Mates’ Rates

A while ago, I noticed an FOI request sent to the Information Commissioner’s Office on the website What Do They Know? I always keep an eye on requests made to Wilmslow, but this one was especially intriguing. It asked about payments made by ICO to external suppliers and consultants where the work had not been put out to tender. Even the progress of the request became notable because the Information Commissioner was seemingly incapable of answering it. The original request was made on February 26th 2019, and the ICO didn’t answer it until July 9th, more than three months after the legal time limit. Twice, the ICO set itself a deadline by which it would definitely answer the request, and twice it failed to do so. Remember friends, the Information Commissioner is the regulator for FOI. They’re supposed to ensure that other public sector bodies answer their FOI requests, but they’re terrible at answering their own. It’s worth noting Liz Denham was almost certainly aware of the request, as there is specific mention of her private office being involved during the glacial march towards a reply.

SIDENOTE: I made an FOI about enforcement and monetary penalties to the ICO that was due on July 16th. The Senior Information Access Officer handling my request told me that he hoped to provide me with a reply by Friday, and an answer came there none. I wonder if they’ll sit on it like they did here.

Anyway, due to the busiest July I have ever had (take that, haters), I missed the fact that the payments request had finally been answered, apparently in full, with no use of exemptions. At first glance, it’s nothing to get excited about. The total amount is less than £240,000, and though the highest payment made to anyone is £58000, the explanation of why this work was not put out to tender doesn’t sound outrageous:

A project brief was developed and three suppliers were approached for quotes. The requirements were in two parts, the first part was research and the second part was delivery. The second part of the brief was tendered to the supplier who completed the first after the proposed next steps were evaluated by the Board and it was agreed to implement their proposals – meaning they were uniquely placed to deliver the second part.

A couple of items did leap out at me. David Smith is not a unique or distinctive name, but it’s hard to believe that the particular David Smith (DP) Ltd paid £5152 for international engagement isn’t the same David Smith who was until recently Deputy Information Commissioner. Apparently, Smith is “uniquely placed” to deliver international engagement on behalf of the ICO. One would think that the Commissioner’s pan-continental roadshow would provide all the engagement the office could require, but I suppose throwing a few grand in an old friend’s direction isn’t the worst thing the ICO has ever done.

Equally, I doubt the Simon Entwistle who received £5791 is a different Simon Entwistle to the Simon Entwistle who was until recently Deputy Information Commissioner. Apparently, he is uniquely placed to carry out ‘Executive Coaching’. Granted, Entwistle is an old ICO hand, originally appointed by Richard Thomas, but it’s rather odd that having retired, the organisation has to pay him to coach the ICO’s senior people. Elizabeth Denham was paid around £180,000 in 2018 – 2019, and every member of the executive team is within spitting distance of 100K. These are well-paid, experienced people – if they’re in these jobs, that should be because they already have the skills to do these jobs. If they don’t, why were they appointed?

The sum paid to Entwistle for coaching isn’t massive, but it’s not the only one. Two different amounts, totalling £17,968, were paid to a ‘Philip Halkett’ for executive coaching, a role which he was once again “uniquely placed” to carry out. I cannot say for certain who Halkett is, and I am happy to be corrected if I have got it wrong. However, I believe he is a former Deputy Minister in Canada’s Ministry of Forests, and is based in British Columbia, where he describes himself on LinkedIn as ‘semi retired’. There are literally hundreds if not thousands of people offering coaching in the UK, but since Denham became Commissioner, the ICO has paid just shy of £18000 to a man who has no website or company that I can find, whose sole contribution to the internet is a single retweet about Denham, and whose main qualification for the job appears to be that he comes from the same remote corner of Canada as she does.

Halkett isn’t the only Canadian to feel the benefit of the ICO’s munificence. The former Information Commissioner of Canada, Suzanne Legault, is “uniquely placed” to deliver the secretariat for the International Commissioner’s Conference that Denham has been nominated to organise. It’s probably a complete coincidence that Legault is Canadian, and it’s not like organising an international conference isn’t a thing that loads of organisations do all of the time all over the world.

