Data Protection: Whither the EU’s SCCs …

It is possible that the European Commission will fail to provide the UK with a data protection adequacy assessment by the end of the year. It is also possible that, in the near future, the EU will publish revised sets of Standard Contractual Clauses to replace the existing SCCs in a bold effort to ensure that flows of personal data outside the European Union remain suitably protected.

So what?

If the UK receives an EU adequacy assessment, presumably the UK Government will simply anglicise the new EU SCCs and ask UK organisations to use the new versions for the Non-EU, UK - Rest of the World data flows.

But, if the UK does not get an EU adequacy assessment, some commentators will suggest that this is the time either to leave the existing SCCs alone, or to adopt a very different approach. 

The Conservative Party won the General Election in December 2019 on the manifesto promise that it would get Brexit done.

If the point of Brexit is for the UK to remove itself from the straightjacket  embrace of the European Union, it is surely now up to the UK to determine for itself what contractual clauses are really necessary, in today’s world, to safeguard personal data flows outside the UK. 

My experience of using SCCs over the past few decades is that few organisations take much, if any, notice of the clauses once they have been incorporated into a data processing contract. They are part of the non—negotiable legal boilerplating text that is slipped into a schedule towards the end of the contract. The very few occasions I’ve noted the processor’s lawyers raising an issue with any of the clauses have been the times when they had realised that “my side” had a right to (1) audit “their” processes, or (2) be consulted and provide prior consent to the use of sub-processors.  

What evidence is there that SCCs are of any value? I’ve never been involved in a contractual dispute with a processor that has required the parties to rely on the SCCs to address or resolve an issue. And, in the past 20 years of attending data protection conferences (with the exception of presentations on the never-ending Schrems cases) I’ve never knowingly come across anyone who has.

 

So, if I were to take an evidence-based approach, I would ask why it was necessary for the UK Government to change the existing SCCs, or why it was necessary to have them at all. What evidence is available to justify their existence, or at least to justify their existence in their current form? Why can’t any of the current clauses be capable of being negotiated between the parties on a risk basis? Why not give UK data controllers more flexibility?

Whatever tweaks are proposed by the European Commission will invariably require EU-based organisations to undertake an absolutely enormous repapering exercise. It could take years to complete. Many of my privacy colleagues are only now recovering from the repapering rigmarole that was required to meet the GDPR Article 28 requirements. To expect them to commission a similar exercise so soon is cruel (and costly). 

No doubt some EU-based organisations will want to ‘simplify’ their contractual arrangements by requiring contracts with all processors, regardless of whether the underlying personal data is within the scope of the GDPR, to be changed to reflect the new SCCs.

But why should the UK Government tell UK organisations to follow the EU’s approach if the EU had decided that the UK doesn’t have sufficiently adequate data protection standards in the first place?  Would the UK really want to copy a GDPR regime that did not properly respect the UK’s privacy standards? 

Isn't there a better approach?

I’m looking forward to a passionate debate. 

In praise of ... the Investigatory Powers Act 2016

A number of commentators will assume that, should the UK not receive an adequacy assessment by the European Commission with regard to its data protection standards, a key reason will be the impact of the UK’s Investigatory Powers Act (IPA) which prescribes how UK public authorities obtain personal data for national security and law enforcement purposes. 

I see the IPA as an outstanding example that Governments of all countries should adopt to ensure that public authorities act transparently and put effective mechanisms in place to ensure that human rights are appropriately respected. 

To recap, in 2016 the IPA brought together all the existing covert and overt statutory powers that were then available to enable the UK’s intelligence agencies, police and other investigatory authorities obtain intelligence and communications data. This included introducing new safeguards in the approval of the use of investigatory powers use and created a single independent Investigatory Powers Commissioner responsible for oversight.

In 2019 the Investigatory Powers Commissioner established the Office for Communications Data Authorisation. This body is responsible for safeguarding an individual’s right to privacy under the Human Rights Act 1998. It makes independent decisions on whether to grant or refuse communications data requests, ensuring that all requests are lawful, necessary and proportionate.

