection and Adequacy https://amberhawk.typepad.com/amberhawk/2022/01/human-rights-proposals-undermine-data-protection-and-adequacy.html
• 28 Feb 2022: Proposals to strengthen journalists’ freedom to report is based on a fundamental misreading of ECHR judgment https://amberhawk.typepad.com/amberhawk/2022/02/proposals-to-strengthen-journalists-freedom-to-report-is-based-on-a-fundamental-misreading-of-echr-j.html

Proposals to strengthen journalists’ freedom to report is based on a fundamental misreading of ECHR judgment

The Ministry of Justice (“MoJ”) Consultation,  “Human Rights Act Reform: A modern Bill of Rights” (the “Consultation”), contains proposals that tips the balance between “respect for private and family life.” (A.8) and freedom of expression and to impart information (A.10) in favour of the latter (A.10).

Quoting a single ECHR judgment (ML v Slovakia) as justification for the changes, the Consultation fails to realise the judgment does the precise opposite.   A case which initially appears to be one where the public interest in the information is high, soon dissipates as it is discovered that the tabloid journalists concerned did not even exhibit a basic level of journalistic integrity.

As reported in my previous blogs, the Consultation is ignorant to the impact of its proposals on the parts of the UK_GDPR relevant to the A.8/A.10 balance (e.g. the A.17(3)(a) exemption from the right of erasure; the journalists code of practice being prepared by the ICO; the Special Purpose Exemption in Schedule 2, Part 5).

These omissions undermine the quality of the Consultation’s arguments.

The current balance between A.10 and A.8

The balance between the protection of private and family life and the freedom to impart information is equally balanced and one right does not take precedence over the other.  This position was set out a recent case before the Supreme Court (Bloomberg v ZXC; see references).

“Both [rights] reflect important civilised values, but, as often  happens, neither can be given effect in full measure without restricting the other.  How are they to be reconciled in a particular case?  There is in my view no question of automatic priority. Nor is there a presumption in favour of one rather than the other.  The question is rather the extent to which it is necessary to qualify the one right in order to protect the underlying value which is protected by the other” (para.57).

The Bloomberg case concerned a US citizen who worked for a company which operated overseas that became subject of a criminal investigation.  A confidential Letter of Request from the relevant authorities was sent seeking information and copies of documents; the Letter expressly requested that its existence and contents remain confidential.

Bloomberg obtained a copy of the Letter, and published an article based on the Letter reporting that information had been requested in respect of an individual (ZXC) and detailing the matters in respect of which ZXC was being investigated.  Bloomberg was later sued by ZXC for misuse of private information; Bloomberg lost and eventually their Appeals reached the Supreme Court.

The Supreme Court came down on the side of ZXC stating that “in general, a person under criminal investigation has, prior to being charged, a reasonable expectation of privacy in respect of information relating to that investigation”.

Note that the use of the words  “in general” shows that there is a presumption that persons under criminal investigation have their privacy maintained during that investigation unless there is a good reason for this not to be the case (e.g. as in historic sexual abuse investigations where there may be a need for other victims to come forward).

This position is current public policy, the argument being that there is a negative effect on an innocent person’s reputation if he or she is publicly identified as being investigated for a crime which is not even before the courts (i.e. prior to any charge).  Additionally,  publicity could impact on the investigation (e.g. by alerting the actual criminal to the existence of an investigation).

As can be imagined, the Supreme Court judgement has not gone down well with the media, who prefer the default position should always be in favour of openness rather than secrecy.  Naturally, they are quite happy that there is a presumption that those under investigation can be identified by the press unless there is a good reason for the opposite.

That is why the question of “which view prevails?” (i.e. public disclosure in the press) depends on the facts of the case – which of course is the current balance between A.8 and A.10.

The MoJ proposals

The Consultation argues that the freedom to impart information to the public should prevail in many circumstances.  This is spelt out by the Consultation in the following terms:

“..the Bill of Rights legislation should contain a stronger and more effective provision, making it clear that the right to freedom of expression is of the utmost importance, and that courts should only grant relief impinging on it where there are exceptional reasons”. (para 213; my emphasis)

In justification of this position, the Consultation does not consider any UK judgement where the press have found a problem with A.8.  This is surprising as there are over a 100 such cases and one would have thought that the Consultation would have been spoilt for choice (see references for a list of cases dating from 2010).

Instead the Consultation justifies the need for change by citing the ECHR judgement in ML v Slovakia (see references) as follows:

“But at the same time, the case law of the Strasbourg Court has shown a willingness to give priority to personal privacy, including in a recent judgment finding that media reporting about a deceased priest’s convictions for child sexual abuse and public indecency could interfere with his mother’s right to private life, drawing, in part, on the so-called ‘right to be forgotten’ invented by the Court of Justice of the European Union” (para 206 of Consultation)

I suspect the authors of the Consultation have not read the judgement.  For instance, I don’t think that judicial commentary like:  the journalists concentrated  “on sensational and, at times, lurid news, intended to titillate and entertain” helps the case for more protection of freedom of expression.

I also suspect the reference to the “so-called right to be forgotten” in the above has been included for pejorative effect.  The Consultation omits the fact that this right exists in the UK_GDPR as an exemption from the right to erasure on the grounds that the freedom to impart information to the public should prevail (see A.17(3)(a) of the UK_GDPR).

Finally, the authors of the Consultation failed to realise that the priest is deceased; the “so called right to be forgotten” does not apply and is completely irrelevant.

ML v Slovakia

In practice,  the ML v Slovakia case is really about two questions:

• can personal information about the dead fall within the scope of Article 8 of the Convention out of respect for the feelings of the deceased’s relatives? (The Court’s answer is “yes”).
• If so, to what extent can personal information about the dead be published by the press. (The Court’s answer is “it depends on the facts of the case”).

The press stories under scrutiny related to a Roman Catholic priest who had been cautioned / convicted in relation to sexual abuse and disorderly conduct (consensual oral sex in a public place).  All criminal convictions / cautions had become spent and the priest died in 2006, possibly by suicide.

In 2008, three tabloid newspapers published articles about the priest’s conviction for sexual abuse and a possible link to his supposed suicide. The articles were headlined: “Priest confessed to abuse of minor boys. Secret of priest’s suicide”, “Priest abused Roma boys. He confessed before his suicide”, and “Protected priests. The Church provided a guarantee to get a paedophile priest out of prison”.

The articles asserted that the priest had confessed to the bishop and the Church then offered a the authorities a guarantee of future good behaviour; that explained how the priest avoided prison. Suicide was reported as a fact.

Given recent history of the Church on this subject, there appears to be a strong public interest in this story.

So what went wrong?

As far as the journalists were concerned, their freedom of expression arguments went pear shaped because they could not present any evidence backing up their stories.  For example, the bishop said he wasn’t contacted by the press about the case, evidence of police contacts were lost, and internet allegations about the priest (e.g. suicide) were reported in newspaper stories as facts.

To give a flavour of these issues, the judgement notes:

“The journalist M.K. referred to a very good source who had provided him with a written document, and to a police record concerning the questioning of the applicant’s son; he claimed to have verified the authenticity of the written document but did not remember any details.  M.K. asserted that he had also contacted police spokespersons and had sent an email to the bishop’s office, but he was not sure whether he had saved their exchange”.(para 10 of judgement).

The result was that the Slovakian District Court ordered each of the defendants (i.e. the journalists) to publish a formal apology to the priest’s mother for having published untrue allegations about her late son, but dismissed her financial claims.  This judgment was then subject to a series of appeals before the case eventually ended up at the ECHR.

I give five quotes from the judgement about the journalistic standards the ECHR encountered; they need no further embellishment from me except to emphasise some key words:

• “Although the journalists must be afforded some degree of exaggeration or even provocation, the Court considers that the frivolous and unverified statements about the applicant’s son’s private life must be taken to have gone beyond the limits of responsible journalism” (para 47).
• “... the Court is ready to accept that the distorted facts and the expressions used [by the press] must have been upsetting for the applicant and that they were of such a nature as to be capable of considerably and directly affecting her feelings as a mother of a deceased son”.  (para 48)
• “…the Court reiterates that there is a distinction to be drawn between reporting facts - even if controversial - capable of contributing to a debate of general public interest in a democratic society, and making tawdry allegations about an individual’s private life”.. (para 53)
• [with respect to the public interest] “….the pre-eminent role of the press in a democracy and its duty to act as a “public watchdog” are important considerations in favour of a narrow construction of any limitations on freedom of expression.   However, different considerations apply to press reports concentrating on sensational and, at times, lurid news, intended to titillate and entertain, which are aimed at satisfying the curiosity of a particular readership regarding aspects of a person’s strictly private life”. (para 53)
• “Thus, the Court finds that, as well as being rather provocative and sensationalist, the articles in question could hardly be considered as having made a contribution to a debate of general interest”. (para 54)

Concluding comment

So, given the above, do you think ML v Slovakia supports the Consultation’s position?  Is the journalism identified by the judgement be the kind of journalism that UK law should protect?