Most intriguing is the work carried out by a British customer service guru, Mark Colgate. Colgate has been paid £20000 to deliver “advice on development of service excellence programme and delivery of training to 500 staff”. If you visit Colgate’s website, you’ll find an uncharismatic man plugging some basic customer service ideas using gratingly clunky acronyms. Colgate sums up his philosophy as ‘Tofu’, which means that he is selling a fundamentally unappetising and artificial concept. I’m joking, ‘Tofu’ means ‘Take Ownership and Follow Up’. Another element of the Colgate Method is FAME, a concept that is so vapid and forced I can’t bear to reproduce it here.

Most regulators do not have customers. In particular, the ICO is not an ombudsman. It is not their job to give complainants redress or resolution. The ICO’s role is to ensure that controllers comply with the law – Article 57 of the GDPR states that the first task of the supervisory authority is to ‘monitor and enforce‘ the regulation. Handling complaints from members of the public is in there, but the public are not the ICO’s customers, any more than controllers are. The aim should not be to give either side what they want, but to ensure that controllers do those things that they are obliged to do, and that individuals’ rights are respected. A ‘customer service’ mentality is at best a distraction, and at worst, risks creating expectations that cannot be met. Many controllers have experience of ICO case officers who keep pushing a dead-end complaint because they clearly don’t want to give an angry or unreasonable complainant an answer they don’t like. If you swap it and make the controllers the customer, it’s at least as bad. The ICO has a long, shabby history of bending over backwards to appease ‘stakeholders’; the aforementioned David Smith was a big fan of describing the ICO as ‘enablers’ of business and innovation, rather than an organisation with a clear mission to enforce some specific laws.

But let’s assume that I’m wrong. Let’s assume that the ICO does need to spend thousands of pounds training its staff on customer service. What exactly is it about Mr Colgate’s brand of bargain basement Dale Carnegie that meant he had to be awarded this work without a tender process? Why, given the plethora of genuine customer service experts in the UK, was Mr Colgate “uniquely placed in respect of experience and expertise” to deliver this work, especially when it is so similar to so many other people? Is there any clue in his CV? Mr Colgate’s current berth as “Professor of Service Excellence” at the Peter B. Gustavson School of Business, which you can find in the fine city of Victoria. In Canada. Specifically, in British Columbia. About a ten minute drive from the Office of the Information and Privacy Commissioner for British Columbia, the last incumbent of which was a certain Elizabeth Denham. Fans of funny coincidences may also care to note that the current incumbent of that office is Mr Michael McAvoy, last seen running the ICO’s investigation into data analytics, a role that I do not believe was advertised externally.

At this point, you might be saying ‘so what’? Denham has thrown some work to her mates both home and abroad: is this so terrible? In my opinion, it really is. A good chunk of my work comprises a single day’s training, and in many cases, the client gets multiple quotes before giving me the work. I simply don’t believe the ICO’s claims that these people are the only possible candidates, especially as there was no competition or objective test. Public money should not be spent on a whim, especially not with the particular flavour of favouritism and self-indulgence that appears to be on show here. Bringing in your Canadian friends to provide luxury services that thousands of people in the UK are well-placed to provide shows lamentably poor judgement.

This is not the first time I have blogged about Denham’s terrible decisions. She did an advert for a commercial company. She enthusiastically endorsed a book she hadn’t read, making claims about the author which were not true. She made misleading claims in the media to get headlines and bragged on TV that she had used powers that actually don’t exist. She announced the Facebook fine prematurely and now faces accusations of bias and procedural unfairness. We haven’t had a decent Commissioner since Elizabeth France, but despite Richard Thomas’ over-caution and Chris Graham’s superficiality, both of them seemed able to do the job without the growing list of howlers for which Denham is responsible. Paradoxically, she is the most respected and popular of all the Commissioner’s incarnations and my complete lack of faith in her judgement makes me the bad guy, as usual. Nevertheless, questions need to be asked about what exactly is going on in Wilmslow, how decisions are being made, and how money is spent. There are a number of well paid non-executive directors on the ICO board; I would be keen to know what they think of all this.

