Category Archives: Data Protection

Data protection misunderstandings in court

There is something that distinguishes those who have practised data protection law for more than five years and those who have come to it more recently. The former are in possession of a secret. It is this: GDPR did not change the fundamentals of data protection.

Look at the keystones of the law – the data protection principles in Schedule One of the Data Protection Act of 1998 (the prior law) and in Article 5 UK GDPR (the current). They are effectively identical. And in fact, they have barely changed from the principles in the 1984 Data Protection Act, and those in the Council of Europe Data Protection Convention 108 of 1981.

Yet even in the courts one still sees from time to time the misconception that the GDPR rights and obligations were something fundamentally new.

An example is a recent case in the Employment Appeal Tribunal. The details of the case are not important for this post, but what is relevant is that the claimant employee argued that information about his previous employment history at the respondent employer (from 2008-2011) should not have been allowed in evidence. One argument in support of this was that the lengthy retention of this information was in breach of the employer’s data protection obligations (and the claimant had received correspondence from the Information Commissioner’s Office broadly agreeing with this).

But in response to this argument the respondent employer asserted that

Prior to [GDPR coming into effect on 25 May 2018] there was no right to erase. Accordingly, the period during which the respondent should arguably have taken steps to delete data was around nine months from this point until 28 February 2019.

This fails to recognise that, even if there was no express right to erasure prior to GDPR (n.b. there was certainly an implied right, as the European Court of Justice found in Google Spain) there was certainly an obligation on a data controller employer not to retain personal data for longer than was necessary (see paragraph 5 Schedule One to the 1998 Act).

The judge, however, accepted the respondent’s argument (although in all fairness to her she does point out that neither party took her to the legislation or the case law):

I accept that the ICO’s reference to retention being likely to breach data protection requirements, was (at its highest) concerned with the nine month period between the GDPR coming into effect and the claimant indicating an intention to commence litigation

That is not what the the quoted correspondence (at paragraph 17) from the ICO said, and it is not a correct statement of the law. If the period of retention of the data was excessive, there is no reason to say it was not in contravention of the prior law, as well as GDPR.

Ultimately, it is doubtful that this would have made much difference. As often in such proceedings, the relevance of the information to the matter was key:

in so far as the Respondent was in breach of data protection law for the nine month period I have referred to, it does not follow from this that the documentation was inadmissible in the [Employment Tribunal] proceedings

But one wonders if the judge might have taken a slightly different view of, instead, she had found that the Respondent was in fact in breach of data protection law for several years (rather than just nine months).

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under Data Protection, employment, GDPR, UK GDPR

ICO threatened Matt Hancock with £17.5m fine (sort of)

It’s well known that, under the UK GDPR, and the Data Protection Act 2018 (DPA), the Information Commissioner can fine a controller or a processor a maximum of £17.5m (or 4% of global annual turnover). Less well known (to me at least) is that he can fine any person, including you, or me, or Matt Hancock, the same, even if they are not a controller or processor.

Section 142 of the DPA empowers the Commissioner to serve “Information Notices”. These fall broadly into two types: those served on a controller or processor requiring them to provide information which the Commissioner reasonably requires for the purposes of carrying out his functions under the data protection legislation; and those requiring

any person to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of—

(i)investigating a suspected failure of a type described in section 149(2) or a suspected offence under this Act, or

(ii)determining whether the processing of personal data is carried out by an individual in the course of a purely personal or household activity.

And by section 155(1) of the DPA, the Commissioner may serve a monetary penalty notice (aka “fine”) on any “person” who fails to comply with an Information Notice. That includes you, or me, or Matt Hancock. (Section 157(4) provides that the maximum amount is £17.5m, or 4% of global annual turnover – although I doubt that you, I, or Matt Hancock has an annual global turnover.)