I find it astonishing that the Consultation attempts to base its arguments to rebalance A.8/A.10 on a case that is so critical of journalistic ethics and standards when there is a hundred British cases to choose from.  It adds to the general concern expressed in my other blogs: the lack of evidence that supports the proposed changes to the Human Rights Act.

I suspect a main driver for change is the same one that scrapped the second part of the “Leveson Inquiry - Report into the culture, practices and ethics of the press”.   It is a “thank you for your continued support”, aimed at the Brexit supporting tabloid press, from a Government that has serious issues concerning honesty, truth and credibility.

Data Protection Courses (Spring 2022)

Because of continued COVID uncertainty, the course can be attended in person, or via Zoom, or as a mixture if you something untoward happens (e.g. you have to isolate mid-course).

• The Data Protection Practitioner Course is in London, and starts Tuesday, March 22-25; March 29-31 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing info@amberhawk.com
• The Data Protection Foundation Course is in London, and starts Tuesday, May 9-11 (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing info@amberhawk.com

References

Bloomberg LP v ZXC  [2022] UKSC 5

Cases involving A.8 versus A.10 – see Informm’s list on  https://inforrm.org/table-of-cases-2/

ML v Slovakia [2021] ECHR 821.  Just Google the reference

The Times is quoted in the 11KBW blog: https://panopticonblog.com/2022/02/25/bloomberg-v-zxc-the-supreme-court-decides/

Outcome of DCMS data protection consultation pre-determined; it helps to save “Big Dog”

“Operation Save Big Dog” is the name given to the effort expended to ensure the Prime Minister survives, despite several after-hours, alcohol-fuelled, “office-gatherings” at 10 Downing Street during COVID-lockdown.  This Operation has coincided with the need to remind the British public of the pure brilliance of the Brexit decision.

Hence last week’s announcement of a ‘Brexit Freedoms’ Bill” (with the promise to use Ministerial powers push through major change) and the publication of a policy document entitled “The Benefits of Brexit” (in case you missed them).  The publication also marks the two-year anniversary of “Getting Brexit Done” and the passage of that not-so-ready, “oven ready” Brexit deal.

The policy document also spells out that the outcome of the DCMS Consultation “Data: a new direction”, concerning changes to the UK_GDPR regime, has been pre-determined; it does not matter what the consultees have written.

It follows that further data protection legislation which provides for weakened privacy protection for data subjects, looser data protection obligations for controllers, and a reduction in the independence of the ICO appears to be inevitable.

Coupled with the changes to the Human Rights regime and the new hurdles facing those who seek judicial review, the UK’s data protection regime is being dissembled.

Pre-determination

The pre-determination of outcome is self-evident from the following quotations from the Benefits of Brexit document.  Firstly:

…the “UK Government consulted in the autumn on proposals that seek to create an ambitious, pro-growth and innovation-friendly UK data protection regime that underpins the trustworthy use of data. The Government will be publishing its response in Spring this year ahead of introducing legislation on reforms to the UK’s data protection regime”.  (my emphasis).

Note the UK Government has “consulted”, an outcome will be published and then legislation will be enacted.  There is to be no second round of consultation.

According to The Benefits of Brexit document these reforms:

“… will help to drive growth, innovation and competition across the country and enhance the UK’s global reputation as a hub for responsible data-driven businesses, trusted by consumers to deliver high standards of data protection” (my emphasis).

[will] “…make the UK an innovation-friendly hub for responsible data-driven business that respects high standards of data protection. Removing barriers to those data flows will boost trade, investment and scientific and technological innovation”. (my emphasis).

Note that both paragraphs repeat the DCMS assertion that “trusted” or “high standard” of data protection can be delivered by reducing or removing controller obligations (e.g.in accountability, doing a DPIA before embarking on high risk processing, having a DPO to monitor compliance, in mandatory data breach reporting, charging for subject access, compatibility and transfer requirements, skewing legitimate interest in favour of the controller, diminishing data subject rights).

Note also the Benefits of Brexit describe the controller obligations as “barriers” not understanding that such barriers exist to protect data subjects.

Finally, the Press Release accompanying the Benefits of Brexit adds that new legislation will create a “less burdensome data rights regime compared to the EU’s GDPR”.   Note that the data subject’s right of access, right to be informed, right to correct, right to object, right not to be profiled etc are all viewed as “burdensome” to controllers and not considered to be valuable safeguards for data subjects.

It is clear that the above conclusions have been reached irrespective of any evidence provided by the consultees to the DCMS Consultation.

Introduction to the ICO comments

I don’t want to spend too much time going over (again) the DCMS Consultation.  My blogs explain that in far too many areas, the DCMS proposals were littered with mistakes, omissions and misunderstandings about the data protection regime (see references at end of blog). The quality of the DCMS consultation is, at best, very questionable.

In addition,  as Rosemary Jay points out,  the protection afforded to data subjects is significantly reduced and the risks of breaching the European Adequacy Agreement is high (see references).  Her evidence also points to errors, omissions and difficulties in understanding the DCMS proposals for change.

Finally, there is the ICO’s response to the DCMS Consultation (see references).   There are at least 34 pages where the ICO fails to comment in substance on the DCMS proposals because there is insufficient detail in the DCMS plans.  I am not expecting you to read all of the list below, but you will quickly get the gist with a scan.

Together the responses identified above demonstrate that the DCMS Consultation cannot be trusted to substantiate the changes to the data protection regime that is to be imposed on the UK’s data subjects (probably using Ministerial powers to minimise public and Parliamentary debate).

ICO seeks clarity on DCMS proposals

1. “As the proposals are developed, the devil will be in the detail we believe there remains more work for Government to demonstrate in sufficient detail how the remainder of the proposals achieve these objectives. (Page 2; ICO consultation)
2. “We believe there remains more work for Government to demonstrate in sufficient detail how the remainder of the proposals achieve these objectives”…. (Page 12)
3. “In order for Government and Parliament to have the required confidence, the nature, context and detail of the processing would need to be set out clearly”… (Page 13)
4. “We would also welcome more detail on how this proposal will interact with the exercise of people’s rights.” (Page 13)
5. “We think Government still needs to provide more detail on the proposals to allow organisations to use data more freely “….(Page 20)
6. “More detail is needed on these and on the proposed role of the ICO”. (Page 20)
7. “We look forward to seeing more detail, particularly on those areas where the policy proposals are more high level”. (Page 24)
8. “We look forward to seeing more detail on the impact on people’s data protection rights …as the Government’s impact assessment and analysis is further developed.” (Page 24).
9. “We would like to see more explanation of the proposals and detailed analysis of the collective impact on the types and volumes of personal data being processed” (Page 28)
10. “We would also like more detail of how the Government plans to make sure this information is protected and that transparency is ensured”. (Page 28)
11. “We would also welcome more detail on how this proposal will interact with the exercise of people’s rights” (Page 30)
12. “We will be looking for Government to set out the nature of the specific types of processing in more detail and how it has assured itself that those included in the list would not have a disproportionate impact on people”.(Page 30).
13. “[The proposal] would need to set out the nature, context and detail of the processing, given that this is all relevant to assessing where the balance lies.” (Page 31)
14. “It is important that Government clearly sets out more detail about how such an approach would work and what safeguards would be in place” (Page 33).
15. “We would like to see more detailed analysis of the thinking Government has done as part of its assessment that the legitimate interests of the organisation undertaking this kind of processing would always outweigh the potential risks to people's rights and freedoms…” (Page 34)
16. “This [proposed change] should be based on detailed analysis and evidence”. (Page 35)
17. “It is also important to understand in more detail from Government how the PMP proposal would ensure a risk based approach”. (Page 42)
18. “This includes how it [the proposed change] would ensure that those organisations with the highest volumes, greatest complexity or most privacy intrusive data have the most robust approaches to accountability and risk identification, mitigation and management”.(Page 42)
19. “We would also welcome more detail from Government about how these proposals would enable businesses to assess the risks of harm to people that arise from new or novel processing, particularly where these involve new technology”.(Page 43)
20. “We would like to see further detailed consideration about how safeguards will work in practice, including how any rights of appeal may need to be amended and how potential equality issues will be addressed”. (Page 49)
21. “we are concerned about the lack of consideration of the impact on people and the potential for these changes to reduce people’s ability to access their fundamental rights” (Page 49)
22. “We are interested in understanding more detail about how this would work in practice.”(Page 49)
23. “The consultation does not go into detail about which elements of these rules would be relaxed.” (Page 55)
24. “While we recognise that these proposals are still in development more detail is needed for respondents to fully understand how a risk-based approach would work in practice”. (Page 60)
25. “We look forward to Government providing more detail on ….”(Page 61)
26. “As above, we look forward to seeing more details or examples of how these proposals would work in practice.”(Page 61)
27. “It would be helpful to have more detail about how the Government proposes to deploy this approach to fully understand the risks and benefits involved.” (Page 61)
28. “It is important that the Government provides more detail on how they would assess whether redress mechanisms are effective.” (Page 61)
29. “More detail on the proposed approach would be helpful in exploring where this might be the case.” (Page 65)
30. “We therefore look forward to seeing further detail on how the Government would ensure the right balance is found between flexibility and assurance to create the appropriate regulatory oversight of this proposal…” (Page 65)
31. “We look forward to seeing further detail on this proposal as it develops. In any more detailed proposals, we would want to guard against weakening the data protection regimes for policing and the intelligence services” (Page 77)
32. “In these areas, more detail on the specific checks and balances in place to ensure the ICO’s continued effective delivery of this role would be helpful”. (Page 79)
33. “We are open to this expansion of our regulatory remit, subject to appropriate funding, and await further detail on how any transfer of functions would work in practice”. (Page 88)
34. “We would welcome a more detailed impact assessment on the overall cost to the ICO, and therefore fee payers, of any changes to the services the ICO is required to deliver (Page 89)

