Hawktalk

Data Bill makes any data sharing with any public sector body lawful

This blog considers how the Data (Use and Access) Bill (the “Bill”) impacts on the lawful bases used in the context of voluntary data sharing with public bodies.

In summary, the Bill creates an infrastructure of Ministerial powers that ensures voluntary data sharing to the public sector has a lawful basis;  that such data sharing is not incompatible with the purpose of obtaining, and that such data sharing is, in practice, exempt from the right to object.

These powers have to be combined with the ability of Ministers in Article 23(1)(e) to specify new exemptions that can negate other data subject right on the grounds of “general public interest”. (This will be the subject of my next blog).

By creating a comprehensive gateway for voluntary disclosures to the public sector, the Bill also has the effect of undermining the role of Parliament in determining the conditions under which an organisation is obliged to provide personal data by law.

These Ministerial powers have been criticised by the House of Lords Delegated Powers and Regulatory Reform Committee (see references).  It recommends that the powers should be removed from the Bill, because they are “inappropriate” and the justification for them, provided by Government, is “unconvincing”.

For example, in relation to the removal of the power to negate Purpose Limitation Principle the Committee concluded: “Given the fundamental nature of that principle and the fact that we found the Department’s reasons for needing the power unconvincing, we took the view in our report that the delegated power was inappropriate” (and recommended its removal).

I would add that the first paragraph of Annex 1 (which legitimises disclosures to any public sector body) should also be removed from the Bill.  This blog explains why.

Recognised Legitimate Interests

The Government’s justification for the change in data protection  law is seductively simple; it goes like this.

Data protection is hard for many controllers, especially when faced with a one-off request for disclosure of personal data from any law enforcement agency, an agency that protects vulnerable children and adults, a national security agency, a defence agency, and for public security purposes or in emergency situations (e.g. floods).

In these circumstances, so the Government claim, many organisations hesitate and do not know whether to disclose personal data or not.

Hence the Bill will clarify the law by providing a list of Recognised Legitimate Interests, so controllers can disclose without performing any balancing test of the competing interests.  This is because Recognised Legitimate Interests have pre-determined the balance of interests is in favour of disclosure of personal data.

Hence, it is unlikely that there will be any overriding interests on the part of the data subject and that, as a result, the right to object to disclosure (and perhaps other subsequent processing that depends on that disclosure) is effectively extinguished.

Just in case the Government needs flexibility, it has provided a Ministerial power to make variations or additions to these Recognised Legitimate Interests.

How does disclosure work now?

So, suppose you get a request from a Local Authority Social Work Department:  “We are worried about Child X; can we have a copy of your personal data that relates to Child X?”. You go through some security questions to ensure it’s not a hoax (e.g. check who is asking) and then you can move on to the decision whether to disclose or not.

In order to make this decision, you will probably ask for information about the circumstances pertaining to the disclosure (e.g. “what are the worries”; “what do you want from us”; “how would our personal data help you” etc).  Normally you will need this type of information before you decide whether to disclose(or not).

If the request is genuine and the concerns about Child X are real, you have a choice.  Protect Child X or protect the putative child abuser’s privacy. So which one is it?

Not a difficult choice is it?

Then you square the disclosure of personal data with the data protection requirements.  Currently such a disclosure would be necessary “in the legitimate interest of a Third Party” (the Social Work Department) and the questions you have asked (e.g. why would our personal data help etc) create the balancing test of whether there exists overriding interests on the part of the data subject in not disclosing.

How does disclosure work under the Bill?

Now we come to the Bill and, for example, how it proposes to deal with the same disclosure protecting vulnerable children.  Remember the decision in favour of disclosure is baked in.

In response to the question: “we are worried about Child X; can we have a copy of your personal data concerning Child X?”, are you going to respond as follows:

“We have checked you are a Social Work Department and a public body with responsibility for child protection. You have asked for these personal data because they are needed to protect Child X.  We are NOT interested in any other details, so here is your personal data.”

Similar with an emergency:

“We know you are a public body tasked with responding to an emergency. You have asked for certain personal data that you state are needed.  We are NOT interested in what the emergency is, so here is your personal data”.

I suspect the answer is “NO”.

In practice, I also suspect you would still ask the questions of the kind: “what is the emergency or worries”; “what do you want from us”, and “why would our personal data help you” etc to decide whether or not to disclose.

In the rare case of a decision not to disclose, the fact that the lawful basis is a Recognised Legitimate Interest would not change that decision.  This is because the data protection considerations come after the details that inform the decision at to whether (or not) to disclose personal data.

In other words, there is very little will change in relation to the Recognised Legitimate Interests described above.  Controllers will still assess the situation prior to disclosure and the data protection elements are a  secondary consideration, and only relevant in support of the decision to disclose personal data.

This is why I have concluded all the Recognised Legitimate Interests are unnecessary in DP terms (except for one which we will come to next).   I am quite relaxed about the Recognised Legitimate Interests in the Bill (except for the one which we will come to next) because nothing has really changed.

Real reason for Recognised Legitimate Interests

The Recognised Legitimate Interest  the Government has wanted for some time has been piggy backed on all the others mentioned above.  It reads as follows:

“the processing is necessary for the purposes of making a disclosure of personal data to another person in response to a request from the other person, and

the request states that the other person needs the personal data for the purposes of carrying out processing … [for its public task or in its official authority under UK law].  The actual words used are “…described in Article 6(1)(e) that has a legal basis that satisfies Article 6(3)”.

This means any public body can ask any other controller (usually private sector) to disclose any personal data because they are needed for its functions.

And what is the purpose of this disclosure?  Because other Recognised Legitimate Interests do not apply, this purpose has nothing to do with law enforcement, protecting the vulnerable, national security, defence, public security or emergencies.

In summary, any old purpose will suffice so long as:

(a) it does not fall within the list in the last paragraph and

(b) the controller can claim that it is necessary for the functions of the public body asking for personal data.

And who enforces claims that the data subject has been wronged? Well it’s the ICO (who current policy is not to do much enforcement against the public sector).

In summary, the provision allows any public body to obtain any personal data from anybody else and places responsibility on the ICO to police every voluntary disclosure to the public sector via this provision.

Anybody should be able to see that this is not a viable system of regulation.

As a result, the provision risks degrading into an unregulated,  “free for all”,  voluntary data exchange with the public sector (which, of course, certainly since the ID Card Act debates of 2005, successive Governments have always wanted).

Undermining of the role of Parliament

Parliament has given, for example, HMRC powers to demand personal data; these have been debated and contested.  By contrast, this new voluntary approach negates the need for future debate over statutory powers because, in our example,  HMRC can merely ask via the new voluntary disclosure route.

To explain how this could work, suppose you get the following request from HMRC:

“We are investigating certain matters relating to taxation; can we have a copy of all  your personal data relating to the following list of your employees.  Such a disclosure of personal data would be lawful as it is a Recognised Legitimate Interest”.

So suppose you respond with:

“It would help us to decide whether to disclose if you could give us the further details: […followed by a list of questions pertaining to the disclosure].

Now you get the response:

“We do not want to answer your questions because it could have an impact on our inquiries. We have given you a clear statement that this disclosure is lawful and necessary for our public task. Because the disclosure is a Recognised Legitimate Interest, no reason has to be provided to you.  We confirm that there  is no impediment to your disclosure of personal data to us.”.

So over to you.  Would you disclose?  Is this an invitation to disclose you can’t refuse.

Now I am sure many brave data protection staff would say “no” but the decision to disclose does not depend on the bravado of DPOs.  I am fairly confident that many senior managers will conclude: “We don’t want to upset HMRC,  for the sake of a quiet life and good relations we will disclose”.

In this way, the statutory route for disclosure gives way to the new, possibly  “voluntary” route, where most controllers will “comply with the request”, albeit with gritted teeth.  HMRC’s statutory powers to demand personal data are unused (when Parliament expects them to be used) and held in reserve.

This explains why the first Recognised Legitimate Interest should be removed from the Bill.

Winter Data Protection Courses

Amberhawk is holding our first session on the changes to the UK’s data protection regime arising from the Data (Use and Access) Bill, by Zoom, on Tuesday January 28^th 2025: (10.00am-4.30pm;  £275+VAT).

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course: London on January 20-24 (5 days: Monday to Friday: 9.30am to 5.30pm) and on March 17 to March 21 (same timings).
• Data Protection FOUNDATION Course: London on March 11-13 (Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].

References

House of Lords Delegated Powers and Regulatory Reform Committee, 9th Report of Session 2024–25, HL Paper 49 (28 November 2024).

“Legitimate Interests” for AI Training? Remember the common law of confidence.