In terms of transparency, a great deal of information about how the IPA has worked in practice is available from the annual reports that have been published by the Investigatory Powers Commissioner. The first annual report, published in January 2019, was organised into chapters which reflected each of the powers the Commissioner oversaw and (its 129 pages) contained a significant level of detail as to how each of these powers were used. 

The second annual report, published in March 2020, has a different structure, with chapters on each of the types of organisations that are inspected and (its 138 pages) focused on the key findings from the inspections. This gives a clear sense of the range of issues that impact the different bodies. 

Many people will never be satisfied with the way the UK’s intelligence and investigative communities operate. But they should be reassured to some extent by appreciating the great care that is taken by the Commissioner and his staff, including the Judicial Commissioners, to authorise warrants using the ‘double-lock’ method (so decisions made initially by politicians and senior public officials must also be authorised by a judge before the warrant is effected); to conduct regular inspections of the agencies that have been authorised to use investigatory powers; and, when errors are reported, to carry out ad-hoc investigations into to determine the root causes. 

Additionally, some people may also be reassured through the work that is carried out by the Commissioner’s communications and policy staff, who engage with a wide range of opinion formers to enhance public confidence in the use of investigatory powers and improve understanding of the Commissioner’s independent oversight. 

Before the coming into force of the IPA, the Home Office and the UK's intelligence agencies spent much less time engaging with representatives of civil society and other opinion formers. Important lessons were learnt following the failure of the IPA’s predecessor, the Communications Data Bill, to reach the Statute Book and replace the Regulation of Investigatory Powers Act 2000. It was realised that, actually, the Government had a good story to tell about the care it took to respect human rights in the context of exercising powers to obtain communications data. Engagement with stakeholders outside the closed investigative world was something that should not be feared but embraced. Where opinion formers had concerns, these issues should be addressed. With more transparency, and more resources devoted to explaining how transparent the new processes were, the Government would have an even greater story to tell.  

In my experience, no UK intelligence, police or investigations officer has ever wanted to have had their reputations traduced by being unfairly accused of trampling over human rights. The Investigatory Powers Act has set out what behaviours are acceptable, and the Commissioner’s annual reports have evidenced compliance with these behaviours. 

As a specialist advisor to the Joint Parliamentary Committees that reviewed both the ill-fated Communications Data Bill in 2012, and the Investigatory Powers Bill in 2016, I’m honoured to have played a small part developing legislation and promoting investigative practices that ought to be the envy of the world.

The Schrems II decision – some EU data exporters will face a huge task to work out whether SCCs are sufficient

Many privacy professionals will be shocked to learn that, in terms of safeguarding personal data flows from an EU to a non-EU country, in the absence of an adequacy decision, more is required than simply slipping the right set of SCCs into a vendor contract. 

The CEJU has clarifiedthat one of the key tasks facing data exporters, when considering whether SCCs are appropriate, is to consider whether there is a conflict between the protections afforded by the SCCs and other local laws, particularly those laws that enable public authorities to access the data. If a conflict is discovered, data exporters will need to do something about it. 

The key paragraphs in the decision are: 

Although there are situations in which, depending on the law and practices in force in the third country concerned, the recipient of such a transfer is in a position to guarantee the necessary protection of the data solely on the basis of standard data protection clauses, there are others in which the content of those standard clauses might not constitute a sufficient means of ensuring, in practice, the effective protection of personal data transferred to the third country concerned. That is the case, in particular, where the law of that third country allows its public authorities to interfere with the rights of the data subjects to which that data relates. [para 126]

In the absence of an adequacy decision, a controller or processor may transfer personal data to a third country only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available…Those safeguards may be provided by standard data protection clauses drawn up by the Commission. However, those [GDPR] provisions do not state that all safeguards must necessarily be provided for in a Commission decision such as the SCC Decision.  [para 127]

In the absence of a Commission adequacy decision, it is for the controller or processor established in the European Union to provide, inter alia, appropriate safeguards. Recitals 108 and 114 of the GDPR confirm that, where the Commission has not adopted a decision on the adequacy of the level of data protection in a third country, the controller or, where relevant, the processor ‘should take measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject’ and that ‘those safeguards should ensure compliance with data protection requirements and the rights of the data subjects appropriate to processing within the Union, including the availability of enforceable data subject rights and of effective legal remedies ... in the Union or in a third country’. [para 131]