All very interesting and theoretical, you might think. Well, so might Matt Hancock have thought, until an Information Notice (which the Commissioner has recently uploaded to the ICO website) dropped onto his figurative doormat last year. The Notice was in relation to the Commissioner’s investigation of the leaking of CCTV images showing the former Secretary of State for Health and Social Care and his former aide enjoying each other’s company. The investigation – which was into the circumstances of the leak, and not Matt Hancock’s conduct – concluded in April of this year, with the ICO deciding that there was insufficient evidence to justify further action. But the Notice states clearly at paragraph 7 that failure to comply is, indeed, punishable with a fine of up to £17.5m (etc.).

The Matt Hancock Notice admittedly addresses him as if he were a controller (it says the ICO is looking at his compliance with the UK GDPR) although I am not sure that is correct – Matt Hancock will indeed be a controller in respect of his constituency work, and his work as an MP outside ministerial duties, but the normal approach is that a ministerial department will be the relevant controller for personal data processed in the context of that department (thus, the Department for Health and Social Care shows as a controller on the ICO register of fee payers).

Nonetheless, the ICO also issued an Information Notice to Matt Hancock’s former aide (as well as to Helen Whateley MP, the Minister of State), and that one makes no mention of UK GDPR compliance or a suggestion she was a controller, but does also “threaten” a potential £17.5m fine.

Of course, realistically, no one, not even Matt Hancock, was really ever at risk of a huge fine (section 155(3) of the DPA requires the Commissioner to have regard to various factors, including proportionality), but it strikes me as a remarkable state of affairs that you, I or any member of the public caught up in a matter that leads to ICO investigation, and who might have relevant information, is as a matter of law vulnerable to a penalty of £17.5m if they don’t comply with an Information Notice.

Even Matt Hancock.

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under Data Protection, Data Protection Act 2018, Information Commissioner, information notice, monetary penalty notice, UK GDPR

NADPO conference on 22 Nov, with keynote from John Edwards, Information Commissioner

NADPO’s 2022 annual conference will see a return to in-person events. And we are delighted that the keynote speaker is UK Information Commissioner John Edwards. John will be joined by a stellar line up including

  • Maurice Frankel, from the Campaign for Freedom of Information
  • Professor Victoria Nash, from the Oxford Internet Institute
  • Professor Lilian Edwards, from Newcastle University, and also the Ada Lovelace Institute
  • Sarah Houghton, Head of Competition Law at Mishcon de Reya LLP
  • Stewart Room, of DWF and also President of NADPO

The conference will take place on 22 November, at the Mishcon de Reya offices at Africa House, Kingsway (right next to Holborn tube station).

Attendance is free (as ever) for all NADPO members, and it is not too late to purchase a membership, for the price of £130, which guarantees free attendance at all NADPO events, as well as at some partners’ events, as well as discounted rates on commercial training services from respected providers. Members also receive a monthly newsletter.

Leave a comment

Filed under Data Protection, Freedom of Information, Information Commissioner, NADPO

GDPR is rubbish

I was challenged recently along the lines that “you don’t like change – you think that GDPR is great and any amendments are negative”.

After I’d spluttered in rage that this wasn’t true, I checked my thoughts. I don’t think the challenge was fair – I don’t mind the idea of repeal or reform of the UK GDPR model – but I do still think that any change needs to be planned and drafted very carefully, so as not to interfere with the core data protection concepts, and checks and balances, that have – broadly – carried through and developed over a series of legal instruments, starting with the Council of Europe Convention 108 of 1981 and the OECD Guidelines of 1980.

But, also, I’m happy to point out that, at times, GDPR is simply rubbish. And I don’t mean in broad legal terms – see for instance David Erdos’s interesting criticisms – I mean that it sometimes doesn’t make sense.

There’s an example in recital 63

A data subject should have the right of access to personal data…in order to be aware of, and verify, the lawfulness of the processing.

I think this is meant to mean “a data subject should have the right of access in order to be aware of the processing and verify its lawfulness”. But, as drafted, it suggests the data subject should be able to be aware of the lawfulness of the processing, and verify that lawfulness, which lacks logic.

But that’s in the recitals, and no one reads the recitals do they?

