A note at Linkedin on the law and legislation applying to data protection and privacy in the UK, now i.e. after brexit and at the end of transition period. Obviously considers the GDPR and the Privacy Shield. The GDPR is now forked. 😋 …
Google, the GDPR and Brexit

Google are going to move their UK users data from Ireland to the USA. I wrote a little note on my linkedin blog. I headline it as
Google are moving UK data from Ireland to the US … what does this say about UK/EU/US dataflows and ompliance with the GDPR and the world’s data protection laws.
I also point out the need for robust legal redress to comply with the GDPR, which the UK and USA may not meet and that the UK will lose access to the US Privacy Shield arrangements. I note that the UK will lose its member state privileges and powers under the GDPR when the transition period ends and that RIPA 2016 and the immigration exception of the DPA 2018 may cause the Commission some problems with respect to “Adequacy”.
I note that model clauses and binding corporate rules will remain in place and I wonder if this is a business opportunity for a European based phone operating system author as people choose to withdraw from Android? Nokia? Canonical? …
Oracle OpenWorld London
I went over to the Excel Centre to meet some friends at Oracle Openworld London. An interesting day, ending with a tincture.
I browsed around the stands and attended a couple of sessions, I was fascinated to see a raspberry pi grid.

…
Life continues

The noise about Ubuntu Linux has increased over the last couple of days, much of it critical. I have been aware that the Open Source militants have for a long time had a down on it and Canonical for bundling proprietary software with the distro (coadecs and now graphic card drivers) and they have taken some odd diversions in their path to today ( Amazon Search Bar, I am talking about you), but it has a a commitment to a usable free desktop and server operating system and it’s not owned by a proprietary software company and is not a competitive weapon in the systems market, unlike say Red Hat who “own” Fedora, RHEL and Centos. The industrialisation of Red Hat was funded by IBM as a competitive weapon against Solaris and HP/UX and who now own it and offer it as their O/S of choice for their Intel servers. At a meeting I attended, Richard Stallman expressed his tests as: does it do surveillance, doe it have restrictions (against the four freedoms) and does it have backdoors and documents his then use of GNewSense, a Debian derivative. He also argued, correctly, that one can’t know if the software is free of these defects unless one can read the code. I wonder how many of these Linux distributions meet these tests today?
My review of the meeting might be worth having another look at, unlike some of what I write, it has aged well. …
Source code engineering rights

I have just written a piece on my linkedin blog emphasising the requirement that software support organisations must have access even if only via contract to source code engineering rights. …
Intellectual Property & economics
Intellectual property laws have alsways been designed to encourage and reward innovation and invention. When the laws are too strong they become barriers to entry to markets.
This is where we are today!
The most immediate challenge is to #saveourinternet but no matter the results there, the rich and powerful wll lobby for laws that benefit them and not the rest of us. …
Digital Democracy

One of the motions proposed but not debated at the CLPD AGM was called “Digital Democracy & the need for greater voter participation”. It’s quite long at over 550 words and I planned to speak against it, by saying something like,
This motion, despite its length, says only two things: that we’ve read Corbyn/Barbrook’s Digital Democracy Manifesto and that we approve of a digital identity card as part of a system of access to e-voting in public elections.
I have read the manifesto and believe it is flawed, most importantly in it postpones the consideration of what human rights looks like in an age of the ultimate surveillance machine until after the election of a Labour Government, when it proposes a consultation. It proposes a People’s Charter of Digital Liberties but makes no mention of the work other campaigners for digital liberty have done in defining new Human Rights needs in a connected world and old Rights that need defending. These campaigning bodies include Liberty, the Open Rights Group, the Electronic Frontier Foundation and Labour’s members on the European Parliament’s LIBE committee.
But we can’t talk about e-voting without talking about Estonia, the poster child of e-voting, and its failed audits, and its proof that e-voting does not increase turnout, and its alleged failure to meet European data protection standards.
We can’t talk about e-voting without talking about the Surveillance State and its private corporate arm. It’s bad enough that the datenkraken can use our phones to spy on us, but I suppose the fact that the US government has access via them to all they know perhaps should reassure us that there is no risk to making a short cut to British Intelligence of our internet usage records, they already have it.
We can’t talk about e-voting without talking about the digital divide.
We can’t talk about e-voting without looking at whether the ERS removed votes from the 2015 Labour Leadership elections, a fact if true showing the vulnerability of the “transparency of the result” to insider attack.
We can’t talk about e-voting without talking about Russia’s interference in the US, British elections and the Brexit referendum through their advanced hacking capability.
We can’t talk about e-voting without noting that Verify, the current Government identity portal has been criticised as a failure by the Public Accounts Committee and now looks likely to be privatised.
We can’t talk about e-voting without looking at the fundamental criticisms of such systems, that they are hard to build, and it may be impossible to resolve the conflict between having a transparent result and a secret ballot; this is before we address the issues of coercion, impersonation and 2nd party verification i.e. how to implement polling/counting agents in a proprietary software system.
In the US, engineers and electoral administrators are developing the systems to make this easier, requiring physical receipts of the cast vote, which are then electronically counted with statistical control samples manually counted.
This motion is technically premature at best and otherwise dangerous populist nonsense.
Please remit or oppose.
ooOOOoo
Interestingly, DARPA have announced an e-voting proof of concept, I am pointed at it by Bruce Schneier. …
Data and Versions
I am trying to write an article for my linkedin blog for which I needed to revisit something I wrote for Citihub. I decided to create a comment & mirror on this site, as my blog has outlasted seemingly mightier organisations then them. I originally commented on it as follows,
why encrypt inside the firewall, and why applications logs are important
On revisiting the article, the need to keep versioned copies of the data, like a wiki or a write-ahead log become more obvious, or I recognise as under emphasised in the original article. I also, this time, consider the inappropriate demise of “Entity Life History” analysis. …
Do the right thing!
A new linkedin blog by me on the fine print of the GDPR’s “legitimate interest”. The print is not so fine, and in summary, you don’t need to read the fine print to do the right thing.
When claiming a legitimate interest, the privacy rights of data subjects are established as controlling the data processor/controller’s legitimate interest by the requirement to recognise the “fundamental rights and freedoms” of the data subject. The “fundamental rights and freedoms” are defined in the Charter of Fundamental Rights
Due to indirection and thus undocumented nature of the data subject’s consent inherent in legitimate interest, I’d advise finding another lawful purpose. …
HRMS, a distressed purchase?
I was provoked by this on Hackernoon, and wrote a little piece on HRMS systems. I have just come back from a Trade Union course on Employment Law and wonder whether the US based systems built for Silicon Valley behemoths are suitable for UK based SMEs. I reference the Gartner MQ which seems to have come on in the last two years; google it, you can get to see it from one of the companies in the top right quadrant but I like their functional breakdown.
I state that a “person” data model is key and finish with the following quote,
…HR functions need to define their mission statement, somewhere between “stop the staff suing us”, and “delivering a self-actualising company”; only then can the needs of the software be defined and developed, bought or rented.