The Government of British Prime Minister, Boris Johnson, is set to ditch data-protection. It risks creating a wild west where peoples’ personal information will be exploited for profit and political purposes.

ImpACT International for Human Rights Policies expose, with growing apprehension, the UK Government’s consultation on data, innocuously labelled ‘Data: a new direction’. The intention is clear. The Government recognising that your data is ‘one of the most important resources in the world’[i] are planning to move away from the mandated consent model of collection to one where information can be even more easily accessed, processed, and sold.

The justification sets up the bogus presupposition that the British public are suffering from ‘consent-fatigue’ the tiresome process of accepting cookies online. Whilst there is a small inconvenience, the Government’s reasoning is little more than a manufactured pretext for the abandonment of hard-won protections. Whilst some do blithely accept web-based requests to collect information and many rarely read the ‘small-print’ the solution to this ‘problem’ is to raise awareness as to consumer rights and how and why people can opt-out of data harvesting to avoid having their information hijacked. Similarly, Parliament should strengthen existing protections. Do the British public support abandoning data protection? Evidence of how people in the UK objected to the sharing of their medical information strongly suggests that many people are unwilling to expand access and are alarmed by data liberalisation.

 

Present rights

The Data Protection Act 2018 has protected people from harassment and defended workers from having to divulge personal and medical information to their employer. It has limited some efforts to obtain and exploit personal information and placed the principle of consent at the core of how citizens information is managed and when and how it can be used.

Indeed, Article 5 of the UK’ GDPR, ensures that data is only “collected for specified, explicit and legitimate purposes” and is “adequate, relevant and limited to what is necessary.” Abandonment of that firm principle will not only endanger data sharing in the European Economic Area but also allow the free for all that many privacy campaigners fear.

 

A controversial consultation

The British Government’s Department for Digital, Culture, Media, and Sport initiated a now closed consultation[ii]  that was difficult to engage with, perhaps deliberately so. Indeed, public pronouncements suggest that the government has already made up its mind or at least had its mind made up for it by corporate lobbyists. The aim seems to be to make life easier for data processors and controllers, in some cases allowing Artificial Intelligence to be the sole arbiter, rather than protecting peoples professional and personal freedom.

 

Recommendations, taking back control of personal data.

ImpACT International, the London-based human rights think tank propose the adoption of the following policies that should replace the Government’s plans to role back data protection. Conversely, ImpACT propose protecting and enhancing policies that keep your information safe.

1. The Government should renew the consultation creating a nationwide discussion on data but with markedly different terms of reference.
   1. The aim should be to expand existing protections and allow people to take back control over their personal information.
   2. The views of representatives of small and medium sized enterprises, and their submissions, should have primacy over those from larger corporations.
   3. Consult with ImpACT International, Big Brother Watch, and other human rights groups on any future legislative changes.
2. Accompanying the reconstituted consultation, the Government should raise awareness as to the importance of data protection and advise citizens on how they can maintain their privacy and manage their personal information.
   1. Information Technology and Ethics classes in education, including higher education, should include training on how to keep data safe and free.
3. Parliament should create a new legal culture and code of practice to protect personal data. This will include:-
   1. An increased role for the Information Commissioners Office (ICO) which will have an enhanced data protection role.
   2. There should be active judicial oversight and appeal over any decision by the ICO not to act or take sanctions following a complaint.
   3. Legal protections for whistle-blowers who expose abuses of data by both private and public bodies.
   4. Codify a new reinforced charter on data protection principles and establish the requirement that any public body or private company that wins Government contracts has to abide by both the spirit and letter of the law and its accompanying code.
   5. The ICO will have the responsibility to review and report on contractor’s compliance under recommendation 3.3.
   6. Establish the principle that any reduction on data protection can only be approved by a national and binding referendum.
4. Recognise the overmighty and near omnipotent power of some corporations who own multiple social media platforms.
   1. Establish a Royal Commission to investigate big tech power and make recommendations on reforming the market.
   2. Competition in the market and a reduction in a company’s capacity to obtain data requires the breaking up of tech conglomerates using anti-monopoly procedures.

