Leadership at the ICO

Given David Smith’s impending retirement, it won't be too long before we learn the identity of his replacement.

And what will we expect from this appointment?

Hopefully, his replacement will be a robust individual who has plenty of practical experience with data protection issues. They really need to get to know their way around the privacy field quickly. It takes time to become fully acquainted with the more arcane and esoteric aspects of data protection law, and there will be plenty of snotty data professionals who will only be too keen to trip up the newbie by trumping their own knowledge of dp gumpf.

Since 1984, the data protection community has developed an obscure language, shrouding what ought to be reasonably simple terms in incredibly complex jargon. Will the new incumbent know the difference between explicit and unambiguous consent? (Do many people care greatly about the difference between the two?) Will the incumbent know how to explain the difference between a Privacy Impact Assessment and a privacy audit? How will the incumbent explain to an incoming Information Commissioner what it is that the new Commissioner will be expected to be talking about?

And, just as importantly, how will the new incumbent deal with the constant heckling from a tiny band of tweeters whose sole purpose in life appears be to comment on just how awful and ineffective  the ICO is?

But that's only what the regulated will expect of the new incumbent.

Those actually working at the ICO will be seeking someone with additional skills. Someone whose management skills are such that things get done. Someone who ensures that people who expect to be paid fairly are put in their place. And someone who can raise the internal staff satisfaction scores to an acceptable level. In short, someone who will be an effective member of the Executive Team.

Soon, both the regulated and the staff will know who this person is.

Good luck to them.

.

Is there really a serious concern with charity fundraising calls?

I’m not an avid reader of the Daily Mail, and I approach many of the articles with a certain degree of scepticism. I’m sure that lots of their journalists are bright individuals who seek to both entertain and inform their readers. And I recognise that they’ve got a job to do – which is to provide material that is sufficiently engaging for readers to take account of the adverts that are surround their stories.

A recent campaign has caught my eye – evidently, there are unacceptable practices in the charity fundraising sphere, and the Daily Mail is leading the campaign to stamp them out.

And, apparently, the ICO has vowed to investigate immediately, saying the charities could be breaking the law.

I’m looking forward to the results of this investigation which, if true, will be yet another nail in the coffin of the cold calling industry. But I want to wait for the facts before rushing to condemn.

Many of the people I know in the charity fundraising industry adopt extremely high ethical standards. I’m sure that they would be appalled if the behaviours that have been alleged by the print media (sections of which are still reeling from phone hacking scandals that they themselves played no small part in) are indeed true.

There will always be rogue cold calling companies, and the ICO does what it can to deter them. Coincidentally, there was no direct criticism of charities in the ICO’s latest annual report, launched last week, either in the report itself or from Christopher Graham or David Smith when they spoke at the event, so I’m really not sure just how significant a problem this is.  

   

If this was a really significant problem that particularly affected the charitable sector, I would have expected to have heard more about the relevant concerns directly from the ICO well before now.

Source:

http://www.dailymail.co.uk/news/article-3151533/Shamed-charity-cold-call-sharks-Britain-s-biggest-charities-ruthlessly-hound-vulnerable-cash-try-opt-receiving-calls.html

Image credit:

http://www.tintup.com/blog/7-tips-on-how-to-cold-call-effectively/

.

Top tips for preparing PIAs

I’ve recently had one of my PIAs placed on the public record in Ireland, so I’m free to speak more generally about it. The assessment was on a programme the Irish Government hopes to implement – shortly, all postal addresses in Ireland are to be given a unique postcode.  This gave me the opportunity to assess how the programme addressed the particular challenges of Irish data protection legislation.

In a nutshell, I recommended that the Irish law be changed to reflect the obligations that would be imposed on organisations that processed Eircodes. This recommendation was accepted, and legislation is currently making its way through the Irish Parliament. It has completed its stages in the lower chamber and is now before the upper chamber.

As the Minister reported to Parliament:

“The final significant element of the project is the enactment of this legislation. It will ensure members of the public can have absolute confidence in regard to data protection. The primary purpose of this legislation is to enshrine the highest levels of data protection within the postcode system. It also provides the clearest possible reassurance that all personal data will remain secure. My Department has consistently taken a strong line on data protection in the design, implementation and operation of the project. The contract we have with Capita reflects this approach. As Minister, I have decided that this approach must be confirmed in primary legislation to ensure the greatest level of protection for citizens. My Department has had ongoing engagement with the Data Protection Commissioner.

My Department has also completed and published a comprehensive privacy impact assessment even though it is not a statutory requirement. The purpose of the privacy impact assessment is to ensure any potential privacy impact on individuals as a result of the introduction of Eircode postcodes is recognised and addressed. The assessment has concluded that the introduction of Eircode postcodes is unlikely to have any significant adverse effect on the right to privacy. All the recommendations contained in the assessment have been incorporated into this Bill. The Bill represents a sensible and pragmatic approach to data protection as it relates to postcodes. It sets out the high level principles underpinning a protective framework and strikes a balance between ensuring the commercial viability of postcodes while at the same time underpinning data protection.”