There is a current debate as to whether “legitimate interests” can be reliably used as a lawful basis by a controller when using personal data to train/test AI algorithms/systems and when AI systems are deployed.

This blog explains how the common law of confidence and two recent CJEU decisions work together to challenge this assumption.

The first half of the blog explains why “legitimate interests” can work as a lawful basis for AI training/testing in some instances.  In the second half, I explain why, because of confidentiality constraints, “legitimate interests” does not work in general.

What is surprising is that reference to the common law of confidence is absent from the ICO’s guidance on AI.

When does legitimate interest work

Suppose a controller wants to explore the use of AI to make “efficiency savings” (e.g. a euphemism for reducing staff numbers) or to “enhance customer experience” (e.g. making it harder for a customer with a difficult problem to talk to a human).

Suppose further, nothing has changed in the controller’s processing environment except the desire to process its existing collection of personal data in order to explore the potential use of AI (i.e. “proof of concept” processing).

There are four key processing assumptions I am making in during this proof of concept phase; these are:

• the controller ensures that “there is no impact on any data subject of any kind whatsoever”;
• there are no transfers outside the UK and established security/accountability standards are maintained throughout the testing;
• no special category of personal data or criminal offence personal data are processed (as this would involve speculating about the Article.9 (UK_GDPR) or Schedule.1 (DPA2018) requirements); and
• personal data relating to those who have objected to marketing are excluded, if direct marketing is a main objective of the deployment phase of AI.

The CJEU has determined (twice) that a commercial interest of the controller is indeed a legitimate interest (see references). This means that the controller can rely on the legitimate interests lawful basis to assess whether it can improve services and profitability using AI.  In DP terms the “processing is necessary for the purposes of the legitimate interests pursued by the controller” (the first part of the balancing test required by A.6(1)(f)).

At the same time, there is little risk that “such interests are overridden by the interests … of the data subject...” because there is no impact on any data subject.  Put simply, the counter-balancing risk of an overriding interest on the part of the data subject almost vanishes because of the application of the first bullet-point assumption above.

Second there is no need to do a DPIA (A.35).  A DPIA is only needed when the processing “is likely to result in a high risk to the rights and freedoms of natural persons”.   However, as the controller has determined that its own AI proof of concept processing has no impact on the data subject, there is no high risk to any data subject.  A DPIA is unnecessary.

Third, there is no need to worry about the automated decision making provisions (A.22).  These apply when “a decision based solely on automated processing, including profiling… produces legal effects concerning him or her or similarly significantly affects him or her”.  There again, the controller has determined at the outset the proof of concept processing presents no legal/significant effects on any data subject. So no worries then.

Fourth, there are no incompatibility issues (as per A.6(4) and A.5(1)(b)) as the processing for a further purpose is very similar to the purpose of obtaining (e.g. the exploration of how existing services, known to the data subject can be improved by processing personal data using AI techniques).

This is because there is a strong “link between the purposes for which the personal data have been collected and the purposes of the intended further processing” (the test in A.6(4)(a)). Additionally there is no change in “the relationship between data subjects and controller” (test in A.6(4)(b)),  and “the possible consequences of the intended further processing for data subjects” are negated (test in A.6(4)(d)) because there is no impact on any data subject.

Fifth, there should be no problems concerning the data subject’s right to object (A.21).  This arises because the data subject has to present “grounds in relation to his or her particular situation”, and these grounds are going to be difficult to establish if the processing has no impact on any data subject.

Finally, the Transparency/Privacy Notice might need adjusting, but not if it already says something like “we additionally use your personal data to develop or improve our services to you”.

The above analysis works for the proof of concept phase when using ordinary personal data which, as we shall see, are not subject to an obligation of confidence.

Obviously the provisions that are ignored during the testing phase must be considered before the processing moves beyond the proof of concept phase.  Indeed, there would be no point proceeding with any proof of concept processing, if there were to be no lawful basis for the deployment phase itself.

The common law of confidence

Suppose you tell me something in confidence. What are you expecting me to do after you have told me?  Can I use or disclose this confidential information for my benefit without your consent?

In general, a duty of confidence can arise either expressly or by implication if:

• the content of the information possesses the “essence” of confidentiality (e.g. something personal or sensitive for whatever reason), and
• the information has been collected in circumstances where confidentiality can be expected (e.g. in a closed room where you and your GP/solicitor discuss your medical/legal options).

Not all the information imparted is subject to an obligation of confidence, and in general, there needs to be a case-by-case analysis of the specific circumstances surrounding the transfer of information.  Confidential details can easily lose any claim to confidentiality (e.g. if overheard as part of a noisy argument or displayed on a laptop screen when travelling on a crowded train).

In summary, your financial personal data are usually confidential, but not if financial details have been made public on Facebook.  Your medical record is confidential, but your name and address contained in that record might not be confidential.  By contrast, names and addresses of those in witness protection are obviously confidential.

In general, a duty of confidence often arises with the following personal data: financial affairs, tax, benefits, means testing, grants, health, social work, education and policing.  Employee personal data are often confidential (e.g. Occupational Health or disciplinary mechanisms) but your pay grade is unlikely to be confidential (as pay grades are made public in job adverts).

Indeed, special category of personal data and criminal offence personal data are often good examples of confidential personal data.

A breach of confidence

A breach of confidence can arise by a use or disclosure of confidential details for another purpose.  “Disclosure” is widely recognised as a cause of a breach of confidence (e.g. a GP who discusses your medical records in the pub), however much case law relates to “use”.

This historic use case-law often related to the protection of Intellectual Property.  For example, suppose you are a Victorian widget manufacturer (circa 1880).  I come to you with a “super-widget” design and once you have satisfied all my orders, you begin producing a “super-duper widget”, based on my design, in competition with me.  Perhaps you can improve my design – who knows.

The point is that you could only have produced your “super-duper widget” by using the confidential design for my super-widget.  You have not disclosed any confidential information you received, rather you used that information for your benefit instead.

Coming back to data protection, “use” and “disclosure” are “processing” operations.  Hence to use or disclose confidential personal data for other purposes can involve a breach of confidence.

Of course, confidentiality is not an absolute. There are several legal requirements (e.g. Court Order, statutory demand) or public interest reasons (e.g. law enforcement request, protecting children or the vulnerable) where one can lawfully set aside an obligation of confidence in the absence of consent.

However, if these two do not apply, then the only justification for setting aside an obligation of confidence is when the data subject has consented to the further use or disclosure.

This includes using existing confidential personal data for AI training purposes  (and indeed in any deployment phase).

Consequences (CJEU)

There are two decisions of the CJEU that support the above argument. CJEU case 621/22, which concluded that a controller can rely on the legitimate interests lawful basis for commercial reasons so long as the controller ”having regard to all the relevant circumstances, that the interests or fundamental freedoms and rights of those users [a reference to the interests of the data subject] do not override that legitimate interest of the controller”.

In my view, the interests of the data subject in maintaining his or her confidentiality are very likely to override the legitimate interests of the controller who sets confidentiality aside for its own commercial interests.

The relevant conclusion of CJEU case 621/22 added that whilst the legitimate interest pursued by that controller do not require “that such an interest be determined by law, it requires that the alleged legitimate interest be lawful”.

In my view this means that in the UK, the reference to a lawful legitimate interest includes the consideration of the application of the common law of confidence to that legitimate interest.

Concluding comment

It is likely to be difficult to rely on “legitimate interests” as the correct lawful basis if confidential personal data, already processed by a controller, are further used in AI proof of concept processing and in later deployment.

This is because it is usually in the overriding legitimate interest of the data subject to preserve his or her own confidentiality over the commercial interests of the controllers that happen to supply services to the data subject.

Confidentiality constraints, in my view, push one in the direction of consent as the correct lawful basis.

Winter Data Protection Courses

Amberhawk is holding our first session on the changes to the UK’s data protection regime arising from the Data (Use and Access) Bill, by Zoom, on Tuesday January 28^th 2025: (10.00am-4.30pm;  £275+VAT).

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course: London on January 20-24 (5 days: Monday to Friday: 9.30am to 5.30pm) and on March 17 to March 21 (same timings).
• Data Protection FOUNDATION Course: London on March 11-13 (Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].

References

CJEU Case C-252/21  (involving Facebook/Meta)

CJEU Case C‑621/22 (involving Koninklijke Nederlandse Lawn Tennisbond)

ICO’s lawfulness guidance on AI: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-do-we-ensure-lawfulness-in-ai/#purposes

What are the main features of the Data (Use and Access) Bill?

The blog concerns the content of the new  Data (Use and Access) Bill (DUAB) as published last week; it bears a strong relationship with the previous Data Protection and Digital Information (DPDI) Bills.  In fact, DUAB could easily have been named the DPDI (No 3) Bill.

