Privacy Regulation

Privacy Regulation

I wrote a little piece on my linkedin blog on the EU Commission’s proposal to agree a data “adequacy” agreement. I point out the next set of hurdles, although I downplay the likelihood of any intervention by the CJEU but note that not was critical in striking down the original EU/US “Safe Harbour” agreement. I note that one threat to its renewal at the end of its four year live is the desire and plans of the British Govt to depart from the current legal protections which are based on the EU’s GDPR.

Issues of state surveillance, the European Council’s Convention 108 and the Human Rights act are all engaged. We’ll probably get it, but for it to be renewed, we’ll have to remain aligned with the GDPR & C108. The right to seek judicial redress by EU citizens may become important as it is a point of contention between the EU & US over the Privacy Shield.

One indicator of a desire for divergence is the advert for the role of Information Commissioner, which asks for,

The Government’s National Data Strategy sets out its ambition for the UK’s pro-growth and trusted data regime, one that helps innovators and entrepreneurs to use data responsibly and securely, without undue regulatory uncertainty or risk, …

cabinetoffice.gov.uk

This has been picked up by the Open Rights Group, who are asking people to write to their MPs, we need an independent Privacy Regulator.

The retreat from the promise of the GDPR is not just a UK phenomenon, across Europe pro-business politicians are beginning to say that it’s too onerous. It’s a shame we’re out, our voices no longer count …

Brexit, the next trade deadlines

Brexit, the next trade deadlines

Brexit is not yet done, this, from the Institute of Govt., shows the upcoming deadlines for further agreement. most importantly in the short term, financial services equivalence and data adequacy. Slightly later in the year, is the new definition for food safety documentation required to export British food to the EU and Northern Ireland.

I might say more when I have studied it, but I have written recently about financial services, and extensively on the need for & likelihood of a data adequacy agreement. …

Labour and antisemitism, some thoughts

Labour and antisemitism, some thoughts

I have now read the EHRC Report, Investigation into antisemitism in the Labour Party, and this is what I think needs to be done. I have published some thoughts already and I believe that it is necessary that the Labour rectify its rules and culture to make it a place where discrimination is both absent and shunned, where perpetrators have the opportunity for contrition and that suspensions and expulsions are a last resort applied only after a fair trial. I am particularly incensed to find there has been no policy nor procedures to guide the investigation nor the determination of discrimination complaints because it’s so basic. However, before I look at the specific recommendations, I want to look at some context. The first is Human Rights law, and the second is that the failings are so basic that anyone of good faith will insist that any remedy is applied to all complaints and disciplinary processes and affairs because the failings are systemic, not specific to handling antisemitism complaints. The article then looks at what a fair and independent process might look like and asks that it take account of the ECHR’s Article 6 and 11, the right to a fair trial and freedom of association. It calls for the retention of the NCC and the provision of legal advice to ensure its independence from the Leader and the NEC. It recognises that the Party must be considered institutionally racist and that attempts to fix the problems have been dogged by factionalism. It calls for the adoption of the Nolan Principles. It recognises that things were worse under McNicol until Formby was appointed. It reaffirms that Labour’s policy and rules are made by Conference and not announcements by the Leadership. These issues are explored in greater detail overleaf …

Things improved under Formby

judges gavel

It is clear from reading the EHRC report, Investigation into antisemitism in the Labour Party that things improved when Jenny Formby became General Secretary in 2018, but the EHRC’s sample data looked back to 2011. The EHRC report states several times that the failure to act on the Royall & Chakrabarti Inquiries is a failing and evidence of Labour’s complicity in the inadequacy of its processes. Much of the failure needs to be placed at the door of the then incumbent General Secretary, Iain McNicol, Formby’s predecessor, and the NEC members that allowed him to act with impunity. Additionally it should be noted, to give an idea of the scale of McNicol and Harman’s ambitions, that over 10,000 complaints were lodged over the summer of 2015, leading to over 5,000 suspension and nearly 4000 investigations, all of them with no policy to guide the investigators and the NEC members making judgement. To expedite the process the NEC set up a wonderfully named Procedures Committee to supervise this purge/examination of eligibility, it consisted of Harriet Harman MP, Margaret Beckett MP, the then general secretary Iain McNicol, Jon Ashworth MP, Keith Birch (Unison), Paddy Lillis (USDAW), Jim Kennedy (Unite), Diana Holland (Unite) and Ann Black (CLP). It’s interesting how some of the names are still around and even more powerful today; the Guardian story exposes how the committee rejected legal advice on using the canvassing records as reasons for exclusion. Canvassing records should only be used for the purpose for which Labour holds them, electoral campaigning, anything else is a likely breach of the electoral secrecy laws. I was advised that I must not use the canvassing records as a source of information when recommending people to be rejected as members or registered supporters during this period.

timeline rules leaders and general secretaries

The Labour Party in an attempt to improve the antisemitism complaints handling process has  changed its rules three times (Conference 2017, 2018 & 2019), the 2017 amendment removed/weakened the free speech defence, the 2018 amendment made breach of codes of conduct disciplinary offences and gave the General Secretary powers to delegate their authority to people other than staff, and 2019 introduced ‘fast track’ process where the NEC and not the NCC heard cases related to discrimination without hearings. These developments show that the Labour Party took the problem seriously but focused on end stages of the process and in doing so, ignored the investigation stage and decision to prosecute which the EHRC has excoriated. The Party also in making these changes created a special class of complaint, that of discriminatory behaviour, which is treated differently to bullying, slander, thuggery and breaches of the rules for factional advantage.