Concluding comment

It is important to understand that the paucity of evidence, the lack of detail, all the omissions and the erroneous analysis in data protection are unimportant to this Government.

Afterall, the political imperative is to “Save Big Dog” by demonstrating that Brexit works.  What better route than by lowering UK data protection standards to the standards adopted by other non-European countries so Ministers can use their powers to state that their data protection law are adequate.

Spring Data Protection Courses

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection Practitioner Course is in London, and starts Tuesday, March 22 (6 days); full details on amberhawk.com/StandardDP.asp or by emailing info@amberhawk.com
• The next Data Protection Foundation Course is in London, and starts Tuesday, May 9-11 (3 days); full details on http://www.amberhawk.com/DPFoundation.asp or by emailing info@amberhawk.com

References

The Adequacy Agreement with the UK: https://ec.europa.eu/info/sites/default/files/decision_on_the_adequate_protection_of_personal_data_by_the_united_kingdom_-_general_data_protection_regulation_en.pdf.

The Benefits of Brexit: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1052148/benefits-of-brexit-document.pdf

Rosemary Jay’s Independent evidence that the DCMS data proposals could undermine adequacy (and the like the ICO, when the DCMS Consultation is unclear or wrong-headed) https://amberhawk.typepad.com/amberhawk/2022/01/independent-evidence-that-the-dcms-data-proposals-could-undermine-adequacy.html

My response to the DCMS Consultation (with links to my 7 blogs on different parts of the DCMS Consultation at the end of this link): https://amberhawk.typepad.com/amberhawk/2021/11/data-a-new-direction-amberhawks-response-to-the-dcms-consultation.html

ICO response to the DCMS Consultation: https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2021/10/response-to-dcms-consultation-foreword/

UK’s human rights proposals significantly weaken protection for all data subjects

The Ministry of Justice (MoJ) Consultation,  “Human Rights Act Reform: A modern Bill of Rights”,  has the potential to significantly undermine the application of UK’s data protection regime.

These MoJ proposals are in addition to the DCMS proposals which also weakened the UK_GDPR (discussed in various blogs last November).  Neither the DCMS nor the MoJ make any reference to the fact that their separate public consultations are connected when data protection is concerned.  One wonders how this fundamental omission was missed?

The MoJ Consultation, in summary, is designed to expurgate any European contamination associated with the words “necessary”, “public interest” and “proportionate”.  For example, MoJ proposes changing the interpretation of the word “necessary” so that “great weight” has to be given to Parliament’s view of what is necessary. The same goes for “public interest”.

This has a knock on to the data protection regime.  For example,  the word “necessary” is used in: three Principles in A.5; most lawful bases in A.6; most conditions for the processing of special category of personal data and criminal offence personal data (A.9, A.10 and Schedule 1 of the DPA2018) and several A.23(1) exemptions.

It can be seen that if that “great weight has to be given to Parliament’s view of "necessary" processing, then any enforcement action by the ICO becomes far more difficult. And if the data protection regime cannot be properly enforced, it follows that the protection for data subjects is weakened.

In addition, the MoJ Consultation uses the term “public interest” over 70 times, without a formal definition.  This is like the DCMS consultation “Data: a new direction” which uses the term “public interest” more than 40 times without defining it.

So when Ministers refer to “the public interest” what they mean?

As will be seen, the answer I derive is not a happy one.

ICO as A.8 ECHR Commissioner?

Both the DPA2018, UK_GDPR & Human Rights Act (HRA) are intertwined mainly through the word “necessary” as used, for example, in A.6 of the UK_GDPR or in A.8(2) of the European Convention on Human Rights (ECHR).

For instance, in the context of interference by a public body into an individual’s private and family life (e.g. by police surveillance), the interference (i.e. surveillance) can be justified if it is necessary to safeguard the functioning of a democratic society for reasons listed in Article 8(2) of the ECHR (e.g. “necessary … for the prevention of crime”).

The European Data Protection Board explained the linkage between the data protection and human rights regimes in the following terms:  “In cases where there is 'interference with privacy' [legitimised in terms of A.8(2) of the ECHR] a legal basis is required [as a result of A.6 of the GDPR] … as a precondition to assess the necessity of the interference”. (quotation from WP217).

In other words, when there is an interference by a public body, A.8(2) of the ECHR sets out a general “necessity” requirement for the processing of personal data to be lawful whilst A.6 of the GDPR additionally sets out why that processing is “necessary” (e.g. “necessary for a legal obligation” etc).

The corollary is also valid: a public authority does not infringe the A.8(1) ECHR right, if it can show that its interference by the processing of personal data is justified (i.e. necessary) and has an A.6 lawful basis (e.g. necessary for its public task).

Note that it is possible for the ICO to enforce A.8 ECHR when personal data are processed by a public authority via its link to A.6 of the GDPR.  For example,  if a public authority controller misapplied its powers to disclose personal data, then it could not rely on the obvious lawful basis as the disclosure of personal data would, for instance, not be necessary for a legal obligation  (as the legal obligation has been misapplied).

In other words, the breach of A.8 would also translate into a breach of the relevant lawful basis, in this example A.6(1)(c).  It is the same for “public task” in A.6(1)(e).

It follows that the ICO (as can any European Data Protection Authority) can make an assessment of necessity or proportionality and could become an A.8 Commissioner whenever personal data were processed by a public body.

Unfortunately all data protection regulators (UK and in Europe) down the ages have steadfastly refused to go down this road except, in the UK, for one notable case (see references which also contains a link to a definitive document on the reach of A.8).

Changes to “necessary” & “public interest”

The MoJ Consultation suggests two possible legislative changes to the human rights regime which have significant interpretive impact across the UK_GDPR.  Namely, those UK_GDPR provisions that rely on the words “necessary” or “in the public interest” for their effect.

Note that the text of the UK_GDPR does NOT change (e.g. the UK_GDPR provision still refers to “necessary”), but the interpretation and consequential impact on application or enforcement of the UK_GDPR does change significantly.

These proposed legislative changes will apply when an A.8 case is heard by a Court; these require the Court to give “great weight”:...

“… to Parliament’s view of what is necessary in a democratic society (and the fact that Parliament has enacted the legislation is for these purposes determinative of Parliament’s view that the legislation is necessary in a democratic society)”;

Or (this “or” could possibly end up being an “and”?)

“… to the fact that Parliament was acting in the public interest in passing the legislation” (page 100; MoJ Consultation;  my emphasis).