The Bill itself is 138 Clauses, 16 Schedules and 251 pages; many of the provisions of DPDI re-appear in DUAB but with different Clause numbers. The Bill is a complex read as its data protection changes appear as amendments to existing legislation (i.e. one has to cross reference DUAB with the DPA2018 and the UK_GDPR to find out what is happening).

There are, in addition, three immediate political consequences with start of the Parliamentary processes in the House of Lords.

• First, it will be difficult for the official opposition to oppose DUAB since it contains many of the Conservative’s DPDI proposals. In other words, apart from the odd maverick intervention, the opposition to this Bill will not come from the two main political parties.
• Second, the Bill has started its Parliamentary life in the House of Lords. This, from the Government’s perspective, gets the awkward Parliamentary stages out of the way first and at a time when Peers and NGOs have not had much time to really understand the detail of the Bill’s proposals. The Commons passage is likely to be cursory given the Government’s majority in the Commons (as it was with the DPDI Bills).
• Third, if the Bill, after Second Reading in the House of Lords, is remitted to be considered under the Grand Committee procedure of the House of Lords, then voting on amendments to the Bill in Committee will not occur. This means that the Report stage will be the main area of voting contention, and where Government amendments to the Bill will surface for minimal debate. So expect Parliamentary scrutiny of the Bill’s content to be much diminished.

The blog is in three parts: what has been dropped from DPDI; what has been copied from DPDI; and what is new. If I have missed something out, please let me know.

Just so you know; I am reinstating our Zoom sessions on the major changes to the UK_GDPR and DPA2018, arising from DUAB, on January 28^th next year (Data Protection Day); details at end of the blog.

What was in DPDI but not in DUAB

DUAB does not contain any proposals:

• to weaken the definition of “personal data”.
• to change the status of Data Protection Officers (so Senior Responsible Individuals are gone).
• to change the requirements associated with the Record of Processing Activities maintained by a Controller or by a Processor.
• to change the circumstances when a DPIA has to be completed.
• to remove the requirement to have prior consultation with the ICO if there are high risks to data subjects that cannot be mitigated after a DPIA has been completed.
• to exclude subject access requests because they are vexatious.
• to encourage “electoral engagement” (I did not understand these in the DPDI anyhow).
• to specify the ICO’s strategic direction (but I suspect this can be done by other means).
• to permit the DWP access to bank records of benefit claimants including pensioners (expect this to appear in other Benefit related legislation).
• to abolish the Home Office’s Biometrics and Surveillance Camera Commissioner and merge the latter responsibility for CCTV with the ICO’s role.
• to scrap the requirement for a Representative in the UK if the controller is based outside the UK and offering services to those residing in the UK (i.e. the Representative in the UK is needed).

What’s in DUAB that was in DPDI

Like DPDI, the DUAB contains proposals that:

• Install a lawful basis of “recognised legitimate interests”, the most important one being the ability of any public body to ask another controller (usually in the private sector) for the disclosure of personal data it needs to deliver its functions. This applies to all public bodies and the Secretary of State (SoS) has powers to add to the “recognised legitimate interests” (but see next bullet). It is difficult to see how the right to object can prevail if the processing is made lawful in terms of a “recognised legitimate interest”.
• Specify that certain further processing purposes as compatible with the purpose of the obtaining of personal data; the SoS has powers to add to the list of  further “compatible” processing purposes.  These powers are unfettered; in extreme, it permits any future Government to define processing to be lawful, compatible (and provide for exemptions from rights courtesy of A.23(1)(e)).
• Introduce a lawful basis that allows USA law enforcement authorities to obtain telecommunications data for its law enforcement purposes, as per a reciprocal Agreement with the USA (the “Access to Electronic Data for the Purpose of Countering Serious Crime”) signed by Priti Patel when she was Home Secretary (October 2019). There is no information provided as to how this international Agreement has worked in practice or whether it is equally balanced.
• Limit the right not to subject to automated decision making processing or profiling to special category of personal data; this facilitates automated decision or profiling using normal personal data. Controllers are therefore free to make such automated decisions (e.g. to use AI techniques on the information scraped from the internet on applicants for employment).  This is “wild west” deregulation and is just asking for trouble.
• Clarify the time limits associated with the exercise of data subject rights (e.g. dealing with requests when the data subject’s original request does not identify the data subject).  The controller does not need to make excessive searches for the requested personal data; the search for personal data has to be "reasonable and proportionate ".
• Provide the data subject has the right to complain to the controller (i.e. to resolve an issue with the controller before complaining to the ICO); in summary this looks as if an FOI type internal review procedure will be needed.
• Overturn the 40 year old requirement (from DPA1984 days) to obtain consent for Third Party marketing as such marketing can be in the “legitimate interests” of that Third Party (i.e. an opt-out will do instead).
• Disapply transparency requirements when personal data are used for RAS purposes (Research, Archive and Statistical purposes) and to make any further RAS purpose always compatible with the processing so long as what is called “the appropriate safeguards” apply. This means that personal data can be exchanged secretly between a controller and any number of Third Parties for RAS purposes.  As with DPDI, one of safeguards does not impress: there is a requirement for the personal data processed not to cause “substantial damage” or “substantial distress”, as if causing “just short of substantial damage/distress” is acceptable.
• Permits the SoS to apply a “data protection test” when considering whether a country, part of a country, or a controller located in an country offers an adequate level of protection. These provisions increases the risk of divergence from European transfer standards if the European Commission and UK Government have different views on what “adequate” means.  Also I don’t understand how a country is not deemed adequate, but a controller, processor, or recipient located in that country is.
• Reinstates the complex proposals for transfers outside the UK for law enforcement; this includes the possibility of a law enforcement controller transferring personal data for law enforcement purposes by assessing the data protection test (instead of Secretary of State).
• Allow the SoS to designate that certain police personal data sets become subject to national security rules (i.e. the personal data subject to Part 3 of the DPA2018 can be designated as being subject to Part 4). The difference: the ICO can enforce Part 3, he can’t enforce Part 4 and the proposal has the effect of taking large volumes of personal data out of the UK's data protection regime.
• The ICO is abolished in favour of the Commission. The problem remains that the SoS appoints the most important members of the Commission and this ability to appoint has the potential to give the SoS undue influence over the Commission’s decision making processes (e.g. determining the policy towards enforcement of AI).
• The Commission still has to have regard for: the desirability of promoting innovation and competition; the importance of the prevention, investigation, detection and prosecution of criminal offences; and the need to safeguard national security.  In other words, these “regards” could fetter decisions to protect the privacy of data subjects.

What’s new

The new items I have identified are:

• Allowing the SoS to add items of special category of personal data so that the processing of newly define types of special category of personal data is prohibited (the example given is “neurodata”). These provisions cannot be used to modify the existing list of special category of personal data specified in A.9(1).
• Giving the Treasury powers over the use and disclosure of “business data” and “customer data” with the permission of the customer. If the “customer data” are also personal data, you may have to grapple with "recipient", "third party" and now “third party recipient” (so good luck with that one).  The objective is to establish “smart data” schemes, which allow the use the customer’s data to provide services for the customer or business as well as sharing or publication of contextual business data.

Concluding comment

There is no Keeling Schedule published for the DUAB at the moment; as with the DPDI Bill, the absence of a Keeling Schedule significantly hinders any prospect of an informed public debate about its content. Perhaps the ICO could publish one?

One cannot expect anyone to understand what the Government proposes if one has to cross reference the DPA2018; the UK_GDPR and this Bill at the relevant pages where amendments are proposed.  This is especially important as there appears to be major concerns (listed above).

I shall be returning to DUAB; so watch this space.

References

All DUAB documents (the Bill; explanatory memorandum etc) can be obtained from  https://bills.parliament.uk/bills/3825/publications

Winter Data Protection Courses

The first all-day Zoom workshop (10.00-4.30)  on the DATA (USE AND ACCESS) BILL will be held on Tuesday 28 January 2025  (£275+VAT per place).

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London on Monday, 18 Nov to Friday, 22 Nov and Monday, 20 Jan to Friday, 24 Jan 20 (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (December 8-10: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].

Upper Tribunal undermines data breach reporting under the UK_GDPR?

The Upper Tribunal (UT) appeal [DSG Retail Limited -v- ICO; see references] is important even though it relates to the DPA1998; the judgement has the potential to undermine the data breach reporting requirements of the UK_GDPR/DPA2018. This blog explains why this is the case, why legislative changes might prove to be necessary and, for good measure, provides details of two errors in the UT’s analysis.

