Glasgow High Court,
1 Mart Street,
Data Protection and Digital Information (No 2) Bill: a second attempt at data protection reform
In the summer of 2022, the then Secretary of State for Digital, Culture, Media and Sport, Nadine Dorries MP, introduced the Data Protection and Digital Information Bill into the House of Commons. That Bill proposed various changes to the UK GDPR and the Data Protection Act 2018. The Bill had its first reading in the House of Commons and shortly before its scheduled second reading, it was dropped from the parliamentary calendar and further consultation with business was announced. Nothing further happened with the Bill until last month when it was formally withdrawn and the Secretary of State for Science, Innovation and Technology, Michelle Donelan MP, introduced the (imaginatively named) Data Protection and Digital Information (No 2) Bill. This piece will briefly consider some of the data protection reforms proposed in the second Bill.
The Information Commissioner
One of the most significant proposed changes is to abolish the office of Information Commissioner and replace it with a new body to be called the Information Commission. As things currently stand the Information Commissioner is the regulator for data protection across the whole of the United Kingdom; he also has responsibility for regulating and enforcing other legislation in the field of information law. The model of having a single office holder as the regulator for data protection (supported by staff and other officers appointed by them) has existed since the Data Protection Act 1984 created the Data Protection Registrar. That office has, over the decades, morphed into the current office of Information Commissioner. However, the government considers that the model which has operated thus far is no longer appropriate for such a large regulator with functions across a number of areas.
The new Commission would inherit the functions and powers of the Information Commissioner so functionally not much would change beyond who was exercising those functions. However, some other aspects of the Bill have caused concern about the future independence of the Commissioner and, in due course, the Commission.
The Chair of the Commission would be appointed by the King on the advice of the Secretary of State (as is currently the case for the Information Commissioner), but other members of the Board would be appointed by the Secretary of State. The Chief Executive would be appointed by the non-executive members of the Commission (which would include the Chair) but must consult with the Secretary of State before doing so.
Clause 28 of the Bill proposes introducing a new section 120E into the Data Protection Act 2018 which would empower the Secretary of State to issue a statement of priorities in relation to data protection. The Commissioner (and later, the Commission) would be required to have regard to that statement of priorities when carrying out their functions. There is a degree of concern that these provisions would impinge upon the independence of the regulator. However, the duty to have regard to the statement of priorities would not apply to the carrying out of functions in relation to a particular person, case or investigation. This suggests that the regulator would continue to be entirely independent from the Executive in the carrying out of their investigatory and enforcement functions. These provisions could raise some difficulties in relation to the adequacy decision by the European Union in respect of the United Kingdom; that is certainly an area to keep under review as it could have a negative impact upon data flows between the United Kingdom and the European Union.
Clause 36 of the Bill proposes introducing a new section 148A into the Data Protection Act 2018. This would give the Information Commissioner the power to issue an “Interview Notice”. This power would enable the regulator to require a person to attend an interview in the circumstances outlined in the proposed section 148A(1); this includes where the Commissioner suspects that a criminal offence has been committed.
It would be possible to appeal the notice to the First-Tier Tribunal and as such the date and time of the interview cannot be before the expiry of the period in which an appeal may be made. There would be no requirement to comply with the notice until any appeal against it had been determined or withdrawn.
It will be a criminal offence, in responding to such a notice, to make a false statement knowingly or recklessly in a material respect. However, other than in relation to the offence of making false statements, any statement made in response to an interview notice would not be admissible in criminal proceedings brought against that person for offences under the Data Protection Act 2018 unless (i) in giving evidence at trial the individual states something that is inconsistent with the earlier statement; or (ii) it is introduced or adduced by the individual or on their behalf.
There would be other protections, for example, against self-incrimination and in relation to material covered by legal privilege.
Spam texts and E-mails and nuisance telephone calls for the purposes of direct marketing is a matter of public concern and an area in which the Information Commissioner remains active in terms of enforcement. The Bill proposes several changes in this area.