Quis custodiet ipsos custodes, and all that.

Lateral Thinking

Last week, I wrote a blog about the ‘personal data agency’ Yo-Da, outlining my concerns about their grandiose claims, the lack of detail about how their service works and their hypocritical decision to ignore a subject access request I made to them. Predictably, this led to further online tussles between myself and Benjamin Falk, the company’s founder and ‘chief talker’. As a result of our final conversation, Yo-Da has effectively disappeared from the internet. Clearly, I touched a nerve.

Yo-Da’s website made concrete claims about what their service did, and in fact had done. There were testimonials from satisfied users, and three case studies. Although it was clear that the service wasn’t operating yet, the testimonials were unambiguous: here is what Yo-Da has done for me. There was no hint that they were fictional, nothing to suggest that the service couldn’t do what the site said.

Yo-Da systematically and automatically exercises your data rights

+

Use Yo-Da to ask any company in Europe to delete your personal information

User ‘Samuel’ claimed “Now I go to Yo-Da, search for the company whose (sic) been breached, and with 1-click find out what is happening with my personal information”, while ‘Nathan’ said “Yo-Da was simple to use and helped me understand just how many businesses in Europe have my data.

None of this is true. Yo-Da do not have a working product that does these things. As Falk put it to me “Our technology is still under development” and “We have some ideas that are working. They aren’t perfect.” I am not saying that Yo-Da aren’t developing an automated data rights service; I’m certain that they are. I’m not saying a product will never launch; I expect that it will and I am looking forward to it, though perhaps not for the same reason as Samuel and Nathan. The point is, it doesn’t exist now and the website said that it did.

Originally, Falk claimed that he had deliberately ignored my subject access request because it was unfounded. ‘Unpleasant’ people like me don’t have data rights, he claimed. This didn’t sound right, especially as after I published my blog, Yo-Da’s DPO (Trilateral Research) suddenly woke up and tried to process my request, as if this was the first they’d heard of it. During our correspondence, they made it clear that they agreed with Falk’s decision that my request was unfounded, but were silent on the decision to ignore it.

But in my argument with Falk, he admitted the truth “We have an outsourced DPO for a reason; we can’t afford a full time one. That’s why the SAR went ignored; our service isn’t live yet and so we didn’t expect to receive any requests, because we aren’t collecting any personal data on anyone

In a single tweet, Falk said a lot. He was admitting that all of the testimonials and case studies were fake (he ultimately said to me that they were “obviously fake”). At the same time, he was also not telling the truth. Falk said that the website was a “dummy” to “gauge interest”. In other words, the site exists as an advert for a theoretical service, but its other purpose is to persuade people to sign up to Yo-Da’s mailing list. It was designed to collect personal data. Yo-Da were saying ‘sign up with us to use this service that actually works’. I believe that this is a direct breach of the first GDPR principle on fairness and transparency. I want to know why Trilateral Research acted as a DPO for an organisation that did this.

Falk said that he was joking when he said that he ignored my request on purpose, but Trilateral didn’t acknowledge that. They wrote of a ‘delay’ in acknowledging my request, but concurred with Falk’s unfounded decision. That decision was never made; my SAR was just missed. Nobody was checking the ‘dpo@yo-da.co’ email account – Falk wasn’t, and neither were they, despite being the putative DPO. Either they didn’t know what had happened, or they didn’t care. They definitely backed up their client rather than digging into why a SAR had been received and ignored on spurious grounds without their involvement. Let’s be generous and assume that they didn’t know that Falk was bullshitting. Their client had taken a controversial and disputable decision in a SAR case, and he hadn’t consulted them before he did it, but they didn’t acknowledge that. They backed the unfounded refusal.

Even if Yo-Da one day launches a product that successfully facilitates automated data rights requests to every company in Europe (prediction: this will never happen), they definitely don’t have that product now, and their website claimed that they did. Either Trilateral didn’t know that this is the case, which means that they failed to do basic due diligence on their client, or they knew that the Yo-Da website was soliciting personal data on the basis of false claims.