The appeal concerns the meaning of “personal data” in the context of the security obligations of the DPA1998.  In summary, the ICO’s position was as follows:  DSG Retail had poor security and it reported the loss of 5.6 million credit card numbers and expiry dates.  As a result the ICO levied a large Monetary Penalty Notice, originally £500K but later reduced to £250K.

DSG’s successful counter argument was as follows: although the data lost by DSG Retail were personal data, the data were not personal data in the hands of the hackers. This was because data subjects could not be identified using “reasonable means” (the test described in Recital 26 of both Directive 95/46/EC and UK_GDPR).

Because there were no personal data in the hands of the hackers, there could be no “substantial damage or distress” caused by the data breach (the threshold for a Monetary Penalty Notice under the DPA1998). So it followed, that there should be no fine at all.

To cut to the chase, this latter view was preferred.

Why an impact on the UK_GDPR?

First, the UT stressed that the parties to this appeal accepted (i.e. the ICO accepted) “… that the relevant provisions of the ‘new’ regime under the Data Protection Act 2018 (DPA 2018) and the UK General Data Protection Regulation (UK GDPR) are materially the same”.

Second UT concluded that if there were to be a hacking incident involving a controller’s personal data and if the data exposed were not personal data in the hands of the hacker, then there would be unlikely to be a risk to data subjects.

It follows that in UK_GDPR terms, a personal data breach involving millions of credit card details (as per DSG Retail)  would not even be reportable under the UK_GDPR terms as a personal data breach, as that breach “is unlikely to result in a risk to the rights and freedoms of natural persons” (the threshold in A.33(2)) assuming the hackers do not know who has what credit card.

Yes, there has been a personal data breach on the part of the controller,  but there is no risk to data subjects as the hackers are unable to reidentify data subjects using reasonable means (see Recital 26, UK_GDPR).

It then follows that such a personal data breach is not reportable to the ICO and it also follows that the ICO will become ignorant of these serious types of mega breaches of security.

This is a consequence of the UT conclusion: “As the risk to be guarded against is the risk of data processing by third parties, the question of whether personal data is involved is to be judged from the perspective of the data that the third parties can access (rather than the entirety of the data held by the data controller)” (my emphasis of para 123).

Of course it could be claimed that the controller has breached other security provisions (e.g. the requirements in A.32).  But if the ICO is unaware of this kind of non-reportable security breach, it is difficult to see how these provisions are enforced.

This explains why a change in the law might be needed (e.g. for the controller to report to the ICO, large personal data breaches involving millions of records irrespective of the risks to data subjects).

The history relates to FOI

Readers steeped in freedom of information legislation (FOI) should recognise the dilemma of whether a third party requestor holds personal data or not.  It arises, for example,  when a FOI requestor asks for statistical data which are derived from personal data; for instance, “how many late abortions were there in the North of England last year”.

Now quite clearly in the hands of the NHS, the information is personal data as they know the identity of the patients having late abortions.  However, in the hands of the FOI requestor, the number of late abortions does not lead to the identification of these patients (using the “reasonable means” available to the requestor).

It then follows that a public authority (e.g. a NHS body) that received this type of FOI question would not be able to apply the FOI exemption associated with the protection of personal data, because in the hands of the requestor, the requested statistics do not lead to the identity of any data subject.

This is different to the FOI request of the form: “how many pupils, attending St. Mary’s School in Putney, were excluded last term?”.  In this case, the highlighting of the particular school, means it’s quite simple to go to the school in the morning and ask the Mums in the playground: “who has been excluded?”.

With this latter type of FOI request, the exemption to protect personal data does apply because in the hands of the requestor, the statistics can lead to the identification of data subjects using “reasonable means”.

As an aside, anyone who wants to explore the current case-law on this dilemma (which gave rise to the ICO’s idea of a “motivated intruder” test) this UT judgement is highly recommended.

So did the UT get it wrong (error 1?)

The first problem is that the UT, to arrive at its conclusions, over-relied on the “motivated intruder” test as formulated by the ICO.  This test permeates the UT’s discussions of “personal data”.

The judgement approvingly quotes the ICO’s motivated intruder” test:

“… assumes that the ‘motivated intruder’ is reasonably competent, has access to resources such as the internet, libraries, and all public documents, and would employ investigative techniques such as making enquiries of people who may have additional knowledge of the identity of the data subject or advertising for anyone with information to come forward.

The ‘motivated intruder’ is not assumed to have any specialist knowledge such as computer hacking skills, or to have access to specialist equipment or to resort to criminality such as burglary, to gain access to data that is kept securely.”  (my emphasis of para 14 of Judgement).

Now please answer the following YES/NO question: do you expect a hacker, who has used unlawful means to exfiltrate DSG’s data, to only use lawful means as a motivated intruder to complete the identification of data subjects?

Or do you think it reasonable to assume that our motivated intruder would also rely on unlawful means (e.g. to complete identification of data subjects by searching the dark web to see if anyone had, for example, lists of credit card numbers linked to credit card holders).  If you agree that this is a reasonable assumption, then the motivated intruder justification, as used by the UT, falls.

Another way of looking at it as follows: what is the point of gaining unlawful access to credit card numbers and expiry dates, if someone does not try and link the credit cards with the data subjects?

This is not the UT’s  conclusion.  It stated that the lower Tribunal (FTT) failed to consider:

“…the risks that shortcomings in security gave rise to, not simply by reference to what actually happened in the attack. This will involve consideration of what a motivated attacker could and could not have obtained data-wise from the DSG estate as a result of the [security] shortcomings. The FTT's decision has not addressed this”. (My emphasis of para 127).

So did the UT get it wrong (error 2?)

You will note that UT reasoning in para 127 (quoted immediately above) -relies on identification details to transform the hacked data into personal data, coming from other DSG Retail’s other personal data holdings and not from other sources (e.g. the dark web).  This assumption dominates the UT’s judgement.

For instance, the UT state that the lower Tribunal did not consider:

whether the data exfiltrated by the hacking attack “could be linked by a motivated attacker to other data put at risk by DSG that would identify the cardholders in question”  (para 173(ii)), or

whether “a motivated attacker could and could not have obtained data-wise from the DSG estate as a result of [security] shortcomings”. (para 127).

The UT’s  standpoint is generalised as follows:

“If a third party can only obtain anonymous data and the key to any pseudonymised material remains behind a [secure] wall [under DSG control] then then, accessing that vanilla data would not amount to an “unauthorised or unlawful processing of personal data”. (para 114). (The term “vanilla data” is used by the UT to describe anonymous data)

Hence the UT’s conclusion:

“Accordingly, the FTT’s decision involved a material error of law in deciding that there had been a contravention of the DPA 1998 ….without determining whether that data would be personal data in the hands of third parties who could access all the data put at risk by DSG’s failings”.

Concluding comment

Fortunately, the UT did not overturn the case entirely as it focused on resolving the “issue of construction” and “a question of law of special difficulty”.  Consequently, it referred the substantive issues back to a newly convened First Tier Tribunal that would use the UT’s case-law determinations as its starting point.

In summary, a fresh Tribunal view of the facts, fettered by the UT’s (dodgy) reasoning.

So will the ICO fight a second case at the FTT using the points raised in this blog which were not considered at the UT?

Given that these legal proceedings relate to the DPA1998 and were commenced by the previous Commissioner, I would not be surprised if the current Commissioner threw in the towel and withdrew the Monetary Penalty Notice.  Afterall, the UT’s judgement will be difficult to set aside.

However, if “towel chucking” is the order of the day, then this judgement because of the similarities of the personal data position in the DPA1998 and in the UK_GDPR (as agreed by the ICO – see above),  has the potential to undermine data breach reporting under the UK_GDPR in the circumstances of a non-reportable mega personal data breach of the kind experienced by DSG Retail.

Fortunately, the Government has just published new data protection related legislation: "The Data (Use and Access) Bill (see references).  What better place to amend the law to ensure that the UT’s view does not prevail.

References

The Upper Tribunal case: DSG Retail Limited -v- Information Commissioner [2024] UKUT 287 (AAC)

The text of the Data (Use and Access) Bill can be found on: https://bills.parliament.uk/bills/3825/publications

Winter Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London on Monday, 18 Nov to Friday, 22 Nov and Monday, 20 Jan to Friday, 24 Jan 20 Sept (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (December 8-10: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].

Data protection policy should return to the Ministry of Justice

The incoming Labour Government has expanded the role of the Department for Science, Industry and Technology (DSIT) by transferring many IT/data related functions from other parts of Government (mainly the Cabinet Office) into DSIT.  The objective is to make DSIT an important driver for economic growth.

In further detail, “experts in data, digital and AI from the Government Digital Service (GDS), the Central Digital and Data Office (CDDO) and the Incubator for AI (i.AI) [have transferred to DSIT] to unite efforts in the digital transformation of public services under one department” (see references).