Direct Marketing is principally regulated by the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). There is currently no definition of direct marketing within PECR; instead, it is necessary to look to the Data Protection Act 2018 for the definition. Clause 81 of the Bill proposes introducing a definition of direct marketing into PECR; it is the same definition as is currently provided for within the Data Protection Act 2018 so it changes nothing in substance but will make PECR more readable.
So-called “non-commercial organisations” would be able to rely upon what has come to be known as the “soft opt-in” for the purposes of being able to undertake direct marketing. It would apply to organisations which have charitable, political or non-commercial objectives, enabling them to undertake direct marketing to further their objectives using personal data collected from people who have expressed an interest in or provided support for their objectives.
The Bill proposes that the Secretary of State will be able to make Regulations exempting marketing communications for the purposes of political engagement from the direct marketing provisions, provided that they are not directed at children under the age of 14.
The enforcement provisions for PECR will become linked to the enforcement powers within the Data Protection Act 2018. Currently, the Commissioner’s enforcement powers in relation to PECR are linked to the Data Protection Act 1998, which has been repealed other than to the extent it has been saved for the purposes of enforcing PECR. This will see the potential financial penalties for breaches of PECR increase from the present maximum of £500,000 to the same as those under the UK GDPR (£17,500,000 or 4% for global turnover, whichever is greater).
The Bill also introduces a new obligation on electronic communications network providers to notify the Information Commissioner of “any reasonable grounds” that they have for suspecting that a person is contravening or has contravened the direct marketing rules. There will be penalties for non-compliance. What “reasonable grounds” means is unclear, but the Explanatory Notes accompanying the Bill suggest that interception or examination of the content of communications won’t be necessary for compliance.
Article 30 of the UK GDPR, which makes provision for ‘Records of Processing Activities’ is going and will be replaced with a new Article 30A. Controllers and processers will be exempt from a need to keep records of processing “unless taking into account the nature, scope, context and purposes of the processing, it is likely to result in a high risk to the rights and freedoms of individuals.” Section 61 of the Data Protection Act 2018 is also going and will be replaced by a new section 61A on records of processing activities in the context of law enforcement processing.
The first iteration of the Bill proposed that businesses could rely upon the legitimate interests ground of processing, without the need to conduct a balancing exercise between the legitimate interests and the rights and freedom of data subjects, where the legitimate interests in question were “recognised”. These recognised legitimate interests would be:
- national security, public security and defence
- safeguarding vulnerable individuals
- democratic engagement
The new iteration of the Bill maintains this position; however, it goes on to provide examples of situations where the legitimate interests ground of processing might be an appropriate lawful basis for processing personal data. These examples are not part of the “recognised legitimate interests” and so a legitimate interests assessment would still be required. It would seem to be the intention that this provision is designed to try and clear up some of the misunderstanding around the legitimate interests ground of processing.
Complaints by Data Subjects
The Bill also introduces a new right for a data subject to complain to the controller about the processing of their personal data. Data subjects have always been able to make such complaints, but the law will now require the controller to deal with such complaints and to facilitate them. Furthermore, the Commissioner may refuse to accept a complaint by a data subject about a controller’s processing where no such complaint has been made to the controller first and it is less than 45 days since the complaint was made. The Bill also proposes giving powers to the Secretary of State to require controllers to inform the Commissioner of the number of complaints they have received from data subjects.
The Commissioner will also be able to refuse to deal with a complaint made by a data subject where the complaint is vexatious or excessive. There will exist a right of appeal to the First-Tier Tribunal against any refusal by the Commissioner to deal with a complaint made to him by a data subject. The requirement to complain to the controller would only apply before making a complaint to the Commissioner, it will not, as a matter of law, be a gateway to raising court proceedings for compensation or a compliance order.
The definition of personal data will be slightly narrowed so as to limit the assessment of identifiability to the controller or processor or anyone likely to receive the information. As the definition is drafted it means that if anyone anywhere in the world could identify the data subject then it is caught.