“Legislation” as used in the above quotations is defined to be  “primary legislation, and subordinate legislation …. which has been approved by a resolution of either or both Houses of Parliament” (i.e. the affirmative resolution Parliamentary procedure has been followed).

If the MoJ proposals become law, it can be seen that whenever Parliament enacts legislation that relates to (or requires) the processing of personal data, this fact has to be given “great weight” by the Courts when assessing whether the processing is “necessary” or “in the public interest”.

Clearly therefore, the ICO will also have to give them “great weight” prior to enforcing the data protection regime (or indeed in the ICO’s official data protection guidance).

Worked example

Suppose the ICO is enforcing the lawful basis used for the processing of personal data by a public authority and suppose further the processing was authorised by law or related to its public task functions as set in legislation approved by Parliament.

To have a successful enforcement under A.6, the ICO has to establish that the processing was neither “necessary” nor “in the public interest” AND overcome the “great weight” that has to be given to the alternative view (e.g. Parliament’s view that the processing was necessary).

This allows a public authority controller that is facing such ICO enforcement action (e.g. for unlawful processing) to defend the ICO’s action in Court (or Tribunal) arguing that: “The ICO has failed to give  “great weight” to Parliament’s view that the controller’s processing was indeed necessary”.

Similarly, if the “in the public interest” option arises; the argument changes to: “The ICO has failed to understand that “great weight” had to be given to the  “public interest” in the processing especially as the Controller was merely following Parliament’s wishes”.

Remember, in general, A.6(1)(e) provides a lawful basis for the processing if it is “necessary for the performance of a task carried out in the public interest” where the public interest in question is likely to carry automatic “great weight”  (in favour of the controller rather than the data subject).

Wider impact on the UK_GDPR

The question then arises as to whether this kind of knock on effect undermines other data protection provisions where the words “necessary” or “the public interest” are used?  I am afraid to say that I suspect this is the case.

For instance the word “necessary” appears in three Principles in A.5, most lawful bases in A.6, most conditions for the processing of special category of personal data and criminal offence personal data (A.9, A.10; Schedule 1) whereas ”public interest” appears in A.23 exemptions, certain rights (e.g. A.13), Schedules 1 to 5 of the DPA2018 (Special category of personal data and exemptions), transfer arrangements, data breach notification etc (and in a number of other places).

So assume the Government use powers approved by Parliament in the Digital Economy Act 2017 to specify data sharing between two controllers of specified personal data for a specified period.  Suppose further the ICO considers that the controllers were processing excessive personal data for far too long.

The controllers can resist any ICO enforcement to by arguing:

• Parliament has determined that the lawful basis for the processing is both “necessary” and “in the public interest” (i.e. A.6(1)(e)) and this fact should carry “great weight”;
• The Data Minimisation Principle is not breached because Parliament has explicitly stated the processing of certain items of personal data; these have been deemed necessary for the purpose and this fact should carry “great weight”;
• The Storage Limitation Principle is not breached because Parliament has explicitly specified the that personal data should be retained in a name linked form for a specific period; Parliament has deemed this retention time as being “necessary” for the purpose, and that this fact carries “great weight”.

It can be seen that there is not much data protection left  (e.g. transparency, security) and the provisions in the MoJ Consultation (as illustrated above) effectively comprise an exemption from the two Principles mentioned above and A.6. 

Note also that the data subject’s right to object also becomes almost exempt as the objection has to overcome the fact that Parliament has judged that the continued processing by the controller has to carry great weight.

With respect to “substantial public interest” (as used in Schedule 1 to legitimise the processing of special category of personal data),  the DCMS has suggested changes where legislation specifies when the substantial public interest is satisfied (para 297 of DCMS Consultation).

If this happens the processing will automatically become “necessary” and this fact will have to be given  “great weight” by the ICO.  The result is that such special category of personal data and criminal offence personal data could be made easier to process by public bodies to the detriment of the protected offered to data subjects.

In the public interest?

With respect to enacting legislation, what Government wants usually is enacted;  there is no separation of powers in the UK as the executive (i.e. Government) sits in the legislature (i.e. Parliament) and is in control of the legislature’s agenda. This is exacerbated by an Electoral System that delivers majority Governments with a minority popular vote (e.g. 58% of the Parliamentary seats with 43.6% of the popular vote).

This means that opposition parties might huff and puff, but with a large majority, a Government should get its legislative way.

The point being made is that Parliament could vote primary legislation down but very rarely does so.  So when the MoJ Consultation refers to  “…Parliament’s view of what is necessary in a democratic society “  it is really referring to what the Government considers as being necessary in a democratic society.

Similarly when Parliament acts in the public interest in passing the legislation it is usually because Government has the view that the proposed legislation is in the public interest.

It’s the same with the secondary legislation subject to affirmative resolution procedures.  Although in theory, secondary legislation can be voted down, it is not.  A House of Commons Research Paper on Statutory Instrument explains that:

“In the House of Commons, the last time a draft Statutory Instrument subject to affirmative procedure was not approved was in July 1978 when the draft Dock Labour Scheme 1978 was defeated by 301 votes to 291. (see references).

So, in summary, what is necessary is what the Government specifies as necessary; what is in the public interest equates to the interests of the Government of the day.

But then it gets worse.  Given the primacy of the (almost Presidential) post of Prime Minister, what is “in the public interest” equates to “in the interests of Boris Johnson”, insofar, at the time of writing, he is the current Prime Minister of the UK.

Now that is a really unpleasant thought to end with.

Data Protection Courses (Winter 2022)

Because of continued COVID uncertainty, fuel crisis, or the results at Barnsley FC the course can be attended in person, or via Zoom, or as a mixture if you something untoward happens: it's up to you.

• The Data Protection Practitioner Course is in London, and starts Tuesday, March 22-25; March 29-31 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing info@amberhawk.com
• The Data Protection Foundation Course is in London, and starts Tuesday, February 1st to 3rd (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing info@amberhawk.com

References

Information Commissioner should enforce Article 8 privacy rights http://amberhawk.typepad.com/amberhawk/2010/04/information-commissioner-should-enforce-article-8-privacy-rights.html

Information Commissioner’s enforcement proceedings links Article 8 to unlawful processing. https://amberhawk.typepad.com/amberhawk/2012/11/information-commissioners-enforcement-proceedings-links-article-8-to-unlawful-processing.html

House of Commons Research Paper on Statutory Instruments: https://researchbriefings.files.parliament.uk/documents/SN06509/SN06509.pdf

Guide to Article 8 prepared by the Registry of the European Court of Human Rights: https://www.echr.coe.int/Documents/Guide_Art_8_ENG.pdf

Example of affirmative SI procedure for the “Economic Growth (Regulatory Functions) Order 2017”:  see middle of Ministers want to pull the strings and rein-in the ICO’s independence; https://amberhawk.typepad.com/amberhawk/2021/11/ministers-want-to-pull-the-strings-and-rein-in-the-icos-independence.html

Human Rights proposals undermine Data Protection and Adequacy

The proposals to change the human rights regime outlined in Ministry of Justice (MoJ) Consultation,  “Human Rights Act Reform: A modern Bill of Rights”, are truly awful.  This is especially the case when combined with the proposed restrictions on Judicial Review that helps ensure that public authorities process personal data lawfully in accordance with Article 8 (A.8) of the Human Rights Convention.

As will be seen in the next few blogs, the human rights legislation that protects us all and underpins the data protection regime is in serious jeopardy.  I therefore encourage readers to enter the fray and make their views clear. 

It goes without saying that these changes, if implemented, would significantly jeopardise the Adequacy Agreement with the European Commission.  Does the Ministry of Justice (MoJ) consultation mention the impact on the Adequacy Agreement? Of course not; like the DCMS consultation “Data: a new direction”, it remains silent on this important issue.

In addition, the MoJ’s case for changing the UK’s human rights regime with respect to A.8 is wholly misleading.  To use a topical idiom: the MoJ Consultation “is as truthful as a BoJo”.

In summary, the proposals are unacceptable and, in the next few blogs, I will explain why this is the case.

Summary of the changes

The text of the human rights listed in Schedule 1 of the Human Rights Act 1998 is not being changed; however, its interpretation and application is.