The objective is to “transform public services and fuel economic growth through science and technology”.  This “will be the defining mission of a revamped [DSIT] department” and comprise the “first steps towards building a modern digital government”.

However, if such objectives comprise the strategic mission for DSIT, the questions that must be answered are:

• How do these economic objectives interact with DSIT’s approach to data protection policy?
• Will there be a repeat of an approach which viewed data protection as sand in the oil of economic progress and an inhibitor to wider data sharing across the public sector?
• Will data protection policy become subservient to economic priorities?

Historical approach to DP policy

For the two decades from 1984, governmental responsibility for UK data protection policy was very problematic.  For instance, the DPA1984 (and DPA1998) were both a minimal implementation of Council of Europe Convention No 108 (and Directive 95/46/EC) in order to have minimal impact on controllers, the economy and provide the minimal protection for data subjects as compared with European standards.

Any data protection specialist who worked with either the DPA1984 or DPA1998 will remember that both sets of legislation were characterised by a weak regulatory regime, diminished rights and both carried a minimal threat of enforcement.

In addition, both DPAs (and FOIA) were enacted under the auspices of the Home Office, courtesy of its strangely named “Liquor, Gambling and Data Protection Unit”.

This meant that the Home Office, which has the political responsibility for functions that were very invasive of privacy (e.g. law enforcement, national security), were also charged with the responsibility of developing policies for protecting data subjects from such invasion.

It can be seen that this represents a huge conflict of interest.  If you have ever questioned why the data protection or FOI exemptions in these early Acts were very expansive when applied to Home Office functions, the answer is, quite simply, staring you in the face!

However, in 2007, responsibility for Data Protection, FOI, Human Rights and related civil society matters were centralised at the Ministry of Justice (MoJ); a neutral Department of State that did not have a vested interest in the processing of vast amounts of personal data for specific public sector functions like tax, housing, health, policing etc.

In data protection terms, the transfer to the MoJ, lifted responsibility for DP policy from a Home Office which processed large amounts of personal data in support of an opposite policy direction.

Why was the MoJ dropped?

The short answer is Micheal Gove MP, when he became Secretary of State at the Department for Education (DfE) in 2011 and thence Lord Chancellor, at the MoJ, in 2015.

In 2011, a FOI request to the DfE included a request to access information contained in Mr Gove’s Hotmail emails to and from his political advisor (“Mr and Mrs Spad”).  Mr Gove’s Department refused the request on the grounds that the relevant emails were private emails and the requested information was therefore not held by the DfE (as they would have been if the official gov.uk email address had been used).

This was despite the fact that the Hotmail communications related to official DfE business.

The FOI request was refused by the DfE and this was followed by appeal to the ICO and the inevitable Decision Notice in favour of the requestor.  Mr Gove’s Department appealed the Notice but the appeal was withdrawn before the Tribunal hearing.  Much, one assumes, to Mr. Gove’s ire.

All became quiet on the Westen Front, until Mr Gove arrived at the MoJ as Lord Chancellor after General Election in May 2015.  On October 15, 2015 he scattered policy responsibility for IT/data related matters to the winds.

For instance, responsibility for:

• Data Protection was transferred to the Department for Culture Media and Sport (DCMS) and thence to DSIT when this Department was formed by Rishi Sunak.
• Data Protection for law enforcement and national security was, in practice, returned to the Home Office.
• Human Rights law (including Articles 8 & 10) was retained by the MoJ.
• FOI and EIR (including DP/FOI/EIR interface) was transferred to the Cabinet Office.
• IT security for personal data processed by the public sector and the HMG Security Framework was managed by the Cabinet Office.
• IT security for personal data processed by the private sector (i.e. now surrounding the ISO27000 series) was developed by DCMS then DSIT.
• ID for Government Services developed by the Cabinet Office via Government Digital Service.
• Digital Verification Services parts of the defunct DPDI Bill were developed by DCMS then DSIT.
• Artificial Intelligence (i.AI) was launched in July 2023 by the Cabinet Office.

So much for joined up government!

Why a return to the MoJ

The Government’s changes, as announced, represent a partial reconstruction of responsibility for the above bullet points around DSIT (the first and the last four bullets from the list above).

The problem is that DSIT, with its enhanced responsibilities for AI, R&D and other technologies is intended to become an engine room for economic growth.  In these circumstances, data protection can all too easily be seen as an inhibitor (as it was with the previous Government).

The risk is then that DPDI-like provisions will re-emerge to provide wide ranging exclusions to ease the secondary use or disclosure of personal data in support of a turbocharged dash for growth.

To minimise this risk and to ensure that data protection is considered with its proper weight, responsibility for data protection policy should be returned to the MoJ.  Leaving DP responsibility in DSIT risks making data protection policy wholly subservient to its economic priorities.

References

Press release about DSIT’s enhanced responsibilities: https://www.gov.uk/government/news/dsit-bolstered-to-better-serve-the-british-public-through-science-and-technology

Post summer Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London (and Zoom) on Monday, 16 Sept to Friday, 20 Sept (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London (and Zoom) on (October 8-10: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].

New A.17 right to erasure in the UK_GDPR added during “wash-up”

Although the DPDI Bill is dead, you have probably missed the addition to the right to erasure (Article 17 of the UK_GDPR) which was made during “wash-up” period (last month) via another piece of legislation (the Victims and Prisoners Act ["VPA"] 2024).

In summary, the change in the law concerns what controllers do when there is a malicious complaint (e.g. to social services) and the procedure for removing that complaint, following the conviction of the complainant of a stalking or harassment offence and a finding that the complaint was malicious.  Phew, a number of conditions to explain!

The change to the A.17 can be found in Section 31 of the VPA Act; it deals with malicious reporting cases such as those as Stella Creasy (MP for Walthamstow, in London), which was publicised by the BBC. (See references for all relevant details).  The new right does not apply immediately; it has to be "commenced" by the incoming Government at sometime in the future.

The new right to erasure

The  VPA Act adds a new paragraph (g) to A.17(1). 

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay if…….

“…(g) the personal data have been processed as a result of an allegation about the data subject—

1. which was made by a person who is a malicious person in relation to the data subject (whether they became such a person before or after the allegation was made),
2. which has been investigated by the controller, and
3. in relation to which the controller has decided that no further action is to be taken.”

So who is a “malicious person”?  Quite simply a malicious person is a person who has made an allegation about a data subject AND that person has been convicted of a “relevant offence".  All the “relevant offences” are identified and relate to stalking or harassment;  they are tabulated in new Article 17(5) and there are ten such relevant offences.

Relevant offences include, for example, an offence under sections 2, 2A, 4 or 4A of the Protection from Harassment Act 1997 or section 8 of the Stalking Protection Act 2019.  Other legislation tabulated are the Scottish and Northern Ireland equivalent of these Acts, and specific legislation which deals with harassment and stalking offences committed by members of the UK’s armed forces.

Article 17(5) is accompanied with a new section 13A to the DPA2018 which provides an order making power to amend or add to the list of relevant offences via an affirmative resolution process.

When does the new right apply

Suppose male employee X stalks a female member of staff. The female member of staff reports it to HR and because of the seriousness of its preliminary investigation, the police get involved.  Supposes further there is an eventual prosecution of X for a stalking or harassment offence (i.e. a relevant offence) but the employee X’s defence, as explained to HR, involves scurrilous accusations against the victim.

Now clearly, the female victim might want HR to delete these allegations from her personal data. As there has been an investigation by the employer, a successful prosecution for a relevant offence and the employer has taken no further action against the female victim, then the new right applies to her.  However, this right does not apply to employee X, as the harasser/stalker is most likely sacked (where sacking is an “action”).

In summary, as there was an initial investigation before personal data were handed to the police, they can be deleted in relation to the female victim (no action against her) but retained in relation to the stalker (i.e. records can be kept of the reason for the sacking but not relating also to the victim).

Note that the new right does NOT apply to personal data processed by the police as their processing is likely to be subject to Part 3 of the DPA2018 (i.e. law enforcement processing) and not the UK_GDPR.

Enter Stella Creasy MP

Stella Creasy MP has faced such serious but false accusation concerning her children,  and this has influenced this amendment behind the scenes.  In the House of Lords’ debate the MP was thanked “for the amendments they have tabled on this issue, and their engagement with myself and officials in this area”.

In her case, according to the BBC, in 2023 a man told Leicestershire Police that her children should be taken into care due to her "extreme views".  This was followed by the MP reportedly facing a safeguarding review by the London Borough of Waltham Forest.

She was quickly cleared; the BBC reports that the man had objected to the MP breast feeding her newly born baby in the House of Commons chamber.