The Bill is still in the early days of its journey through parliament and there will be plenty of opportunities for amendments to be proposed (and made) to the Bill before it completes that journey; however, the Department of Science, Innovation and Technology does not expect much in the way of amendment to the Bill. Some of the proposals within the Bill are significant while others are much more mundane in nature and are ones which the government hopes will make some aspects of the data protection framework clearer to businesses.
Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.
Optimum Advocates are delighted to announce that four members of our stable have been appointed to the rank and dignity of King’s Counsel this year; Louise Arrol, Lorraine Glancy, John McElroy and Paul Nelson.
Louise, Lorraine, John and Paul were among the 16 new silks that were appointed this year.
Louise currently has an extremely busy criminal law practice and is extremely well versed in the preparation of cases with complex evidence such as cell site analysis, firearms discharge residue, surveillance, use of trackers and DNA. Louise has also built up an extensive practice defending sexual crimes. It is without doubt that she is one of the most instructed counsel in this area, having defended numerous rape trials. She regularly prepares and argues applications under section 275 of the Criminal Procedure (Scotland) and has already conducted examination of many witnesses giving evidence on commission. In particular, she has specialism dealing with complicated psychiatric, psychological and medical evidence in sexual abuse cases. She has particular specialism dealing with accused persons who have psychological and psychiatric conditions.
Lorraine is currently a full time Advocate Depute. Prior to joining Crown Office earlier this year, Lorraine was instructed in a wide variety of criminal trials, including attempted murder, fraud, computer crime, indecent images and misuse of drugs but with a particular emphasis on cases involving allegations of sexual misconduct, rape and allegations of historical sexual abuse.
John is also currently a full time Advocate Depute. Prior to joining Crown Office in October 2021, John had substantial experience in all aspects of the practice of criminal law from first interview with accused persons to running cases in the Judicial Committee of the Privy Council. He practised as a Solicitor Advocate from 2000 until he called at the Bar in June 2013.
Paul also has an extremely busy criminal practice. Paul has been instructed, as leading or sole counsel, to defend a wide range of the more serious crimes known to the law of Scotland, these include murder, attempted murder, rape, fraud, serious and organised crime offences, etc. Paul has a wide knowledge of and interest in forensic medicine and science in general and, in particular, the use of DNA evidence, and the limitations of such evidence. That knowledge has been applied for the benefit of those for whom he has been instructed in a number of cases that have turned on the successful cross-examination of forensic scientists and doctors.
Practice Manager, Angela Bath said “We are delighted for Louise, Lorraine, John and Paul on their appointment as King’s Counsel. They have all worked extremely hard to achieve this elevation and it is very well deserved. We wish them all the best in the next chapter of their legal careers as Senior Counsel.”
This evening the members and staff of Optimum Advocates join the nation in mourning the passing of Her Majesty Queen Elizabeth II. None of us have a memory of anything other than the second Elizabethan era, and as such feel with great sadness, the loss felt by all of Her Majesty’s subjects, by others within the Commonwealth of Nations, and by the World at large. It is doubtful if any head of state, alive or dead, has ever offered such a constant figure of stability to so many, and this she did with persistent grace, dedication and humility. The thoughts of all of us are with her family who seamlessly carry on her legacy.
The seamless succession of the Monarchy is such that we have this evening amended the post-nominals of our Senior members to reflect that they are now His Majesty’s Counsel.
Long Live the King.
Louise Arrol was appointed for a five-year term by the Lord Justice General, after consulting the Scottish Ministers, to the Scottish Sentencing Council as Advocate Member on 28th July 2022.
Niall Raymund McCluskey July 1968 to April 2022
The entire membership of Optimum Advocates was both shocked and saddened to learn, this morning, of the death of one of its members, Niall McCluskey. In his untimely death at the age of 53, we have lost true character, and inestimable colleague.