In summary, the MoJ proposed changes relevant to this blog (I.e. A.8) include:

• empowering domestic courts to apply human rights in the UK context. Comment: the UK Courts are not required to follow European Court of Human Rights judgments.
• changing the ability of individuals to protect their A.8 rights by requiring the UK courts to give “great weight” to the views of Parliament (e.g. the “public interest” or “necessity” is essentially determined by Parliament).  Comment: public bodies will be presumed to be working in “the public interest” when they act in a way that is authorised by legislation enacted by Parliament.
• changing the balance between A.10 (freedom of expression) and A.8 (respect to private and family life); there will be a presumption that the former should prevail over the latter. Comment:  this can be seen as a “thank you for your continued support”, from the Conservative Party,  to its friends in the largely Brexit supporting media.
• making it harder for individuals to take human rights cases by “ensuring that spurious cases do not undermine public confidence in human rights”. Comment: the individual could be required to exhaust other remedies first, then obtain leave of the court in order to pursue an A.8 case and then show prior “significant disadvantage” or demonstrating an “overriding public importance”.

Note that the above constitute a subtle change to our human rights.  The text of the actual rights has not changed but exercise of these rights, or an interpretation that favours the individual complainant, becomes very much harder to establish.

In summary, Government can claim “nothing has changed” (e.g. to the text of A.8 right), but a great deal will change when individuals attempt to exercise the A.8 right.

Adequacy down the tubes?

The threat to Adequacy Agreement arises because the European Commission thought that..:

• there was “… United Kingdom’s adherence to the ECHR … as well as its submission to the jurisdiction of the European Court of Human Rights”. (para 19; my emphasis). Comment: as explained above, the UK is no longer “submitting” to the jurisdiction of the European Court. The MoJ  Consultation spells this out “…that the judgments and decisions of the European Court  of Human Rights … are not part of the law of any part of the United Kingdom” (page 100 of MoJ)
• “….any person that considers that his or her rights, including rights to privacy and data protection, have been violated by public authorities, can obtain redress before the UK courts under the Human Rights Act 1998”. Comment: the MoJ proposals put considerable hurdles in the way of any person seeking such redress (e.g.  show prior “significant disadvantage” etc;  para 109).
• there was “continued adherence to such instruments” (i.e. “submission to the jurisdiction of the European Court of Human Rights”; para 120). ”. Comment: “continued adherence”  is no longer the case.

I now move on to the misrepresentation of A.8 position as expressed in the MoJ Consultation.

The case of Marper v UK

Marper v the UK is an important example of an A.8 case that the MoJ Consultation ignores (see references).

The case surrounds a simple question: “should the DNA sample and the numerical representation of that DNA sample,  be deleted if a suspect, charged of a crime, is acquitted?”.  So should the police be able to retain DNA of people found innocent?  Before reading on, what’s your answer: YES or NO?

As an aside, I explained in a blog 13 years ago that the current retention policy relating to DNA will eventually produce a DNA database that spans the population (see references).

Marper is interesting in that, when before the House of Lords (now called the Supreme Court), a panel of five law Lords (all senior judges) found unanimously in favour of retention of DNA by the police.  By contrast, a full panel of ECHR Court judges found 17-0 in favour of Mr. Marper (i.e. unanimously the other way).

If the Government’s proposals were to become law, DNA of the innocent would have been lawfully retained by the police as the highest Court in the UK would have made an unanimous determination.  Such retention would be very different for European police forces.

In addition, I suspect all the surveillance A.8 cases where the national security agencies and the police have overstepped the mark (e.g. bulk personal data collection; use of CCTV facial recognition) would have been lost if the MoJ’s proposals were law.

One obvious reason for this is that the claimant would not be able to overcome the “significant disadvantage” threshold.  For instance, how do you know that you are subject to secret covert surveillance?  Answer:  you don’t know.   So how can you establish “significant disadvantage” before taking action.  Answer: you can’t. 

In general therefore many actions on human rights grounds are likely to fall at first base.  There will be limited leeway for a judge to allow a case to go to trial if a "highly compelling reason" of "public importance" can be established pre-trial, but this pathway is designed to be exceptional-use only.

Should the MoJ Consultation have given examples like Marper that illustrate the complex human rights issues involved  (e.g. what happens if the UK is out of step with the rest of Europe) so that respondents can make an informed and balanced response? The MoJ answer is: “of course not”; the subject is not even raised.

The case of Ellis

Does the MoJ give examples where it thinks individuals have won A.8 cases without merit? Answer: YES (in spades), especially in the area of prisoner voting and deporting immigrants.

However,  this “evidence” is presented in a very misleading way and this is illustrated by the case of R (Ellis) v the Chief Constable of Essex Police as used in the MoJ Consultation.

At the heart of Ellis is a simple question?  Should the police be able to deter crimes by printing posters or leaflets that identify known criminals who have been arrested or put behind bars?  So before reading on, what’s your answer: “YES”, “IT DEPENDS” or “NO”?

The MoJ consultation explains that the Ellis case:

“…has led to the situation where police forces face a real risk of legal challenge, where they wish to publicise the results of criminal activity or deter others by issuing posters identifying offenders who have been convicted for very serious crimes” (para 137).

Does the MoJ Consultation explain how the Court come to its conclusions in favour of Ellis? Of course not.  So I will provide the missing links.

In its evidence, the Probation Service provided the following explanation to the Court:

"If Gary Ellis were to be made subject to the Essex police naming scheme, this is likely to make worse the risk of homelessness, drug misuse, reoffending, non-compliance on licence and is likely to increase the risk of harm to the public. If named there is also the distinct possibility of some collateral harm to the parents of Gary Ellis, his ex-partner and his daughter."  (para 10-12 of the Ellis judgement).

So what’s your answer now: “YES” or “NO”?

In a later A.8 case, involving the London Borough of Brent (see references), the Ellis arguments resurfaced to prevent the distribution of a leaflet that identified youths who were excluded from a geographic area (e.g. a shopping centre).  The youths were subject to an Anti-Social Behaviour Order (ASBO) which specifically excluded named individuals from that area and the police wanted to enforce the ASBO by distributing a leaflet that identified those who were subject to the ASBO.

So should the leaflet be circulated by the police (e.g. to shopkeepers)? YES” or “NO”?

In this case, the A.8 argument used in Ellis was rejected by the Judge in the following terms:

“It is clear to me that whether publicity is intended to inform, to reassure, to assist in enforcing the existing orders by policing, to inhibit the behaviour of those against whom the orders have been made, or to deter others, it is unlikely to be effective unless it includes photographs, names and at least partial addresses.”  (para 40; my emphasis)

It is interesting to note that both the Met Police and L.B. Brent argued that the A.8 right was not engaged; the Judge rejected that view but concluded that “Article 8 could be involved if the publicity was found to be unnecessary or disproportionate”.

So these are the criteria that resolves the problem raised by the MoJ’s consultation in Ellis.  If the publication of personal data is necessary and proportionate then there is no A.8 breach, if publication is unnecessary or disproportionate there is an A.8 breach. 

In my view, all that is required is a proper assessment of necessity and proportionality; not a change in the law.   Is this explained by the MoJ Consultation? Of course not.  It wants to tip the scales in favour of Government.

Hence my conclusion that the arguments presented by the MoJ Consultation in support of the changes to the A.8 regime do not stand up to scrutiny.

Concluding comment

I have found one paragraph from the MoJ Consultation deeply unsettling and I wonder whether you read it the same way as I am.  This paragraph reads as follows:

“The Prison Service has settled claims alleging a combination of negligence, inhuman and degrading treatment (under Article 3), the violation of the right to a privacy (under  Article 8) and discrimination (under Article 14). This has cost the taxpayer around £7 million, including compensation paid out and legal costs” (bottom page 40).

Do you think the MoJ Consultation is suggesting that these settled claims are unfounded and should not have been settled?  Does this then imply that a small amount of “negligence, inhuman, degrading treatment, violation of the right to a privacy and discrimination” is somehow acceptable to the Prison Service?

As the MoJ Consultation wants to change the law, the answer is an inferred “YES”; hence my alarm. Note that the Consultation is promoting the “Prince Andrew” defence:  “No inhuman and degrading treatment occurred but we are paying compensation anyway (AND please sign our Non-Disclosure Agreement)”.

In other words,  the worrying reason why the Government is wanting to change the human rights regime to “make the law difficult to use so we can get away with it”.