The contractual mechanism provided for in … the GDPR is based on the responsibility of the controller or his or her subcontractor established in the European Union and, in the alternative, of the competent supervisory authority. It is therefore, above all, for that controller or processor to verify, on a case-by-case basis and, where appropriate, in collaboration with the recipient of the data, whether the law of the third country of destination ensures adequate protection, under EU law, of personal data transferred pursuant to standard data protection clauses, by providing, where necessary, additional safeguards to those offered by those clauses. [para 134]

Where the controller or a processor established in the European Union is not able to take adequate additional measures to guarantee such protection, the controller or processor or, failing that, the competent supervisory authority, are required to suspend or end the transfer of personal data to the third country concerned. That is the case, in particular, where the law of that third country imposes on the recipient of personal data from the European Union obligations which are contrary to those clauses and are, therefore, capable of impinging on the contractual guarantee of an adequate level of protection against access by the public authorities of that third country to that data. [para 135]

I recommend 6 steps that privacy officers should take to assure stakeholders that the CJEU’s decision is being respected:

1. Document the data flows so it is clear what data is exported to what country.
2. Identity the relevant laws and practices, including national security laws and practices, that permit local law enforcement authorities and other regulators to access the personal data that is processed in those countries.
3. Consider how the GDPR rights of in-scope individuals may be adversely impacted by these laws and practices.
4. Identify what additional contractual measures would be necessary to achieve a level of adequacy with GDPR rights.
5. Discuss and agree the additional contractual measures with the data importer.
6. Return to step 2 at regular intervals to check whether the laws or practices have changed.

From a practical perspective however, the problems start at step 2. It can be hard, when a large number of data importers are engaged, to maintain a list of the relevant laws and practices, including national security laws and practices, that permit local law enforcement authorities and other regulators to access the personal data that is processed in non-EU countries. Will it always be possible to rely on the explanations and assurances provided by third parties, including the data importer, who might possibly have a vested interest in ensuring the correct spin is placed on any explanations they provide about local practices?

Let’s be clear. The CEJU’s decision does not only affect EU - US data flows. Personal data flows from the EU to just about every other country on the planet. And the majority of these countries will have their own national security and other regulatory laws. Official or unofficial English translations of these laws will have to be read and understood.

Unfortunately, life doesn’t get any easier after that.

Turning to step 3, it may well be challenging to document a comprehensive statement which explains how the GDPR rights of in-scope individuals may be adversely impacted by each of these laws and practices. As many organisations may lack the capacity to complete this task themselves, perhaps it could be carried out on their behalf by their trade associations.

With step 4, it may be even more challenging to identify what additional contractual measures would be necessary to achieve a level of adequacy with GDPR rights. Given that even the European Commission’s decisions on what contractual measures are appropriate have been quashed, twice, by the CEJU in the context of the US Safe Harbor & the Privacy Shield data transfer mechanisms, what hope is there for a significantly less-well resourced data controller to successfully identify all the right measures? Is this a task that even individual members of the European Data Protection Board are capable of completing?

The difficulty is compounded by the tight timescales that apply to many commercial contract negotiations. Assessments on the impact of the relevant laws in a particular country can’t take months, or years, to compete. If an organisation’s data protection team is unable to provide their contract negotiators with appropriate information and support within a matter of days or weeks, there’s a real risk that any advice from the data protection team will be ignored. 

On the matter of reaching agreement on any additional controls that should be applied to the data importer, where do you start? Given the poor understanding by many organisations of the context within which SCCs are currently used, it would be a brave commentator to forecast that it would be easy, or even practicable, to agree any additional contractual measures. This may particularly be the case when the data importer had not yet found it necessary to accept any new clauses to supplement the SCCS in contracts that importer had signed with other EU data exporters.