Niall was admitted to Faculty in 1995, having served in The Crown Office and Procurator Fiscal Service following his graduation from Aberdeen University, and having spent time as a defence solicitor in Edinburgh. Called to The Bar at the age of 27, as a young advocate, Niall readily accepted instruction at both first instance and in the appeal court. This prepared him well for the incorporation of the European Convention on Human Rights into domestic law from 1999, a development over which Niall enthused, and effectively gilded his already well-honed reputation. This new dawn also drew Niall into other areas of law to which the Convention was applied, and in particular extradition cases, where he became one of the most experienced Counsel in that field. But the Convention was not simply an area of Law to Niall. It represented his compassion for his fellow man, and genuine sense of humanity. His sense of giving was manifest in all aspects of his life, and he gave of himself unconditionally to those who devilled to him. He also took time to contribute to the effective training of his peers, and ensured his knowledge and that of his fellow lawyers was made available to others.
Today, however, as a stable, we mourn the man beneath the wig. He was a man full of fun, compassion, wit and good humour. He will be remembered as a worthy opponent, and above, all, a loyal and generous friend.
Not for the first time, the Gown Room has lost one of its characters.
But our sense loss is inconsequential to that of a family which has lost a husband, and father. Our thoughts are with his immediate family and loved ones beyond.
May he rest in peace.
Niall’s close friend, university peer and in recent decades, colleague Dale Hughes, Advocate had this to say of Niall:-
I first met Niall at University when, like the other callow youths, we knew so little and partied a bit too much. He was even then a larger-than-life character with a ready enthusiasm and not a little charisma.
Niall could talk -for hours on end! : about Law- he was so articulate and a very gifted and clever thinker, and many colleagues sought his sensible views on court strategy; about books – he was an avid reader on politics philosophy and other current world topics ; about music – he had an encyclopaedic knowledge of music and loved live gigs. I spent many a happy night at Barrowlands with him among crowds who were mostly our children’s age.
Niall started off his career in Crown Office, was briefly a defence agent and went to the Bar early. He quickly gained a stellar reputation and was one of the busiest and best senior- juniors at the criminal bar. He served as an advocate depute and also was involved in many significant appeal and extradition cases – such was his breadth of talent.
Above all he was a decent and humane man who cared passionately about people; his vocation and justice for all accused to get a fair trial which is the key facet for this tough job we do. He was highly articulate and was equally adept in the appeal court as the trial arena in front of juries. It goes without saying he always did the best possible for clients without compromise.
Always modest of his achievements during his long and distinguished career at the Bar – he could easily have taken Silk – he also found time, in his busy life, for his many friends and interests such as sport, music, literature and current affairs.
Personally, I will miss him terribly as will all his colleagues and friends at the Bar. The tragic loss of another very able, kind and decent man is hard to bear coming in the wake of the recent loss of Stephen. It is a sad reminder of the strains of life and this job we do, and the need to support each other.
My thoughts are with Jacqueline and the children at this most difficult and sad time.
Tony Graham QC, was elected as Chairman of Faculty Services Limited on 9th December 2021.
We are delighted for Tony on his recent appointment and are thankful for all of his hard work as stable director over the last 10 years.
We wish Tony all the best in his new role!
January 28th – CPD Seminar for the Glasgow Bar Association by Mark Moir
March 30th – CPD Seminar on Family Law to CLAO by Rosemary Guinnane
October 29th – CPD Seminar to the Kilmarnock Bar by Patricia Baillie
November 25th – CPD (via Zoom) “Remote Juries: The issues we face” by Donald Findlay QC
We are delighted for our Maryam Labaki who has been appointed as a Part-Time Sheriff in Dunfermline. We wish Maryam all the best for the best in her new chapter.
We are delighted that our Mark Moir has been appointed to the rank and dignity of Queens Counsel.
We are thrilled for our Gillian Ross on her appointment as Deputy Director of Training and Education at the Faculty of Advocates.