Data Protection Courses

Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection Foundation Course is in London, and starts Tuesday, February 1^st to 3^rd (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing info@amberhawk.com
• The next Data Protection Practitioner Course is in London, and starts Tuesday, March 22 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing info@amberhawk.com

References

The Adequacy Agreement with the UK: https://ec.europa.eu/info/sites/default/files/decision_on_the_adequate_protection_of_personal_data_by_the_united_kingdom_-_general_data_protection_regulation_en.pdf.

Human Rights Consultation Document from the MoJ: https://consult.justice.gov.uk/human-rights/human-rights-act-reform/.

Marper v UK references: Case of S. and Marper  v. The United Kingdom, (Applications nos. 30562/04 and 30566/04; judgement delivered 4 December 2008);  Regina v. Chief , Constable of South Yorkshire Police (Respondent) ex parte LS and Marper [2004] UKHL 39, judgment delivered 22 July 2004).

Blogs relevant to Marper:

• Marper case exposes how Parliament cannot consider human rights issues: https://amberhawk.typepad.com/amberhawk/2010/01/uk-terror-case-judgment-illustrates-a-failed-system-that-cannot-protect-privacy.html.
• Example of divergence between the UK and European approach to A.8 in Marper: https://amberhawk.typepad.com/amberhawk/2009/11/uk-courts-view-any-data-retention-as-human-rights-compliant.html.

2009 blog “Indefinite retention produces a DNA database that spans the population”: https://amberhawk.typepad.com/amberhawk/2009/12/indefinite-retention-produces-a-dna-database-that-spans-the-population.html.

R (Ellis) v the Chief Constable of Essex Police ([2003] EWHC 1321 (Admin)) https://www.bailii.org/ew/cases/EWHC/Admin/2003/1321.html.

R (Stanley et al) v Metropolitan Police and L.B. of Brent ([2004] EWHC 2229 (Admin)): https://www.bailii.org/ew/cases/EWHC/Admin/2004/2229.html.

Independent evidence that the DCMS data proposals could undermine adequacy.

First of all Happy New Year; I hope the recent festive excitement was not too infectious.  Indeed, with the risky policy of letting Omicron rip, let us hope there are not too many ex-data subjects, possibly as a result of the collapse of essential services.

I am starting the Year with a real treat; I have been given permission to publish the personal views of Rosemary Jay as submitted to the DCMS consultation “Data: a new direction” (see link at end of the blog).  It is a detailed 30 page submission.

I should add that I am a fan of all Rosemary’s writings and publications.  They are always well argued and fully referenced; the DCMS would be unwise to ignore her views.

In general, Rosemary thinks it was an error for the Consultation not to deal with the impact of the proposals on the UK’s Adequacy Determination from the European Commission.  She also agrees with the ICO that several proposals are unclear as to what is meant.

So if both the ICO and Rosemary are stating that the proposals lack clarity, the question must be asked as to how can the DCMS hold a meaningful public consultation?

Anyway, you don’t need me to prattle on;  so to whet your appetite, there follows several quotes from her text.

1. “The consultation includes a number of helpful and practical proposals. However the wide scope means that it can be difficult to tease out the useful and/or significant elements. In some cases the impact of the proposals is not clear and in some places it is difficult to work out how different aspects of the proposals fit together”.
2. “In addition there are some regrettable omissions…. The most striking omission is the absence of any assessment of the proposals on the UK’s adequacy finding from the EU. , it may mean that many who read the consultation paper will assume that none of these proposals will have a potential impact on adequacy.”
3. “It seems that an assumption of legitimate interests is reasonable (a bit like the old registration or notification exemptions – processing widely accepted as low risk) however the categories proposed need to be re-examined. Overall the better approach may be to add a presumption of legitimacy which could be rebutted in specific cases, particularly in the case of internal business purposes”.
4. “In relation to cookies this proposal seems nugatory and adds nothing to the impact of PECR and should be removed” [for the reasons set out in Rosemary’s evidence]…“...It is regrettable that cookies have been included in this section on legitimate interests without reference to the section of the paper covering PECR related issues, including the placing of cookies”.
5. “The proposals to remove the DPO role, DPIAs and central records of processing; the proposed changes to the position and independence of the ICO; the potential changes to the compatibility regime; the potential removal of the Article 22 rights; the proposal to diminish the test of fairness in relation to AI, and the cookie proposals all raise potentially serious problems with the adequacy assessment”
6. “There seems no point in removing the role of the DPO which is now well-understood and utilized, and replacing it by a “suitable individual responsible for the privacy management programme”.
7. “As a result the failure to evaluate and discuss the adequacy risks attached to different parts of the proposed changes means an essential element of the relevant policy consideration is missing in every aspect of the proposal”.
8. “Secondly there is little clarity over which parts of the proposals would impact on the law enforcement and security provisions in the Data Protection Act 2018 (DPA 2018)”.
9. One proposal that a new legal basis for processing is not required for compatible processing (justified in terms of an “odd sentence in Recital 50”) “….is fatally flawed”.  It would undermine the UK regime by importing an unjustified liberty to carry out new processing without proper assessment and ensuring the application of adequate grounds for processing in the particular case.  As the grounds for processing are a fundamental concept in the GDPR this would amount to a significant undermining of the UK regime”.
10. “These proposals are extremely confusing [relating to  when further processing may occur when the original lawful ground was consent].  It is difficult to have any real sense of what is being proposed.
11. “The conflation of research with non-research further processing is misleading. The proposals need to be clearly re-drafted and set out concisely what is being proposed in each case. In particular the cases where there is a statutory presumption of compatibility need to be distinguished from those where there is no such presumption, therefore re-use for research purposes should be clearly distinguished and it made clear the second section does not cover re-use for research”.
12. “Further, the use of the broad, generic term “public interest” needs to be addressed – there is no generic test of public interest and it needs to be considered and applied in specific contexts; re-consent or consent situations should be distinguished from those where there is no consent or no other ground”.
13. “It cannot be asserted that there is always a public interest in all research, or that, to the extent there is a public interest, it is always of the same nature or importance. Research into the hair colour of women who buy stiletto heels in not on a par with research into the causes of diabetes. Accordingly there is no justification for removing the rigour of the law from all research and a more appropriate and balanced option needs to be considered”.
14. “Irrespective of the purpose of the processing or the purpose of collection, it [the Consultation Document] recommends permitting the re-use of personal data for a new purpose, including an incompatible purpose, where the processing safeguards an important public interest”.
15. “ Irrationally (and arguably giving a misleading impression) this also covers where the data subject has “reconsented” to the new purpose which is a wholly different fact set and should be clearly differentiated. In such a case the controller can rely on the consent and the issue of compatibility does not arise”.

Concluding comments

Sometimes, I wonder who actually is driving some of the changes proposed by the DCMS; my nightmare is that it is the same people who wrote that awful TIGRR report (see references).

My blogs before Xmas provide ample evidence of a relatively low standard of data protection knowledge that is inherent in some of the DCMS justifications for its proposals (e.g. especially around consent, incompatibility, research and accountability).

In addition, I think the DCMS proposals:

• put the ICO’s independence at risk.
• in relation to transfer from the UK are far too loose and will be unacceptable in the EU.
• for a privacy management programme to replace accountability obligations is a recipe for inconsistent data protection management on the part of UK controllers.
• are not supported by evidence; that is why the DCMS Consultation asks for evidence.

It is strange that the Government wants to attract high tech industry to the UK whose customers are likely to include many EU controllers; such customers will expect that AI services and software products, produced in the UK, to satisfy the EU_GDPR requirements.

The fact that such products and services are produced in a country that has low data protection standards, as outlined by the DCMS proposals, does not strike me immediately as being a strong USP.

Hence losing that Adequacy Determination is an important factor;  Rosemary is absolutely correct to point out that the absence of Adequacy discussion in the DCMS Consultation was a major mistake.

Finally, given the political difficulties of the Prime Minister is in with his own Party, there is a real risk that the GDPR (and the proposed changes to the Human Rights Regime) will be red-meat to be thrown to the right wing of the Conservative Party (e.g. the TIGRR brigade) as an example of the UK “taking back control”.

In practice, the real threat is to UK data subjects losing control and the deliberate undermining of their privacy protection.

Data Protection Courses (Winter 2022)

Because of continued COVID uncertainty, fuel crisis, or the results at Barnsley FC the course can be attended in person, or via Zoom, or as a mixture if you something untoward happens: it's up to you.