But consider one of the substantive provisions. Article 5(2), which describes the “accountability principle” says

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Think about what that says: “the controller shall be responsible for…paragraph 1” (paragraph 1 containing the core data protection principles). What it is surely intended to mean is “the controller shall be responsible for compliance with paragraph 1”, but it doesn’t say that. In literal terms it says that the controller has responsibility for the legislative words.

And it’s worth noting that in the French text (French being the only other language this lumbering English person has really even vague familiarity with), the wording does say that: “…est responsable du respect du paragraphe 1…”.

I’m not suggesting this is a big problem: a regulator and a court would almost certainly read the wording so as to give effect to the legislator’s intention.

It just irritates me.

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under Data Protection, GDPR, not-entirely-serious, UK GDPR

Certainly uncertain – data protection reform developments

In recent weeks the future of data protection law in the UK has been not just hard to predict, but also hard to keep up with.

Since Brexit, the UK has had its own version of the EU’s GDPR, called, obviously enough, the “UK GDPR“. Then, on 18 July, a Data Protection and Digital Information Bill was presented in Parliament – it proposed some significant (but possibly not hugely so) changes to the current regime, but it retained the UK GDPR. It was scheduled to have its second reading in the House of Commons on 5 September, but this was postponed “to allow Ministers to consider the legislation further”.  

Following this, on 22 September, the Retained EU Law (Revocation and Reform) Bill was introduced. This appeared to propose the “sunsetting” (i.e. the repeal) of multiple data and information laws, including the UK GDPR, by the end of 2023.

The next development, on the first day of the Conservative Party conference, is the announcement by the Culture Secretary, Michelle Donelan, that

we will be replacing GDPR with our own business and consumer-friendly data protection system… Many…smaller organisations and businesses only in fact employ a few people. They don’t have the resources or money to negotiate the regulatory minefield that is GDPR. Yet right now, in the main, they’re forced to follow this one-size-fits-all approach.

She also suggested that businesses had suffered from an 8% reduction in profit from GDPR. It is not immediately clear where this figure comes from, although some have suggested that an Oxford Martin School paper is the source. This paper contains some remarkably complex equations. I have no competence in assessing, and no reason to doubt, the authors’ economic and statistical prowess, but I can say (with a nod to the ageless concept of “garbage in, garbage out”) that their understanding of data protection law is so flawed as to compromise the whole paper. They say, for instance

websites are prohibited from sharing user data with third parties, without the consent from each user

and

companies that target EU residents are required to encrypt and anonymise any personal data it [sic] stores

and (probably most bizarrely)

as users incur a cost when prompted to give consent to using their data, they might reduce online purchases, leading to lower sales

To be quite clear (as politicians are fond of saying): websites are not prohibited from sharing data without the consent from “users” (if they were, most ecommerce would grind to a halt, and the internet economy would collapse); companies subject to GDPR are not required to anonymise personal data they store (if they did, they would no longer be able to operate, leading to the collapse of the economy in general); and “users” do not have to consent to the use of their data, and I am still scratching my head at why even if they did they would incur a cost.

If the authors base their findings on the economic cost of GDPR on these bases, then there are some very big questions for them to answer from anyone reviewing their paper.

I may have the wrong paper: I actually really hope the government will back up its 8% figure with something more sensible.

But regardless of the economic thinking this paper, or underpinning the developments in the statutory regime, it is possible that all the developments cohere: that the Data Protection and Digital Information Bill, when it re-emerges, will have been amended so as to have the effect of removing references to “GDPR” or the “UK GDPR”, and that this will mean that, in substance, if not in name, the principles of the UK GDPR are assimilated into a new piece of domestic legislation.

But (given that the government’s focus is on it) business, just as nature, abhors a vacuum – many business owners (and indeed many data protection practitioners) must be hoping that there is a clear route forward so that the UK’s data protection regime can be considered, and applied, with at least a degree of certainty.

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under adequacy, consent, Data Protection, Data Protection Act 2018, Data Protection Bill, GDPR, parliament, UK GDPR

Government urged to take action to protect UK citizens’ information rights

The Retained EU Law (Revocation and Reform) Bill was introduced to Parliament on 22 September 2022. The Bill sets a “sunset date” of 31 December 2023 by which all remaining retained EU Law will either be repealed, unless expressly assimilated into UK domestic law. The sunset may be extended for specified pieces of retained EU Law until 2026. A large number of UK laws which cover “information rights” appear to be caught by the Bill.