As the (36 page) executive summary of the PIA is now available, I thought it might be useful to share some thoughts with fellow practitioners who are charged with the requirement to write PIAs.

1.     Who is your audience?

a.     If the data controller is a public authority, the language used in the report should not be too technical, as Freedom of Information provisions mean that it may be made available to members of the public, and they would expect to understand it.

                                               i.     Consider incorporating in the report an annex that explains the project in non-technical language.

                                              ii.     Consider incorporating in the report an annex that defines technical terms and acronyms in plain language.

                                             iii.     Be careful when listing in an annex, the names/ job titles of individuals who were consulted as the assessment was being written – these individuals have privacy rights, too, and the more junior employees may not expect to be publicly identified with the project.

                                            iv.     Take care to ensure that the language used in describing the potential privacy risks is written in ways that make it difficult for other parties to use extracts from the PIA out of context.

b.     If the data controller is not subject to Freedom of Information provisions, the language used should still be sufficiently clear that senior managers can understand the process that was followed to reach the conclusions and recommendations in the assessment. The author can be more frank in their assessment of the project if it is clear that the document is for internal purposes only.

2.     Who should be consulted?

a.     If the data controller is a public authority, there may be a greater need to ensure, if citizens rather than employees are to be impacted by the project that is under assessment, that the concerns of citizens are properly taken into account. This is also to ensure that the project under assessment not only meets the legal conditions that are set out in the data protection legislation, but also that from a more general fundamental rights perspective, the project is likely to be socially acceptable in that it meets the legitimate expectations of the community.

b.     If the data controller is a not a public authority, there is less of an obligation to consult customers or potential customers.

3.     What role should project managers play in carrying out effective assessments?

The role of project managers is to provide factual information to the assessor. It should not be assumed that these managers have a significant amount of privacy experience. Accordingly, the task of analyising the facts from the perspective of compliance with privacy obligations and data protection legislation should be left to suitably qualified and experienced privacy professionals.

4.     How frequently should the PIA be revised?

a.     PIAs can be viewed as snapshots that are taken at a particular stage of the project. If the assessment is carried out at an early stage in the project, it is possible that quite a wide range of issues which need to be addressed will be highlighted. As the project matures, many of these issues ought to be resolved, so a PIA review mid-way through the project is useful to ensure that not only have existing risks been addressed, but that no new issues have emerged.  If new issues do emerge, these should be captured in subsequent versions of the assessment.

5.     What summaries of the PIA should be prepared?

The Article 29 Working Party has recommended that Privacy Impact Assessments should include a section to demonstrate more generally compliance with the privacy targets. Since the privacy targets are mandatory and not negotiable, assessments should describe how each target is being implemented, or explain why it has not been implemented.

Accordingly, it is useful to consider incorporate a one or two page table summarizing the issue.

Sources:

http://www.eircode.ie

http://oireachtasdebates.oireachtas.ie/debates%20authoring/debateswebpack.nsf/takes/seanad2015062500002?opendocument#R00100http://www.dcenr.gov.ie/NR/rdonlyres/7F434454-9CCB-4D0C-A04C-5E265C0B5DE6/0/PIAExecutiveSummary.pdf

http://oireachtasdebates.oireachtas.ie/debates%20authoring/debateswebpack.nsf/takes/seanad2015062500002?opendocument#R00100
http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2013/wp209_en.pdf

.

Privacy trumps the free flow of personal data

“The free flow of personal data is not a fundamental right. Privacy is a fundamental right.”

So said the ICO’s David Smith at a data protection KnowledgeNet event in London today.

It's a phrase that will be mulled over for some time. But when can data controllers assert rights that are equivalent to those of individuals? What rights do data controllers have (who, after all, also benefit from human rights legislation)? When is it that their right to exercise freedom of expression can be quashed by someone who tries to exercise a right to forget?

And how can the person who wants others to forget actually achieve that aim? What practical steps are really effective? Perhaps the courts will, in the fullness of time, clarify what obligations search engines have to identify and then remove all hyperlinks to data that is considered (by some) to be unacceptable to remain in the public domain.

These are some of the really interesting challenges that are facing those who are brave enough to stick their heads above the policy parapet and propose potential solutions.

And who is it that ought to be leading the discussions on this issue? Should privacy regulators assume that they must take the lead? Are privacy regulators sufficiently dispassionate about the issue, or are they so heavily focused on privacy that their mindset is against the competing rights that others exercise, in the name of self expression?

We’re back to that awful word “balance.” Somehow, the regulators will need to balance fundamental privacy rights with other rights, such as the right of self expression. Fortunately, help was on hand today. Anya Proops of 11 Kings Bench Walk was able to explain to the audience what data protection rights were in the ascendant, and what issues still needed to be addressed by the Courts. My, she’s good. In the fullness of time, she’s going to be on the bench, opining on whatever issues are left to address.