• The Data Protection Practitioner Course is in London, and starts Monday, January 25-27; February 8-10 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing info@amberhawk.com
• The Data Protection Foundation Course is in London, and starts Tuesday, February 1st to 3rd (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing info@amberhawk.com

References

Load a copy of Rosemary’s personal evidence here: Download RJ personal view on DCMS Data proposals

The blog “TIGRR, Eeyore and Pooh Bear decide to destroy the GDPR”: https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html

“Data: a new direction” - Amberhawk's response to the DCMS Consultation

This blog comprises the response of Amberhawk Training Limited to the DCMS Consultation document “Data: a new direction”  (the “Consultation”).  Amberhawk is a training company established in 2000; its Directors have over 40 years’ experience in training those who are responsible for data protection in an organisation.

The response is over 15,000 words and takes the form of 7 blogs, each of which are about 2,300 words long.  They were published during the consultation period which ends tonight and have been updated as our understanding of the proposed reforms have improved.  The links to these blogs at the end of this document.

In summary, the blogs cover the following topics.

1. How the data subjects’ privacy protection is much diminished by proposals to change UK_GDPR. This text explains how the DCMS proposals significantly impact on the protection of data subjects to such an extent that the level of privacy protection for data subjects is about that found in the DPA1984.  The Ministerial promise of “maintaining the UK’s world-leading data protection standards” for data subjects is therefore dishonest and lacks credibility.
2. Government propose to reduce DP accountability requirements to OECD standards. The Consultation makes several mistakes and omissions when explaining its DPO proposals.   It follows that its arguments are misleading and its conclusions at this part of the Consultation are suspect. The proposals for a privacy management program do not comprise a recipe for improved data protection management; it is a recipe for inconsistent compliance (as in the DPA1984 and DPA1998) as many controllers will go off on a frolic of their own when deciding how their own programme is implemented and resourced.  It appears that the objective is to align UK DP law with OECD standards; DCMS should be more honest with respect to that objective.
3. Ministers want to pull the strings and rein-in the ICO’s independence. The blog explains why the DCMS proposals ensure that the ICO role is no longer independent of Government and explains how the Secretary of State is in control of key aspects that would identify the ICO as being independent.  If DCMS’s objective is to lose the adequacy agreement with the European Union, implementing these provisions would serve as a good way to achieve this objective.
4. Data Protection accountability suffers as a result of an unconvincing attempt to reduce red-tape. This blog discusses the proposal: to remove the obligation to maintain a register of processing activities (ROPA; A.30); to remove the requirement to undertake DPIAs (A.35 and A.36); and to reduce the circumstances when a data breach is reported to the ICO (A.33).   These will be replaced by far looser requirements that form part of a controller’s privacy management programme. Additionally, I suspect the DCMS author of this part of the Consultation does not understand the role of the ROPA nor the obvious solution to the over reporting of data breaches.  Mention of the processor’s ROPA is missing? Was this deliberate? Is it being retained? Or abolished?  This is an example of the problems associated with the Consultation document.
5. Government propose to tip the scales in the controller’s legitimate interests. As far as I can see, this proposal is based on a false data protection analysis and illustrated by examples that show that no change is needed. Additionally, if the controller’s legitimate interests always prevails, it follows that the data subject’s right to object to the processing and other related rights are also negated.  The impact of these negated rights is missing from the DCMS’s incomplete analysis. In short, if enacted, this proposal will take away rights of those data subjects who could face substantial distress by the processing of their personal data.
6. UK plans for incompatible processing undermines data protection for individuals. The proposals misses out any analysis of A.23(1) and in particular A.23(1)(e);  this undermines the proposals as the text becomes ambiguous as to what is intended.  As far as I can guess the objective is to break the link in A.6(4) between “public interest” and the exemptions in A.23(1) so that Ministers can declare what is in the public interest and negate the compatibility assessment.  Because of the lack of clarity, the outcome of this part of the consultation is suspect.  The analysis shows that proposal to change the law around incompatibility has a knock on effect that negates most of the Principles in A.5, provides a lawful basis for the “incompatible” processing, can involve the processing of special category of personal data and diminish the rights of data subjects.
7. Government’s UK_GDPR proposals for research are unethical and unsafe. The blog shows the proposals for the processing of personal data for research purposes; they are unreliable, untrustworthy and unethical.  For instance, the proposals are so “flexible” they can allow for secret research, using of special category of personal data or criminal offence personal data, similar to the “research” that gave rise to the Cambridge Analytica scandal.

Concluding comments

In summary, the DCMS proposals for changing the UK_GDPR do not impress; there are too many mistakes and errors and the conclusions do not withstand intellectual rigour.  There is no evidence for the changes that the Government want to make and the invocation for responders to provide the evidence does not fill one with confidence.

One also gets the impression that the proposals for change will be pushed through Parliament using Ministerial Powers with little regard to the consequences.

What really irritates is the repeated statements by the DCMS that the proposals comprise “world class data protection” when they palpable do not. A little more honesty from Government would be better (e.g. we want to lower data protection standards to those of our new trading parties).

Links to the blogs

How the data subjects’ privacy protection is much diminished by proposals to change UK_GDPR; https://amberhawk.typepad.com/amberhawk/2021/11/how-privacy-protection-is-much-diminished-by-proposals-to-change-the-uk_gdpr.html

Government propose to reduce DP accountability requirements to OECD standards; https://amberhawk.typepad.com/amberhawk/2021/10/government-propose-to-reduce-dp-accountability-requirements-to-oecd-standards.html

Ministers want to pull the strings and rein-in the ICO’s independence; https://amberhawk.typepad.com/amberhawk/2021/11/ministers-want-to-pull-the-strings-and-rein-in-the-icos-independence.html

Data Protection accountability suffers as a result of an unconvincing attempt to reduce red-tape.; https://amberhawk.typepad.com/amberhawk/2021/11/data-protection-accountability-suffers-as-a-result-of-an-unconvincing-attempt-to-reduce-red-tape.html

Government propose to tip the scales in the controller’s legitimate interests; https://amberhawk.typepad.com/amberhawk/2021/10/government-propose-to-tip-the-scales-in-the-controllers-legitimate-interests.html

UK plans for incompatible processing undermines data protection for individuals; https://amberhawk.typepad.com/amberhawk/2021/10/proposals-for-incompatible-processing-undermine-protection-for-data-subjects.html

Government’s UK_GDPR proposals for research are unethical and unsafe; https://amberhawk.typepad.com/amberhawk/2021/09/governments-uk_gdpr-proposals-for-research-are-unethical-and-unsafe.html

Data Protection Courses (New Year: 2022)

Because of continued COVID double jab / booster uncertainty, the fuel crisis, or the results at Barnsley FC the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection Foundation Course is in London, and starts Tuesday, February 1^st to 3^rd (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing info@amberhawk.com
• The next Data Protection Practitioner Course is in London, and starts Tuesday, January 25 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing info@amberhawk.com

How privacy protection is much diminished by proposals to change the UK_GDPR

The DCMS Consultation document “Data: a new direction”  (the “Consultation”) proposes to tip the balance between the interests of controllers and the interests of data subject in favour of the controller.  This blog looks at the proposals, not in the context of how beneficial they are for controllers, but rather in the context of how they weaken the privacy protection afforded to data subjects.

The weakening provisions being mooted include:

• Introducing a fee arrangement for subject access which has a chilling effect on the subject access right. A £10 fee as per the DPA1998, for instance, is likely to disenfranchise the poor from the right of access;  having lost £20 in universal credit, post COVID, would impoverished data subjects pay £10 for subject access?  It is difficult to fathom how such a proposed fee arrangement forms part of the Government’s “levelling up” agenda.
• A fee arrangement based on FOI Appropriate Limit is likely to apply to complex requests (e.g. where there is personal data relating to more than one individual as is common in education, health and social work). Many of these complex requests risk being refused on the grounds that they are over the equivalent of the FOI Appropriate Limit.
• Effectively removing the A.22 right not to be profiled. As some profiling is to be deemed to be in the legitimate interests of controllers and some profiling deemed to be necessary for public tasks, the original right not to be profiled in A.22 thus only remains for “vital interests” processing.
• Increasing the prospect of unwanted marketing telephone calls unnecessarily. The proposal is for the “soft opt-in” (an “opt-out” in practice) to be extended to all forms of electronic marketing when the unsolicited marketing rules by telephone already allow for the use of an “opt-out” – oops I mean “soft opt-in”.
• Controllers do not work to a unified privacy standard as set out in the UK_GDPR; instead they work to their own data protection standards as set out in their own “privacy management program” (if controllers ever get round to establishing such a program). Unlike the Consultation,  I cannot see how letting controllers “do their own thing” (as per DPA1984 and DPA1998) allows for any consistency in the level of data subject protection.
• The ICO can no longer rely on the controller and processor maintaining records that demonstrates compliance with A.24-A.39 (e.g. appointment of DPO, DPIA, Data Breach, Security, Contracts) much to the detriment of data subjects. Even the ICO’s response to the Consultation states that “Keeping good records is a key element of good privacy management and high standards of privacy”.
• Reducing the ability of the ICO to enforce issues which are very important to a specific data subject but which are not common to many data subjects. The ICO is expected to focus on the important issues that impact on a large number of data subjects and not on issues that may seriously impact a single data subject.
• The change of focus mentioned in the previous paragraph (i.e. consideration of issues relevant to a large set of data subjects) leads to the circumstances when there is fettering of the ICO’s independent course of action. This arises by requiring the ICO to consider matters that have nothing to do with data protection (e.g. the ICO’s duty to consider economic or innovation issues or the public interest).
• The ICO can decide how, to what extent, or whether to investigate a complaint; the ICO cannot be challenged on, for example, a decision to close a case because it is too difficult for the ICO for whatever reason. This prospect could leave a data subject who has a complex case out in the cold.
• Requiring the data subject to attempt to resolve issues with the controller before complaining to the ICO. This can be uncontroversial in many circumstances.  However, the Consultation’s proposals wholly ignore the circumstances when such contact with the controller could cause detriment to the data subject (e.g. in cases of zero hours contracts, how many such contracts will a controller give a complaining data subject?).
• Extending the exemptions in A.49 so that transfers of personal data can be repetitive (and not occasional as of present). This means that personal data can be transferred to any other country on a bulk basis without reference to the data subjects’ wishes or interests or consideration whether the bulk personal data are safe (e.g. from the authorities) in any destination country.
• Allowing the Secretary of State to assign adequacy to groups of countries (e.g. all countries that implement Convention No. 108 are adequate). This means that there is no individual assessment of the level of protection on a case-by-case basis (e.g. there are 55 countries signed up to this Convention).  The Consultation’s pledge to keep each country’s DP law under continual review is simply not credible given that there are more than 100 countries with DP laws.
• The ICO in her response effectively equates the Consultation’s transfer proposals to the data protection equivalent of “Pie in the Sky when you Die”. She states that there are so many unanswered questions (which means the case of change has not been made):

“While we recognise that these proposals are still in development more detail is needed for respondents to fully understand how a risk-based  approach would work in practice. It would also be helpful to understand more detail about the proposals for future adequacy decisions to “take into account the different legal and cultural traditions which inform how other countries achieve high standards of data protection”. We look forward to seeing more detail about how these changes would work in practice” (para 120).

• Extending the processing of a data subject’s special category of personal data by specifying certain processing to be in the public interest or legitimate interests of the controller. Such processing could well occur without reference to the data subject’s wishes or interests (who is left bereft of options to protect their interests).
• Allowing for wider data sharing across the public sector and to include data sharing with private sector bodies without reference to the data subject’s wishes or interests (who is also left bereft of options to protect their interests).

Commentary

The Consultation provides no evidence for most of the legislative changes it claims that are needed.  That is why the Consultation frequently ask its consultees to provide the necessary evidence to substantiate the Government’s proposed change.   This is governance at its very worst;  a classic example of making detailed legislative changes before the existence of evidence for the need for such changes.

Given the sometimes basic errors and omissions in the Consultation’s data protection analysis (see references for some examples), one also wonders about the quality such received evidence.

That is why the Consultation asks respondents to answer the same question many times.  Roughly speaking, this question goes: “We know that controllers find the following data protection elements a right pain in the arse; please explain your answer, and provide supporting evidence where possible”.

The Consultation is largely drafted from a position where the controller becomes entitled to process the data subject’s personal data (i.e. entitled to use, disclose, retain or transfer the personal data) without consideration of how the data subject’s wishes or interests are protected (usually they will not be protected by the proposals in the Consultation).

If data subjects were to complain to the ICO,  they would find that the ICO is fettered by consideration of matters not related to data protection (e.g. a duty to consider the economy, innovation or the public interest).  There is simply no commensurate increase in the ways data subjects could protect their own interests.

In addition, there is very little the data subject can do if the ICO makes a mistaken decision.  Whereas controllers can appeal against the enforcement actions of the ICO, there is no comparable proposal that allows for an appeal for data subjects to obtain a review of the ICO’s decision.  Given the weakening of the ICO’s powers (as described above), the risk is that such mistaken decisions are set to increase.

Indeed, the Consultation makes Judicial Review of the ICO (itself a cumbersome and expensive procedure for data subjects) less likely.

In some circumstances, the proposal is for the substantial public interest or the legitimate interest of the controller to always prevail irrespective of the data subject’s wishes or interests.

Finally,  transparency of processing to the data subject is deemed to be sufficient protection; however if the data subject cannot do much with that transparency, then transparency is, of itself, of little value.

The result is rather similar to when someone is blackmailed; those blackmailed are fully informed as to what the blackmailer knows but can do very little about it.

Liz the Departed

All the proposed changes are occurring at the end of the watch of the departing Elizabeth Denham as ICO;   one wonders how much the changes to the UK’s data protection regime will become her legacy.  Apart from a mere handful of cases over her tenure, she has limited her enforcement action to unsolicited electronic marketing.  Picking on spammers is easy; picking on controllers who have disregarded other GDPR marketing norms (e.g. Adtech) is far more difficult.

One gets the impression that instead of taking the lead in tackling difficult data protection issues of concern, the ICO has preferred to jump on the coat-tails of privacy activists who crowdfund Judicial Review (e.g. facial recognition CCTV and Big Brother watch; Immigration exemption and the Open Rights Group).

Indeed, she has strenuously opposed the Information Rights Tribunal looking at specific issues of ICO inaction (e.g. her failure to address Adtech and the Open Rights Group).

In addition, her response to the Consultation contains too many statements of the kind: “We would also welcome more detail from Government about how these proposals would before we can comment ….”.

This approach is far too laid back.  Sadly the next ICO will only see the requested “more detail” when it is etched on the face of fresh legislation, likely to enacted by Ministerial edict, and not subject to any meaningful Parliamentary debate.

In conclusion, the Ministerial promise of “maintaining the UK’s world-leading data protection standards” is both dishonest and lacks credibility.   I expect the UK’s data protection regime to emerge at a reduced standard somewhere between the DPA1984 and DPA1998.

Data Protection Courses (New Year: 2022)

Because of continued COVID double jab / booster uncertainty, the fuel crisis, or the results at Barnsley FC the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens.  It's up to you.

• The next Data Protection Foundation Course is in London, and starts Tuesday, February 1^st to 3^rd (3 days); Full details on http://www.amberhawk.com/DPFoundation.asp or by emailing info@amberhawk.com
• The next Data Protection Practitioner Course is in London, and starts Tuesday, January 25 (6 days); Full details on amberhawk.com/StandardDP.asp or by emailing info@amberhawk.com

References

Please feel free to use of previous blogs when responding to the Consultation.

Government propose to reduce DP accountability requirements to OECD standards; https://amberhawk.typepad.com/amberhawk/2021/10/government-propose-to-reduce-dp-accountability-requirements-to-oecd-standards.html

Ministers want to pull the strings and rein-in the ICO’s independence; https://amberhawk.typepad.com/amberhawk/2021/11/ministers-want-to-pull-the-strings-and-rein-in-the-icos-independence.html

Data Protection accountability suffers as a result of an unconvincing attempt to reduce red-tape.; https://amberhawk.typepad.com/amberhawk/2021/11/data-protection-accountability-suffers-as-a-result-of-an-unconvincing-attempt-to-reduce-red-tape.html

Government propose to tip the scales in the controller’s legitimate interests; https://amberhawk.typepad.com/amberhawk/2021/10/government-propose-to-tip-the-scales-in-the-controllers-legitimate-interests.html

UK plans for incompatible processing undermines data protection for individuals; https://amberhawk.typepad.com/amberhawk/2021/10/proposals-for-incompatible-processing-undermine-protection-for-data-subjects.html

Government’s UK_GDPR proposals for research are unethical and unsafe; https://amberhawk.typepad.com/amberhawk/2021/09/governments-uk_gdpr-proposals-for-research-are-unethical-and-unsafe.html