As there was a formal complaint to Police and it investigated a "number of emails" sent to the MP (presumably in the context of harassment). However, it was this police referral that triggered a statutory investigation by the Borough, and this explains why the Borough could not delete the personal data (even though it the Deputy Speaker of the House of Commons publicly criticised the "appalling abuse and harassment" Ms Creasy had received).

Because individuals can hold views that are wrong, the BBC reported that Leicestershire Police resolved the issue by “a community resolution rather than a formal sanction because the messages did not meet the threshold for a criminal offence”.

Concluding comment

You will note that the new right does not help Ms. Creasy get her personal data deleted, as the BBC report states that no relevant offence has been committed (see added note below).

This could have an unforeseen consequence; data subjects who are falsely accused by a stalker or harasser might put pressure on the authorities to prosecute in order to engage the new right.  This is preferable, from the victim’s perspective, than to allow the offender to be let off by treating the issue as some kind of misogynistic misdemeanour which results in the victim’s personal data remaining on file.

And that might not be a bad outcome.

Note added on 23/6/2024: there is a Times report dated 3rd December 2023 stating that Leicester Police changed their mind about harrassment and "a man from Wigston in Leicestershire, admitted harassment without violence and was given a 14-week prison sentence suspended for one year, in part because of overcrowding in prisons. He was also given a three-year restraining order and will be required to carry out 120 hours of unpaid work". (see updated references below).

References

The Parliamentary debate about the new right to erasure in A.17(1)(g) of the UK_GDPR: https://hansard.parliament.uk/Lords/2024-05-23/debates/CC504D8F-CC76-4EBB-9FF3-09FD1D2C2E74/VictimsAndPrisonersBill

Section 31 of the Victims and Prisoners Act 2024: https://www.legislation.gov.uk/ukpga/2024/21/section/31/enacted

BBC story “Stella Creasy: Call for action after online troll sparked MP probe” https://www.bbc.co.uk/news/uk-england-london-65463367

Times report (3/12/2023) on the re-opened case: "Troll’s harassment of Stella Creasy one of worst cases judge has seen" on https://www.thetimes.com/article/stella-creasy-labour-mp-online-troll-philip-stacey-guilty-0k9mzzmls

Forthcoming Data Protection Courses

The next Data Protection PRACTITIONER Course is in London on Monday, 16  September  to Friday, 20 September (5 days: 9.30am to 5.30pm).  Remember also our specialist DP qualification for those in Education. 

Details from www.amberhawk.com

Labour should not let the DPDI Bill go through in “wash-up”; it should kill it off.

When a Prime Minister calls a General Election, the Official Opposition in Parliament becomes very powerful.  The reason is that the two main political parties can agree to enact outstanding and uncontroversial pieces of legislation (e.g. in this case, before the end of next week – May 30th).  Parts of the DPDI Bill do fall into this uncontroversial category; but many bits don’t.

In summary, the Opposition can say to Government something like; “we will agree to pass the DPDI Bill if you remove Schedule 11 (DWP powers to access bank accounts), the definition of personal data and the new disclosure arrangements in Schedule 1, paragraph 1” etc.  Alternatively something like: “we will let through the DPDI Bill limited to the DVS elements, ICO changes to an Information Commission and  law enforcement transfers of personal data outside the UK”.

This horse trading is called “wash-up”; it is undertaken in smoke filled rooms, out of the public gaze where FOI is a distant dream.

The problem is that the Labour Party is not opposed to the DPDI Bill; so it could agree to enact something from the DPDI.  That explains why privacy NGO “BigBrotherwatch” has launched a campaign to get its supporters to contact Labour MPs to ensure the DPDI Bill has no resurrection.

If Labour seeks the views of the ICO, he will repeat his oft-expressed (and erroneous) view that he supports this Bill as it presents no risk to data subjects (aaargh).

So in my last missive on the lamentable (but unlamented) DPDI Bill, I thought I would list the items that are in my view controversial in the hope that it helps “Kill the Bill.

Weakening data subject protections

The list is not complete but contains the following; all impact on the rights and freedoms of all UK data subjects.

Personal data: this definition is changed to make it more prescriptive (i.e. less personal data are subject to the DPDI Bill).  This definition, which impacts on all the data protection rights and Principles, does not meet the standard set by the DPA1984, CoE No 108 and GDPR and is a risk to the UK’s Adequacy Agreement with the EU.

Lawful basis: the specification of “Recognised Legitimate Interest” legitimises any voluntary data sharing of personal data from any private sector controller to any public sector controller for its public tasks.  In addition, the further purpose of the disclosure is also likely to be deemed compatible with the purpose of obtaining. The data subject’s right to object to such disclosures is much diminished.

As modifications of lawful basis are not possible with the GDPR, this provision is also a risk to Adequacy.

Marketing: “opt-in” (consent) for third party marketing becomes the exception; “opt-out” (legitimate interests) becomes the new norm. This overturns the “opt-in” consent rule for Third Party Marketing established under DPA1984  (40 years ago).

In my view, this change represents a spammer’s charter for Third Party marketing.

Transfers outside the UK: these transfers are legitimised via powers granted to the Secretary of State (SoS) without direct reference to Parliament (as it follows negative resolution procedures). The provisions allow the SoS to identify specific controllers in a certain country as adequate, even though the country itself is not deemed to be adequate.

This also could threaten the Adequacy Agreement if transferred personal data from the UK contains personal data that has originally been transferred from the European Union.

Data subject rights: the presumption that automated decision-taking is prohibited, is removed. This means that automated decisions using Artificial Intelligence (AI) techniques are likely to become the norm in the UK.  There is very little protection for UK data subjects except for making complaints after an AI decision has had an effect on them.

In addition, DPDI specifies that a data subject complaint is first directed to the controller. This will add a further month and a half delay before the data subject can complain to ICO (who often takes 4-5 months to allocate a case-worker).

This means delays of half a year or more concerning an automated decision can be expected.  Such a time delay does not protect the data subject’s interests; it protects the controller’s interests.

Research (RAS) processing: it becomes easier to share personal data for RAS purposes, in the absence of transparency to data subjects, so long as certain safeguards apply (see next bullet). Consent as the lawful basis for RAS is likely to be replaced by “legitimate interests” or “public task”. Existing databases can be used and disclosed for RAS purposes and the “scientific research” definition is expanded to cover AI research and development.

There is a considerable risk that, to facilitate AI research and development,  there will be disclosures of personal databases in the legitimate interest of Third Parties and onward to further Third Parties in their legitimate interests, again in the absence of transparency.  This “Wild West” approach to data-sharing is likely, in my view, to result in major data breaches or significant AI harm to individuals.

Research (RAS) Safeguards: The safeguards for data subjects associated with RAS purposes (mentioned above) are not particularly “safe”. For example, one safeguard is that the RAS disclosure does not cause “substantial damage or substantial distress”; this means that moderate damage or distress is perfectly acceptable to Government.

The Regulator: the ICO becomes an Information Commission where voting members of the Commission are all selected by SoS. Such self-selection puts at risk the regulatory independence of the UK and has knock on implications for the Adequacy Agreement.

Codes of Practice: Codes are still not produced in an independent manner in the UK. Although the SoS does not to approve the final text of a Code (as originally intended), it is possible for the SoS to recommend that Parliament vote down the Code.  As the SoS’s political party form the majority of MPs, the SoS veto over the text of Codes of Practice is maintained.  (btw the ICO thinks the veto has gone).

National security: the SoS can designate personal data processed by the police as being of interest to GCHQ. MI5 or MI6. The result is that the personal data, once designated, move from Part 3 of the DPA2018 to Part 4.  This then means that any processing of designated personal data fall outside the DP enforcement regime.

This reason for this designation mechanism has never been explained. However, it provides an alternative, for example, that could permit a bulk ANPR database that the police use to monitor traffic on UK roads being subject to national security rules for data protection purposes.

Forget bulk data transfers and the statutory restrictions and protections found in Investigatory Powers legislation; instead think designated databases under DPDI Bill and total freedom from ICO regulation.

Codes of Conduct: Law Enforcement Codes of conduct can be produced by expert Law enforcement bodies covering their own processing. If approved by a (SoS compliant) Information Commission, these Codes can specify that the processing described in a Code complies with Part 3 data protection obligations.

The prospect of controllers establishing that their own processing is compliant with DP law, by reference to a Code of Conduct they produced for themselves, is pure Alice in Wonderland.  It obviously risks reducing the protection afforded by data subjects

DWP Powers: the Department for Work and Pensions (DWP) want to obtain financial details from financial bodies to use AI techniques to identify whether any payment to any claimant is correct (e.g. benefit, pension, allowance).  As powers to demand these details when there is suspicion of fraud already exist, these new powers do not need any suspicion of fraud.