 

The Government’s new regime (unless we stop it)

The consultation and its supporting document[iii] which sets out some of the general changes the Government would like to introduce. The principle of consent and threshold of when to act are to be markedly raised, making it easier for your data to be used. Should there be a breach this need only be reported if there is a ‘risk’. People will be subject to open ended research that has not been defined nor specifically consented to. The changes will allow for a much wider use of your information on a broad range of ‘legitimate interests’. The Government also proposes to remove the right not to be subject to automated procedures.

Subject rights will be subject to the interventions of technology. Artificial intelligence (AI) will have an expanded role to trawl through and collate personal data under a purely automated basis. Article 22 of the Data Protection Act 2018 currently gives British citizens the right not to be subject to machine decision making that solely decides matters with important implications. That right could be ditched under Government plans. Those who feel that such a process has been conducted unlawfully will however not be able to appeal to a human against the actions resulting from AI judgments made about their data. Under this new system the computer says no to privacy and yes to profiling[iv]. There are also implications regarding healthcare. Processing of patient data by AI, already a tool in medical matters, may partly take care from real life clinicians awarding it to complex systems few can understand nor engage with.[v]

Whilst the consultation mentions one of the aims is to ‘ensure the Information Commissioner’s Office (ICO) is equipped to regulate effectively in an increasingly data-driven world the role of AI will inevitably reduce the ICO’s power. The likelihood that personal information will end up being crunched overseas by those outside of the authority of the ICO negates some of the good intentions future changes may have.

British citizens should not just be alarmed about how businesses will snoop on their personal information and use it, expanding data mining is also a concern. It will lead to an international intrusion into private information where your life, interests, passions, opinions, could all become commodities to be bought and sold on global markets to those that are less scrupulous than British businesses. There is every likelihood that once sent over-seas it will be subject to fewer restrictions than in the United Kingdom.

 

Economic risk

The Government may think these changes help the economy, certainly their proposals will be a boon for big tech and large corporations that have the means to collect and crunch your data. However, whilst oligarchs will benefit by allowing a trade in consumer information and from their businesses being allowed more use of peoples’ data, there will be comparatively less opportunities for less well-resourced companies. Small and medium sized enterprises may fall further behind their big rivals. This will not help the functioning of the free market the Government purports to be in favour of. Yet, there are even bigger risks to business and the economy if the government liberalises too far.

A divergence from European Union GDPR standards may lead to a situation where British data has insufficient protections. In that scenario it could lead to Brussels revoking their ‘adequate’ assessment of current UK data handling. Losing that status could prevent business from receiving the benefits of data sharing throughout the European Economic Area. With current disputes existing between the UK and the EU overfishing access, and Northern Ireland some businesses may consider it unwise to provoke a third dispute that could undermine trade with the block that is still the UK’s largest single business partner. Nevertheless, the UK Government appears to be prioritising data adequacy agreements with overseas jurisdictions namely the United States which has less enlightened data protections and is home to the most vociferous miners of personal information. To again overhaul the law in the UK will create more confusion. The current clearly defined rules are arguably an aid to economic development as businesses have surety as to the legal environment they are operating in.[vi]

 

Elite merger

Digital exploitation of people’s personal data for commercial reasons is not the only concern. Civil liberties are also threatened by the Government’s proposed reforms. With little discernible difference between corporations, civil servants, and senior politicians – many of which often operate in a revolving door – the growing corporate culture of intrusive observation of consumers will become more troublesome, that is unless people are put at the centre of any changes and not the interests of largely unaccountable companies.

 

Robert Oulds, Executive Director of ImpACT International states, “Alarmingly, the trend of technology being harnessed to spy on consumers and citizens is growing, this will be to the detriment of freedom and will make already overmighty corporations, who can exploit your data, even more powerful. An intrusive state allied with big business will only damage good governance and distort the proper functioning of a free economy.

“To dilute hard won protections will accelerate the process of citizens losing out to the emerging state-corporate complex. This transfer of power, wealth, and data from the people to the super wealthy uber-elite must end.”

Download Full policy here 🔻