In the LRB review of Jones’ “This Land” and Pogrund & McGuire’s “Left Out”, the James Butler, says, that

His [Jones’s] account is an improvement on the defensive response that the public’s perception of the problem with antisemitism in Labour was distorted, or that positive changes were made to disciplinary procedures after they were taken out of the hands of anti-Corbyn party staff.

James Butler – LRB

This article is not an attempt to say that Labour solved its disciplinary problems under Formby, it clearly didn’t but she inherited a system far distant from what was needed. Its crap etherealness and its then and current inability to address corruption within the bureaucracy are further reasons why the EHRC recommendations should be pursued.  …

Google, the GDPR and Brexit

Google, the GDPR and Brexit

Google are going to move their UK users data from Ireland to the USA. I wrote a little note on my linkedin blog. I headline it as

Google are moving UK data from Ireland to the US … what does this say about UK/EU/US dataflows and ompliance with the GDPR and the world’s data protection laws.

I also point out the need for robust legal redress to comply with the GDPR, which the UK and USA may not meet and that the UK will lose access to the US Privacy Shield arrangements. I note that the UK will lose its member state privileges and powers under the GDPR when the transition period ends and that RIPA 2016 and the immigration exception of the DPA 2018 may cause the Commission some problems with respect to “Adequacy”.

I note that model clauses and binding corporate rules will remain in place and I wonder if this is a business opportunity for a European based phone operating system author as people choose to withdraw from Android? Nokia? Canonical? …

No Deal & cross border data flows

No Deal & cross border data flows

I have just written a blog at linkedin on the impact of a No Deal Brexit on cross border personal data flows. Obtaining an adequacy agreement will take time, one would have hoped that the transition period would have been enough, but without one there will be no adequacy decision on Day 1. Large and prepared entities may be OK as they can use the currently legally permitted alternatives. The US privacy shield may not be avaialable n Day 1, since its an EU agreement. If we leave, we i.e. the UK state may no longer avail itself of the Article 23 powers and the Investigatory Powers Act and the DPA “immigration exception” may cause problems in achieving an adequacy decision. …

Crime & Brexit

As I said, earlier this week I attended a session of the House of Commons Home Affairs Committee. This was called to take evidence on the impact of Brexit as it impacted Europol and the European Arrest Warrant.

I have published a link to the video recording of the event but I took some notes and wanted to share them with you. They interviewed Sir Robert Wainright, a former Head of Europol and Claude Moraes MEP, Chair of the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs (LIBE) and Camino Mortera-Martinez, Research Fellow and Brussels Representative, Centre for European Reform. If we leave, we are unlikely to get a better agreement than Denmark which has withdrawn from Europol and unless we accept the Court of Justice of the European Union, we will be excluded from the European Arrest Warrant. Moraes made the point that the UK’s Investigatory Powers Act may inhibit a data sharing adequacy finding which may lead to a restrivtion on access to Europol’s databases. …  …

Privacy & compliance, reprised

I have had a look at the changes in Law, and thus the potential changes in data protection strategy since I first wrote about the conflicts between privacy, compliance and law enforcement.

The US courts have been siding with citizens and their privacy rights, the ECJ has been doing the same. Parliament has been going in the opposite direction, although the Supreme Court has declared the Data Retention laws to be contrary to Human Rights Law and should we actually leave the EU we will find obtaining an “Adequacy” agreement harder than we’d hope as the EU Parliament, Commission and the EU Data Protection Supervisory board focus on the rights of privacy from Governments. This will be a significant problem if the ECJ strikes down the model clauses and binding corporate rules.

I briefly touch on the fact that the European Laws are meant to be implementing the globally agreed seven principles of Data Protection, of Notice, Purpose, Consent, Security, Disclosure, Access and Accountability and that in a rights based jurisdiction, these rights must be protected from the Government as well as from Corporates.

 

The language has developed since 1980 but these principles were agree by the OECD in 1980.

I conclude the article by saying,

Today, under EU law, the lawful purpose would seem to be more flexible, cross border transfers are more restricted, and may become more so, and the EU is more concerned about nation state compliance; it’s what you’d expect from a political entity consisting of states and the children of people surviving fascist or Stalinist rule.

This political heritage should be remembered by those that see these laws merely as a business burden, …

Investigatory Powers revisited

Investigatory Powers revisited

In December, the CJEU stated that the British and Swedish investigatory powers laws were in contravention to the EU’s Charter of Fundamental Rights. This was in the case of the UK partly based on the litigation started by Tom Watson MP, initially with David Davies MP. This was reported in the Register, here, and the Guardian here.  The Open Rights Group have asked for people to engage in the Home Office consultation; they propose to put a judicial warrant requirement on investigation requests for suspect internet data. This blog discusses my contribution. If you want to follow me, you’ll have to be quick the consultation closes tomorrow. …