An “account information notice” from the DWP can demand details from accounts of those connected to a benefit recipient (e.g. of a family members).  So potentially these powers involve half the UK population (e.g. child benefits; OAPs, benefit recipients).

Even the ICO has identified a likely A.8 ECHR problems (ICO says “I do not think the current drafting is sufficient to ensure this [proportionality]”.  Note the ICO does state the obvious:  that there is lack of an A.6 lawful basis that could be subject to his enforcement powers.

International Agreement: there is a new lawful basis of “necessary for the purposes of responding to a request made in accordance with the Agreement … [between UK and USA Governments] … on Access to Electronic Data for the Purpose of Countering Serious Crime signed 3 October 2019”. This sets a precedent for other similar International Agreements having a similar lawful basis.

Again the ICO is on record as saying this change is unnecessary.

Conclusion

For the above reasons(and more), the data protection elements of the DPDI Bill should NOT be subject to the Parliamentary “wash-up” mechanism.  The Bill should be killed off.

This is especially the case as Government Ministers still claim that this DPDI Bill maintains a high level data subject protection and at the same time eases the load of controller compliance, when this is demonstrably wrong.  Quite simply, this Government cannot be trusted with data protection.

However, before you rest easy, the Tony Blair Foundation has plans for the wider use of NHS data to make large financial gains for UK Plc whilst maintaining the highest degree of patient confidentiality.

“Hang on a second; haven’t I heard this before?”  I therefore suspect that a further DP legislation is on the horizon after the Election.

Forthcoming Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture.

• Data Protection FOUNDATION Course is in London on (July 2-4: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Data Protection PRACTITIONER Course is in London on Monday, 8 July to Friday, 12 July (5 days: 9.30am to 5.30pm).
• Remember our specialist DP qualification for those in Education. Next course on June 11th, 12th & 18th 2024

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].

DPDI Codes of Conduct allow competent authorities to write their own DP rules

If, on April 1^st,  I reported that a cabal of controllers could club together and draft a Code of Practice that establishes their legal compliance with the UK’s data protection regime, you would probably say that this was too far-fetched to be true. Yet this is the procedure that has been put in place by our the Government for all law enforcement processing of personal data.

The grim detail can be found in Clause 68A of the Data Protection and Digital Information (DPDI) Bill.  The production of law enforcement Codes of Conduct (as they are called) does not have to involve any data protection expertise, nor the ICO, nor does the text require Parliamentary approval nor does a Code have to consider its impact on data subjects.

Yet, law enforcement processing often comprises the most sensitive of processing.

In addition, the DPDI Bill’s procedure for Codes of Conduct compares starkly with Codes of Practice (which does involve, by law, data protection expertise, impact on data subjects and the approval of the ICO and Parliament).

How Codes of Practice are produced

The DPDI Bill specifies that the ICO has to reissue the Data Sharing Code of Practice, the Age Appropriate Code, and the Journalism Code to accommodate the changes in the DPDI Bill.  As is well known, the Direct Marketing Code has been held up until the range of non-consensual marketing rules of the DPDI Bill become law.

Additional Codes of Practice can be produced on the instructions of the Secretary of State (SoS).

All these Codes follow the same procedure.  This first involves consultation with the SoS and other specified parties that have an interest in the production of a Code. This could involve a preliminary scoping document covering the need for a Code.

For example, a revised data sharing Code will have cover the voluntary data sharing arrangements for disclosures of personal data from the private sector to public sector controllers arising from the introduction of the “Recognised Legitimate Interest” lawful basis.  The revised Code also has to accommodate the weakened data subject’s right to object to such disclosures using this lawful basis.

The text of Code is first drafted by the ICO.  This is then considered by a panel of experts, chosen by the ICO for their knowledge of the subject; this panel then produces a report on the draft Code.  The panel of experts includes representatives of “persons likely to be affected by the Code” as well as representatives from data subject facing organisations.

This expert panel report can suggest modifications to the draft Code; the ICO can reject or accept some or all of the suggestions. Details of any rejection from the panel of experts has to be made public.  The Code (if modified) is then subject to an impact assessment.

This procedure is also followed for significant amendments to existing Codes.  However, for reasons unexplained, the analysis of a panel of experts can be dispensed with, if the Code is an additional Code produced following instructions of the SoS.

The Code is then submitted to the SoS for comments which are made public (if the SoS has any).  The ICO has a choice: he can reject SoS’s comments;  withdraw the Code, or submit a “revised” Code to accommodate them. The Code is then laid before Parliament by the SoS.

Note that if the ICO rejects the SoS commentary, the SoS can ask Parliament not to approve the Code.  In this way, the SoS still retains the “whip hand” if there is disagreement over the Code’s content.

How Codes of Conduct are produced

Let’s assume there is a need for a Code of Conduct covering facial recognition cameras as used by law enforcement agencies.  How would such a Code of Conduct be developed?

First the ICO identifies “expert bodies” who are “encouraged” to produce a Code.  Note that the identification is of expert bodies and not expert individuals.  In other words, there is no obligation placed on expert body, to choose from its ranks, an individual who has requisite expertise in data protection.  Note also, the expert bodies can reject the ICO’s encouragement.

These expert bodies are then also “encouraged” to submit their Code of Conduct to the ICO in draft.  In other words, the drafting of the content of a Code of Conduct can emerge without any submission of its text to the ICO.

If a draft Code of Conduct is submitted to the ICO, the ICO can express an opinion on a Code, decide to approve the Code, and publish the Code if approved.  Of course, this provision does not apply if the Code is not submitted to the ICO.

There is no requirement for the ICO to publish his or her opinion on a particular Code of Conduct (e.g. to explain why approval was not granted).  Codes that have not been submitted to the ICO for approval can still be published without any commentary from the ICO.

There is no requirement for an Impact Assessment (e.g. impact on data subjects) nor is there a requirement to seek Parliamentary approval of a Code of Conduct’s content.

One can easily see a situation where the ICO does not like a Code of Conduct and expresses some contrary views on its proposals.  The response of the expert bodies could well be to press ahead with that Code of Conduct without any further involvement of the ICO.

This could especially be the case with, for example, if a populist Government wanted to skew law enforcement policy in a specific direction (e.g. wanted facial recognition cameras to target those who have pre-booked seats on flights to Rwanda).

Remember the ICO is to be replaced by a Commission where all the voting members of the Commission are appointed by the SoS.  Additionally, the SoS might express a view that a strong emphasis on law enforcement should be a strategic priority for the Commission.

All these possibilities could put pressure on the Commission to approve the Code of Conduct produced by the law enforcement agencies.

Once a Code is “approved” by the ICO, then the text may be used to demonstrate compliance with the law enforcement requirements (see Clauses 56(4) and 59(7A) of the DPDI).

In this way,  public bodies producing a Code of Conduct effectively are drafting text that determines how data protection law applies to their controversial area of law enforcement processing. This "lawfulness" is without any reference to the Courts, Parliament, Impact assessment on data subjects nor any detailed privacy analysis from the ICO.

The ICO has not objected to such a prospect.

Forthcoming Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• All-day Zoom workshop (10.00-4.30)  on the DATA PROTECTION AND DIGITAL INFORMATION BILL held on Thursday 9 May.
• Data Protection PRACTITIONER Course is in London on Monday, 13 May to Friday, 17 May (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (July 2-4: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education. Next course on June 11th, 12th & 18th 2024

More details on the Amberhawk website: www.amberhawk.com  or email [email protected] (e.g  for. DPDI workshop agenda).

Government extends privacy protection to bequests made to the Conservative Party

Late on Good Friday (a very good time to bury “bad” news), the Government quietly tabled an amendment to the Data Protection and Digital Information Bill  (DPDI Bill) which extends the definition of personal data to include bequests and comments, made by a deceased, in his or her will.  The ICO has welcomed this amendment as a positive change to the law.

Although the amendment makes a somewhat quirky change to the Wills Act 1837,  an impeccable sauce has indicated that its main motive is to protect the privacy of bequests of large financial donations to the ruling Conservative Party.

Because the amendment is to a later Schedule of the Bill, it is expected to be debated towards the end of Committee stage in late April.

Amendment to Wills Act 1837

In further detail,  the unassuming amendment reads as follows:

At Schedule 12, page 270, line 8, insert new paragraph 29  (into the DPDI Bill)

29        WILLS ACT 1837

Insert into section 1 of the Wills Act, after the words “section 8 of the Human Transplantation (Wales) Act 2013…”, the following:

All personal information contained in a will shall be treated as if it were personal data (as defined in Section 3 of the Data Protection Act 2018) except when applied to the rights granted to data subjects as specified in Articles 12 to 22 of the UK_GDPR.