Alternatively, organisations might revisit their rationale for relying on SCCs in the first place, rather than any of the other complex data transfer mechanisms that are set out in Chapter 5 of the GDPR.

However, we are where we are. European data protection standards are high – and for a good reason. European politicians demanded a gold standard and that is what exists. In theory, anyway. 

The CEJU’s decision has moved a large number of contracts into a data protection wilderness. Precisely how many are there? Which can be remediated? If so, how? By when? And how active will the supervisory authorities be in requiring organisations to address this issue?

The peak summer holiday season has started. Even so, I hope that European data protection supervisory authorities will soon reach a common agreement on what the decision means, and explain how they expect, or will help, organisations to address privacy gaps that many thought the SCCs alone existed to fill. 

 

Privacy Shield shafted – but do SCCs really deliver better privacy protections?

Here we go again.

The compulsory Sunday morning church services for all Anglicans at my boarding school served as an opportunity for The Reverend James Culross, (or Druid, as we boys affectionately called him), to churn out stuff from the Book of Common Prayer. It was stuff designed to cleanse our souls and provide us with helpful words of comfort, to prepare us for the horrors that would be inflicted upon each and every one of us during the school week ahead. 

Was I, or were my school tormentors, better Christians at the end of each service? 

I think not. But we had all heard and we had all recited the required words, and that was evidently what mattered.

A couple of years into my boarding school experience, Druid updated the format of the Sunday service. The language was slightly more modern, and (most importantly) the Sunday sermon was shortened to 10 minutes.

 

But was I, or were my school tormentors, better Christians as a result of the revised format? 

I think not. But, again, we had all heard and we had all recited the required words, and that was evidently what mattered.

So, with that in mind, what are we to do with the CEJU’s decision, published today?

Presumably, most of the companies that have used the Privacy Shield will decide to adopt the SCC approach. Then, they can wait nervously for the European Commission to tweak the texts of the SCCs, and embark on another repapering exercise. Also, they can wait, perhaps less nervously, for some European organisations (or European data protection supervisory authorities) to decide that, in data protection terms, transfers to the USA is a lost cause because the recipients can’t offer sufficient guarantees. 

But will these companies, when religiously adopting the new SCC language, really deliver better data protection protections for the individuals whose data is in scope? I think not. But they will be using all the right words in their contracts, and that, to many people, is evidently what matters.

I doubt whether a shift from the Privacy Shield to the SCCs will fundamentally change the protections that are afforded to the relevant individuals. To be honest, I’ve not dealt with many companies that have relied on the Privacy Shield. But my experience of using SCCs to address the privacy risks associated with transborder data flows over the past two decades is that, in practical terms, they do little to protect privacy standards. I’ve found that:

1. Few organisations have staff who have much (if any) experience in knowing what SCCs are and when they should be used. 
2. It can be challenging to reach agreement with the other party on the role they play when they use “my organisation’s” personal data. To what extent are they a processor, a controller, or are they a combination of the two? Answering this question incorrectly leads to the wrong set of SCCs being used. 
3.  It can be challenging to determine whether there is a meaningful transfer of personal data in the first place (i.e. one that would require SCCs). The other organisation may be collecting personal data in a manner that would not trigger the requirement to use SCCs.
4. Different views exist on whether enough personal data is in scope to trigger the requirement to use SCCs in particular cases.
5. It can be unclear as to who is accountable should a risk-based decision be taken not to use the relevant set of SCCs.  It could be a range of people, including the person who owns the relationship with the third party, the contracts manager, the lawyer, the head of compliance or the privacy officer. 
6.  Once the contracts have been signed and stored in a safe place, accessible to just a few key staff, most people don’t actually realise that they contain SCCs.

The outcome of today’s decision is that lots of privacy professionals will have lots to think about in the months ahead. Battalions of consultants will help organisations find the right contracts and change the words. Legal and privacy budgets will either soar or be stretched to deprioritise other privacy work. 

However, as I’ve asked before, and might well ask again, will a shift from the Privacy Shield to the SCCs result in organisations delivering better data protection protections for anyone? 

I think not. 

But, these organisations will be using all the right words in their contracts, and that, to many people, is evidently what matters.