When I pointed out to Falk that all of the sign-up data had been collected unlawfully (it’s not fair and transparent to gather data about a service that doesn’t exist), the conversation ended. The Yo-Da website instantly vanished, and their Twitter account was deactivated minutes later. I’m certain that Falk will be back, his little spat with me considered to be no more than a bump in the road to world domination. But forget him; what does this say about Trilateral? The best defence I can think of is that they took Falk’s money to be in-name-only DPO but didn’t scrutinise the company or their claims. This is bad. If they had any idea that Yo-Da doesn’t currently do what the website claimed, it’s worse.

According to the European Data Protection Board, the professional qualities that must be demonstrated by a Data Protection Officer include “integrity and high professional ethics”. I seriously question whether Trilateral have demonstrated integrity and high professional ethics in this case. It’s plainly unethical to be named as DPO for an organisation, and then ignore what comes into the DPO email address. Article 38(4) of the GDPR states “Data subjects may contact the data protection officer with regard to all issues related to processing of their personal data and to the exercise of their rights under this Regulation” but Trilateral weren’t even listening. It’s unethical to take on a client without knowing in detail how their services work (or even whether their services work), and that’s the only defence I can see in this case. It’s unethical to be DPO for an organisation that is making false or exaggerated claims to obtain personal data.

I regularly get asked by clients if I can recommend an outsourced DPO or a company who can do the kind of sustained consultancy work that a solo operator like me doesn’t have the capacity for. There are a few names I’m happy to give. I have no hesitation in saying that on the basis of this shoddy episode, I wouldn’t touch Trilateral Research with a bargepole.

A Boy’s Best Friend is his Data

Just over a month ago, I enjoyed a series of bad-tempered Twitter exchanges with Benjamin Falk, Founder and “Chief Talker” of the personal data outfit Yo-Da. Falk has an interesting perspective on Data Protection. Instead of coming to DP through the traditional routes of information management, security, governance or the law, Falk is an ‘information economist’. He doesn’t see the subject as an issue of human rights, instead looking at it through the prism of economics. Because Data Protection is concerned with information, and there are other contexts where information is a commodity traded in a market, Falk has had the revelation that the processing of personal data is just another market, and this is the only way to understand it. Falk perceives this market as a ‘dumpster fire‘, and he alone has the solution. He has founded what he calls the “world’s first Personal Data agency” and hopes to lure people into signing up for an ill-defined service that he asserts will put them in control of their information. Somewhere along the way, money will be made.

Falk has some eye-catching ways to explain the ‘market’ he seeks to disrupt:

personal data is best understood as a newspaper that we publish about ourselves, whether we like it or not“.

Sometimes, he thinks personal data is “a really really boring autobiography, it’s just information about yourself written down somewhere“.

Falk’s view of data subjects is that they are “an author with an information rights management problem

I can imagine that if a person had, say, an AI program and they had to persuade gullible investors to buy into a wheeze that hadn’t really been worked out properly, this kind of eye-catching guff might get them going. However, it’s nonsense. Most personal data isn’t published or created for public consumption like a newspaper (indeed, many people have laboured for years under the misapprehension that personal data in the public domain isn’t personal data at all). Equally, a lot of personal data doesn’t fit Falk’s favourite analogy of a ‘robo-biography‘ because it is generated by people and not machines. You can’t simplify a million different controllers doing things for themselves in a million different ways. It’s complicated.

As Yo-Da’s website says, users will be able to “discover, fetch, control and erase” personal data from “any company operating in Europe”. However, the first thing you see on Yo-Da’s homepage is the following: “who earns from your personal data? everyone but you“. Falk also wants people to monetise their data. There’s not much detail however, making me wonder Falk has got this far by saying ‘AI’ a lot without a clear idea of how that will translate to the power he claims to put in subjects’ hands. After all, in order to work, Yo-Da needs to be able to successfully obtain and amalgamate data held on millions of different systems, in thousands of formats, processed for a host of different reasons by a multitude of businesses as varied as Apple, Tesco, 2040 Training and the Friendly Furry Shop. I’d like to see this in action.