The second half of the event focused more narrowly on the General Data Protection Regulation, and featured Bruno Gencarelli from the European Commission and Wojciech Wiewiorowsk, the Assistant European Data Protection Supervisor.

Bruno will be leading for the Commission as the informal triologue discussions on the GDPR get underway, and it was useful to hear his defence of “the perfect, as always, proposal of the Commission”.  Quite how he and his team will find the time to discuss and find a common approach with the other stakeholders to all of the issues that need to be negotiated and agreed, to meet the Commission’s self imposed deadline of completing the task by the end of the year, is beyond me.

It emerged that the compromise ceiling for financial sanctions against Google & Facebook transgressors could be 3% or 3.5% of global turnover. But then again, I might have been dreaming those figures. Bruno did speak for quite some time.

Wojciech knows how to charm an audience. He started his presentation by emphasizing how the EDPS was not a super supervisor, but simply one privacy supervisor, among many others. Yes, the EPDS had a role to play by offering opinions on a range of proposals published by the European Commission, but he left the delegates in no doubt that it was the role of the EDPS to facilitate the work of the Article 29 Working Party (and possibly subsequently the European Data Protection Board), rather to automatically assume that it would lead it.

Wojciech also paid tribute to the incredible influence that UK courts had on the development of data protection law throughout Europe. We may think that, in other areas, the Brits are widely ignored, but certainly in terms of privacy law, the Europeans do sit up and take notice. The main reason for this is that we operate in a language that is easy to use – so reports of British cases travel further much than, say, cases decided in the Czech, Hungarian, Polish or Estonian languages.

The packed audience was left with plenty to think about. Actually, it makes a change to attend a privacy event and leave with so much to think about. Lots of breaking news – about the Bulgarians trialing an automated pre-PIA tool, and what some companies were doing to undermine data protection professionals within those organisations. But I won't be blogging on those subjects – at least, not yet.

.

The awful dilemma of the GPDR and 15 June

First, I should mention that the notoriously indiscreet world of data protection has another document to drool over.

Thanks to our friends at Statewatch, we now have the first draft (of which will be many drafts) of the notorious 4 column document, from which the final GDPR is crafted.

Here, sitting alongside each other, is the original text of the Regulation, as proposed by the European Commission, and the versions that the European Parliament has and the European Council is highly likely to recommend.

The bunfight will focus on the 4^th column. What text will the drafters develop that is satisfactory to all the negotiators in the room? For that is what will be slipped into the 4^th column.

Eventually, when all 630 pages of the document have text in the 4^th column, someone will announce “Ladies and gentlemen, we have done it”. Then, data protection professionals outside the magic circle of trusted advisors / lobbyists / privacy advocates and geeks who have already seen it will get their change to work out whether they can both understand and implement what it is that has been agreed.

The current fly in the ointment is the obtaining of the final agreement of the European Council to their draft (ie final agreement on the contents of the 3^rd column). 

The pragmatic Brits have a teeny weeny problem over the 3^rd column right now. Although we still have a Minister for Data Protection, and although the general election next month may herald a new Minister, replacing Simon Hughes, its going to be really hard to find anyone really important who is prepared to travel to attend a Council Of Ministers meeting to finalize the bloody thing.

Why? Because the European Council appears to be pulling out all the stops to reach final agreement on the 3^rd column on 15^th June. Representatives are due to be locked into a room and told that they can’t emerge until agreement has been reached. Their iPads will be confiscated, refreshments will be gradually withheld, and the translation channel featuring winning songs from the past ten years of the Eurovision Song Contest (the other channels translate the current speaker into all the tongues of the European Union for the delight of all delegates) will be disenabled.

15^th June is a big day for the European Council. It has been decreed that, come what may, agreement will be reached on this day.

But, and this is a big but, the most senior British privacy Ministers have no intention of being anywhere near that meeting on 15^th June. Instead, they want to be at the Royal tea party that will be held in the middle of a field in Runnymede, near Windsor. With HMQ - and our very own Information Commissioner. 

Why?

Because 15^th June 2015 marks the 800^th anniversary of the agreement of the Magna Carta. A huge celebration is planned. There will be speeches – and possibly even a reenactment of the great event. Our own Queen Elizabeth could play the part of King John, while our new data protection Minister would represent the rebel barons.

So, Minister, what would you prefer? Cucumber sandwiches with HMQ, or being stuck in a basement room in Brussels hammering out a document that will then be torn apart by a year worth of triologues?

I know what I would prefer.

[Most of my chums at the Crouch End Chapter of the Institute of Data Protection) expect the Council of Ministers to start an extended debate on 15th June, but to delay the final vote until our most important privacy Minister has taken their tea with HMQ at Runnymede and has then travelled (economy class) to Brussels. This ought to enable agreement to be formally reached the following day.] 

Source:

http://www.statewatch.org/news/2015/apr/eu-council-dp-reg-4column-2015.pdf

.