 

Warm words for the UK's intelligence privacy practices from the UN

It’s not often that the UK is praised for the manner in which its intelligence agencies adopt appropriate data protection standards. So let's give due acknowledgement to Joe Cannataci, the UN’s Special Rapporteur on the right to privacy, who has recently used some very warm words to comment on these privacy practices. 

Of the Investigatory Powers Act, he proclaimed: "I am satisfied that the UK systematically employs multiple safeguards which go to great lengths to ensure that unauthorised surveillance does not take place, and that when authorization is sought it is granted only after the necessity and proportionality of the surveillance measures are justified on a case-by-case basis ... Moreover from a UN perspective, I am greatly encouraged that the UK has translated its commitment to human rights globally into procedures which do not discriminate between UK citizens and non-UK citizens when it comes to safeguards and remedies available." And: "While the new set-up may still contain a number of imperfections, the UK has now equipped itself with a legal framework and significant resources designed to protect privacy without compromising security."    

Of course nothing is ever perfect, so of course he recommended additional improvements. Why? Principally because he was not confident that the UK’s system could be replicated in other countries "where the culture many be different and not sufficiently robust in key aspects such as judicial integrity." 

Mr Cannataci’s intervention at this stage is timely as it provides helpful briefing material for those who will need to argue that, come Brexit, the UK’s data protection standards are essentially equivalent to those of the EU, and that, therefore, the data flows between the UK and the EU should be permitted to continue without the need for additional protections in the guise of mostly incomprehensible (and stomach churning) data processing contracts. 

Given that Mr Cannataci acknowledges that only "a tiny minority of EU states ... have made a successful effort to update their legislative and oversight frameworks deaing with surveillance," I say that, overall, and certainly in the areas where it really matters, the UK's data protection controls are actually better than those that exist in other EU countries.  

Reference:
https://www.ohchr.org.uk/EN/NewsEvents/Pages?DisplayNews.aspx?NewsID+23297&LangID=E

.

Resuming the blog

Time to start blogging again.

In praise of ... Elizabeth Stafford

Many of even the most dedicated members of the UK’s data protection fraternity may not have heard of Elizabeth Stafford.

And that’s a shame.

Why?

Because she, along with a small band of colleagues in the Department of Digital, Culture, Media & Sport are doing great things.

How?

Because, as Head if EU Data Flows, not only is she working on ensuring UK businesses can rely on unencumbered data flows between the UK and the EU post Brexit, she’s also one of the key DDCMS officials working hard behind the scenes to fashion a new set of Privacy & Electronic Communications Regulations that are truly fit for purpose.

Whether she will succeed is another matter – after all, with regard to the PECR deliberations, the UK delegation is just one of the talking heads around an extremely large negotiating table. 28 very different EU Member States need to reach an agreement as to what the real problems are, and therefore what proper solutions, should be developed.    

What I am certain of is that she understands the issues that occupy the minds of the British stakeholders in these debates.

And, in her patient, pragmatic and insightful manner, she has explained the key issues to the DDCMS decision makers, and has helped develop a policy positions which, as far as I can judge, reflect the requirements of most sensible data controllers with in the UK.

Whether the DDCMS will be able to “sell” pragmatic British PECR solutions to a majority of the other 28 Member Sates around the table is an entirely different matter.

But it might not matter.

By the time the European institutions will have reached agreement on the precise form of the new PECR regulations and the precise date that the new rules will come into force, Brexit could have happened and the UK will have left the EU.

And then, UK policymakers will be faced with a choice.

Should they follow all the new PECR rules, or should they reserve the right to adopt a different approach?

While I’ve no idea what the final decisions will be (nor, who will actually be the DDCMS minister who will have to recommend said decisions to the Cabinet), I’ve no doubt that the UK will have developed a series of pragmatic options that will have been shaped by the great policy work that Elizabeth has recently been heading. 

So, Elizabeth, you almost certainly won’t get a gong for your great work - nor, any other form of official recognition, for that matter - but please be assured that there is a small band of privacy folk that do appreciate what you’re working to achieve.