The idea of individuals monetising their data is common to survey platforms like YouGov and CitizenMe, while Paul Olivier-Dehaye has been touting the automation of SARs and other data rights for years. A mock-up of the Yo-Da app shows data obtained from Starbucks (including how many coffees the user has drunk) with a suggestion at the bottom that this data be combined with that information from Transport for London or NHS England. Rather than selling data at scale like most data brokers, Yo-Da seems to encourage subjects to obtain vast quantities of data about themselves (the app shows a user having obtained data from 1200 companies) to create a “rich personal database” which presumably the user will then sell with Yo-Da’s assistance.

Falk’s ambitions are not limited to data monetisation. Yo-da, he claims, will stop subject’s rights from being infringed. The ‘dumpster fire’ of poor data protection practice in the UK is the fault of greedy consultants like me who ensure that our clients don’t actually comply with the law so we can keep charging them. Like Hercules diverting rivers to sluice the Augean stables, Falk’s tweets demonstrated a belief that Yo-Da will wipe Data Protection clean. Solving DP’s many problems is “easy to do“, he says, it’s just that nobody has actually tried (take that, Liz Denham). I don’t see how, but even if you believe that Yo-Da’s data jumble sale could change the face of DP forever, it can surely only do so if millions of people participate. Even if thousands of people sign up, Yo-Da will barely scratch the surface of how much personal data is processed across the UK and the EU. People will still be obliged to provide their data to pay their taxes, claim their benefits, use the NHS, set up a bank account or a mortgage, or be employed. The ability to get a slice of your data (it won’t be all of it) and possibly hawk it to dodgy data brokers (about the only people who I can imagine might buy it) won’t change that, and would do nothing to stop DeepMind, lost discs, the Met Police’s use of facial recognition or hospitals letting TV companies film vulnerable women without consent.

Moreover, just imagine how Yo-Da could go wrong if it actually works. At the moment, the fact that the different aspects of your life are often held in silos is wholly to your advantage from a data protection perspective. Capitalism is trying to connect the various loose ends of your life, but there are limits.  As a middle aged man with middling health, the NHS doesn’t know how often I drink coffee at Starbucks, or how regularly I get the Tube in London rather than using a TfL bike (I would like to confirm to my GP that I never drink coffee in Starbucks and I have only used the Tube once this year on my many visits to the capital). But what else could be added? Could Yo-Da include how many orders from Beers of Europe I make? How often I go to SoLita for a burger? Yo-Da is selling a seductive idea – one might almost paraphrase it as ‘take back control’, but it probably contains the same risk of unintended consequences as that rancid propaganda. Falk positions his company as the saviour of privacy rights, but he’s encouraging people to conspire in their own exploitation by creating an intrusive and potentially prejudicial data cocktail and then flogging it to the highest bidder.

I’m ignoring the practical problem that the key to driving his plan is subject access requests, and SARs rarely provide a seamless, rich repository of information, ready to be amalgamated and exploited. SAR disclosures are often messy and incomplete, a patchwork left behind by the removal of third parties and exempt data, and often delivered in PDFs. Only data supplied direct to the controller by the subject or obtained under observation has to be supplied in a portable form. There are legitimate reasons to refuse requests altogether. Falk has asserted repeatedly that “ownership and rights mean the same thing“, and so subjects own their data, but this won’t be any help to his business model. Subjects own the copy of the data that they receive from their SAR, but that doesn’t give them automatic access to any and all data held. They don’t own the data held by the controller. The promises of control and erasure made on the Yo-Da website are embarrassingly simplistic – you can’t object to a controller processing your data under contract or legal obligation or ask them to erase the data. They can resist an erasure request because they need to establish, exercise or defend a legal claim. Only someone who doesn’t understand how limited the GDPR rights of objection are would make the grandiose claim that “Yo-Da… lets you control who processes your information“. No, it doesn’t. It never will, because the GDPR doesn’t do that.