Following the amendment, there is a brief explanation of the impact of the change in the law.  This reads:

Minister’s explanatory statement

This amendment protects personal statements and bequests made by a deceased person in a will.  It ensures the deceased, when drafting a will, can be assured of the confidentiality of any bequest, after death.  The amendment also clarifies the law so that the recently deceased cannot exercise their data subject rights under the UK_GDPR.

Speaking on the new GBNews, Sunday breakfast, talk-show (“In The Pub with Lee Anderson MP”),  ex-GBnews presenter Esther McVey MP,  known by the tabloid press as the Minister for Common Sense, expanded on the amendment. She said:

“The amendment is a total realisation of the benefits of Brexit.  The UK is seizing back control of its laws by extending privacy protection to the wills of the newly departed.  The deceased will sleep more serenely in Heaven, secure in the knowledge that their privacy is maintained on Earth, from the moment they leave”.

Lee Anderson MP added a more practical observation:

“The text of wills can be very controversial, especially if the recently deceased leaves, in a will, a “parting shot” at his or her partner or another member of the family.  Such information is rightly protected from the do-gooders, neigh-sayers and anti-Brexit re-moaners who are jealous that their trivial political pursuits do not attract large financial donations from the dead”.

He added “where I come from, up North, we recognise the dead know a thing or two”.

ICO has also welcomed the clarity of the new amendment.  In a statement on his website, the ICO said:.

“I  heartily support the spirit of this amendment and I assure the British public that I shall enforce the new provision as robustly as I enforce the UK_GDPR and DPA2018 currently”.

“As a New Zealander, I am well attuned to a cultural tradition that embeds immense respect for ancestral history: “Hanga koa i taku gin me te tonic”, he added in Māori.

And finally…

Remember my Petition requesting the Government to implement the EU’s AI Act as part of the DPDI Bill is on that Parliamentary web-site: https://petition.parliament.uk/petitions/652982.  Please consider signing it and passing it to your colleagues to consider signing.

Details  reasons why you should sign the Petition are on my Hawktalk blog: https://amberhawk.typepad.com/amberhawk/2024/03/petition-calls-for-implementation-the-eu-data-act-to-protect-data-subjects-from-ai-abuse.html

Forthcoming Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• All-day Zoom workshop (10.00-4.30)  on the DATA PROTECTION AND DIGITAL INFORMATION BILL held on Thursday 9 May.
• Data Protection PRACTITIONER Course is in London on Monday, 13 May to Friday, 17 May (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (July 2-4: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our new specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected] (e.g  for. DPDI workshop agenda).

UK Government abandons Precautionary Principle and tolerates AI abuse risks to data subjects

Speakers at the Data Protection Forum in early March reinforced my reasoning that the Data Protection and Digital Information Bill  (“DPDI Bill”) should be used as a vehicle to implement the EU’s AI Act.  [Obviously my Petition which states this should also be supported: so please sign it! – see references].

One speaker, at the end of her presentation, made several personal comments about the risks associated with the fragmentary, “wait and see” approach of the UK Government towards AI regulation.

She pointed out that, in the UK, this meant that the five pillars of AI trustworthiness (Fairness, Robustness, Privacy, Explainability, Transparency: see references) could all to be interpreted differently by about 90 Regulators.

In further detail, these “trusty” five pillars, largely developed by the AI industry itself, can be summarised thus:

• Fairness: ensure that AI models don't exhibit biased behaviour when considering factors such as age, gender and ethnicity.
• Robustness: focus on the ability of AI models to perform well under exceptional conditions and adapt to changing circumstances.  Comment:  I assume this covers the change in AI functionality if there were to be another pandemic (the latter being the exceptional condition which could vary society’s usual modus operandi).
• Privacy: ensures that data used for training AI models remain protected and that insights derived from the models are under the control of the model builder. Comment: protected from whom? Does “under the control of the model builder” exclude data subjects (e.g. their rights)?
• Explainability: involves being able to understand and explain the decisions made by AI models to end users and decision makers. Comment: does this include data subjects?
• Transparency: emphasises making all relevant information about AI models easily accessible and inspectable. Comment: accessible and inspectable to data subjects?

The point being made in the “Comments”, is that any reference to “data subjects”, whose personal data are likely to be at the centre of much AI processing, is notably absent, especially with respect to the pillars relating to  Privacy, Explainability and Transparency.

Precautionary Principle

Given the obvious risks to data subjects, the Government’s laissez-faire approach to AI regulation abandons the Precautionary Principle towards its governance.

This Precautionary Principle arises when the risks of an action on society is high and the evidence about the future impact on that society of that action is uncertain.  I would argue that this fits the circumstances surrounding the development or use of AI to a tee.

It is this Principle which explains why the EU has enacted the Data and AI Acts that apply to the processing of all forms of data by AI.  By contrast, the Government’s approach sees this Principle as an obstacle to progress.

Indeed, the Government has deliberately weakened this Principle to accelerate such “progress”, by reducing the protection afforded to data subjects.

Data subjects at risk

For example, the A.22 UK_GDPR prohibition on profiling or automated decision taking is reversed.  Under the Bill, AI profiling/automated decisions can take place, in general, subject to a few exceptions usually associated with the processing of special category of personal data.

Yes there safeguards, but these all apply post automated decision when the decision has been taken effect and has impacted on the data subject.  There has been very little consideration of implementing safeguards prior to that AI induced, automated decision.

Secondly, much AI testing and development is also likely to fall within a revised “scientific research” definition.  Thanks to the Bill’s new transparency exemption for scientific research, such research can allow databases of personal data to be exchanged with Third Parties for their AI development purposes without existing data subjects knowing, so long as some (dodgy) “appropriate safeguards” apply.

One such appropriate safeguard is that substantial damage/distress to any data subject is unlikely; this merely means that moderate damage/distress to data subjects is acceptable to this Government!

There are impacts on data subjects’ rights.  How can data subjects exercise their right to object to the processing if they’re kept ignorant of who processes their personal data because of the new transparency exemption associated with scientific research?

Finally, such personal data exchange for scientific research purposes (i.e. AI development; algorithm testing) is also deemed “compatible” with the purpose of collection by the DPDI Bill.  In this way,  the Bill throws precautions to the wind, and legislates its way around the provisions in Article 6 (lawfulness of processing) that could prevent unlawful processing of personal data for AI development purposes.

Concluding comment

The Precautionary Principle, if followed, would add AI clauses to the DPDI Bill  which were aligned with the EU Data and AI Acts (both of which  maintain the GDPR standard).  Such amendments could be tabled for the Bill’s Report stage in the House of Lords (e.g. expected to be over five-days in May/June).

This Bill, once enacted (e.g. before the summer recess) will preserve the ability of the UK’s AI businesses to develop services that meet the requirements of the only available, recognised, international legal (and precautionary) standards that apply to AI.

These AI legal standards might not be the best, but they establish an important safety break in UK law.  That is what the Precautionary Principle is all about.  In addition, as the UK is no longer an EU state, the next Government can tweak these provisions if they do not work as intended.

The alternative is to adhere to this Government’s policy towards AI and put UK’s data subjects in harms’ way.

Forthcoming Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London on Monday, 18 March to Friday, 22 March (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (April 9-11: Tuesday to Thursday, 3 days: 9.45am to 5.00pm)
• All-day Zoom workshop (10.00-4.30)  on the DATA PROTECTION AND DIGITAL INFORMATION BILL held on Thursday 9 May.  Email [email protected] for workshop agenda or to reserve a place on this session.

References

Regulation 2023/2854 (Data Act} on “Harmonised rules on fair access to and use of data” (published in the OJ on 13 December 2023).  See also my updated Hawktalk blog dated 5 Jan 2024 (DPDI Bill combines with EU's Data Act and AI Act to strangle the UK’s AI industry?).

The Petition is on: https://petition.parliament.uk/petitions/652982.  Please consider signing it and passing it to your colleagues to consider signing.

Details  reasons why you should sign the Petition are on my Hawktalk blog: https://amberhawk.typepad.com/amberhawk/2024/03/petition-calls-for-implementation-the-eu-data-act-to-protect-data-subjects-from-ai-abuse.html

Chapter and verse on the relationship between scientific research and AI: https://amberhawk.typepad.com/amberhawk/2023/10/dpdi-no-2-bill-undermines-transparency-of-artificial-intelligence-development-and-training.html

Example used is IBM’s five pillars: https://www.toolify.ai/ai-news/the-five-pillars-of-trust-for-ai-a-guide-to-building-reliable-and-ethical-ai-systems-2584388