Mishcon de Reya has written an open letter to the Minister of State at the Department for Digital, Culture, Media & Sport, Julia Lopez, to highlight the risk to these laws.

Government urged to take action to protect UK citizens’ (mishcon.com)

Leave a comment

Filed under access to information, Data Protection, DCMS, Environmental Information Regulations, Freedom of Information, UK GDPR

Data Protection reform Bill on ice

A piece by me on the Mishcon de Reya website on yesterday’s news that the Data Protection and Digital Information Bill has been paused

https://www.mishcon.com/news/data-protection-reform-progress-paused

Leave a comment

Filed under Data Protection, Data Protection Bill

ICO investigates collection of barristers’ names

News from the Mishcon de Reya website on data protection concerns arising from criminal barristers’ dispute with the MoJ

https://www.mishcon.com/news/information-commissioner-investigates-collection-of-criminal-barristers-names

Leave a comment

Filed under Data Protection, fairness, Information Commissioner, Ministry of Justice, UK GDPR

OMG – OCG attacks HMRC

ICO declines to take action after 1000 HMRC customer records apparently altered in 2020 by Organised Crime Gang and used to make fraudulent claims

Rather hidden away on the Information Commissioner’s Office (ICO) website is information, disclosed under the Freedom of Information Act 2000 (FOIA), in relation to an ICO investigation of a security incident involving HMRC, and an organised crime gang (OCG).

It appears that, in June 2020, an OCG had used 193 genuine National Insurance Numbers (NINOs) which it had managed to “hijack” (it is not clear how) from external sources, and set up bogus Government Gateway (GG) accounts. This subsequently “enabled the OCG to carry out enrolments on the bogus GG accounts of genuine Self-Assessment customer Unique Tax References”, which in turn enabled the submission of fraudulent tax returns with the aim of the OCG being to make fraudulent expenses claims.

It was also discovered that details of 130 of the data subjects whose NINOs had been compromised were also used to “utilise” the DWP universal credit service.

HMRC did not become aware of this incident until 2 December 2020, and it notified the ICO (pursuant to its obligations under Article 33 GDPR) on 14 December 2020.

Details of the incident also appear to be contained in HMRC’s Annual Report for the period in question, where (at page 188) it refers to an incident involving 1023 people where “Personal information [was] used to make changes to customer records on HMRC systems without authorisation”.

There are many redactions in the information that the ICO has now published, but the headline point is that it did not view the incident as a serious enough infringement of HMRC’s obligations under GDPR so as to warrant a monetary penalty. The ICO noted that

…there is no indication that any of the originating personal data used to commit the fraud was obtained from HMRC.

However, it does appear that some people might have lost money, although this has since been repaid to them:

…any repayments due to genuine customers have been (or will be) made good…and therefore all the financial losses will be HMRC’s.

Also redacted are what would probably be details of systems changes that HMRC has taken or agreed to undertake as a result of the incident. These would, says the ICO

increase the protection applied to customer records and data and make stacks of this nature more difficult…

This wording suggests that the ICO felt that the level of protection had not been adequate, in line with HMRC’s security obligations under the GDPR. That being the case, the ICO must have decided that, in this instance, despite the infringement, it wasn’t necessary, or appropriate, to issue a fine or take other enforcement action.

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under Breach Notification, Data Protection, GDPR, HMRC, Information Commissioner, security

ICO secures court-awarded compensation

ICO often say they can’t award compensation, but what they can do is – in criminal cases – make an application for the court to make an award (separate to any fines or costs). But as far as I know, until this case last week, they’d never done so:

https://www.mishcon.com/news/ico-recommends-compensation-awards-in-criminal-prosecution-case

Leave a comment

Filed under crime, damages, Data Protection, Data Protection Act 2018, Information Commissioner