I think Falk’s claims are hype and his understanding of data protection is fundamentally flawed. Moreover, I don’t trust him. During the period that I spent arguing with the Yo-Da Twitter account, it became clear that I wasn’t just dealing with one person. There were two distinct personalities, inverted versions of the dual identities in Hitchcock’s Psycho. The Norman Bates character – relentlessly polite no matter what the provocation, endlessly ingratiating – is fake, a bot unleashed by Falk to fool people into thinking they’re dealing with a real person. Mrs Bates – the bitter, angry and resentful persona that occasionally lashes out – is real, presumably Falk himself, unable to let the upbeat-to-the-point-of-being-deranged program do all of the talking. Falk called me a jerk for accusing him of being a bot when actually, he was just being “unswervingly polite“. In the end, he had to admit that I was right and that he was using a bot. Ethics is Data Protection’s flavour of the month, and I’m not sure that such duplicitous behaviour will fit in.

Despite the fact that Yo-Da hasn’t launched yet, the website mysteriously features testimonials from happy users, while one of the three case studies highlighting how the service works using happy Yo-Da customers is actually just Falk himself. Falk wants to charge people to use their DP rights. Somewhere in our bickering, either Falk or the bot told me that Yo-Da would be a monthly subscription based on what users can afford, but there’s no hint of that on the website. It’s the same model that Dehaye originally proposed for PersonalData.Io – just as GDPR makes personal data rights free in most cases, in come some chancers hoping to charge you for using them. And I have one last piece of evidence that when it comes to upholding data protection, in giving people “transparency into this secretive ecosystem“, Falk isn’t the champion of data rights he purports to be.

After five days of arguing and provoking whoever / whatever was running the Yo-Da account, on June 4th, I made a subject access request to the company via the Data Protection Officer’s email address on the Yo-Da website (i.e. the specific address they direct you to make SARs to). I explicitly ruled out any personal data processed on the public Twitter account – that is available to me already and besides, I’ve already seen it. I wanted to see any direct messages, emails or other correspondence generated by my spat with Falk and his bot. Of course, there may not be any data at all. It’s quite possible that Falk didn’t talk to anyone about me or what I was saying, but he could have done. Several times, I questioned the fundamentals of Falk’s interpretation and I also asked whether Trilateral Research, the consultancy he has engaged to be Yo-Da’s DPO, agreed with his views. I wouldn’t be surprised if Falk contacted them about what I was saying, or just complained to his colleagues about what a jerk I was.

However you slice it, the deadline for compliance has passed, and Yo-Da has not responded to my request. I have received no data, no confirmation that data is not held, no request for ID, not even an acknowledgement. Nothing, nada, zip. Benjamin Falk proclaims that he seeks to land a knock-out blow for data subjects through the use of the GDPR rights, but the vehicle for this glorious revolution can’t even be arsed to answer a simple SAR. I wondered before why Trilateral wanted to be associated with Falk’s hyperbolic nonsense, but now he has coupled it with contempt for the law he claims to defend, I wonder if they’ll think again? In any case, everyone who receives one of Yo-Da’s SARs when the service launches knows what they can do.

Ignore it, you can.

 

The Curse of the Padlock

One of the dangers of working in Data Protection is the risk of becoming a pedant. Precision matters; court cases have turned on the meaning of individual words like ‘likely’ and ‘distress’. The legislation is a maze of definitions and concepts that the competent practitioner needs to get to grips with. Lazy thinking can be revealed by an inability to get the details right, so it’s possible to become obsessed with the detail. Even the BCS Data Protection exam has a question which requires you to list the elements of the definition of consent in the right order. It’s easy to lapse into pedantry, to point out every wrongly quoted article, every jumbled phrase.

Nevertheless, getting a simple thing right is often important. GDPR does not cover ‘personal identifiable information’; it covers ‘personal data’ and the definition of the two is not the same. A person who talks about PII in the context of European Data Protection is starting in the wrong place (the US), and can make mistakes as a result. Another error that seems to be creeping in all over the place is more profound, and risks entrenching one of the biggest misconceptions about how data protection works, a misconception many of us have spent years trying to break down.

The problem is the phrase ‘data privacy’.

I see it everywhere – on LinkedIn naturally, in news coverage of the sector, and predictably, the ICO has fallen for it. They describe themselves as “The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.” Look at the Data Privacy Advisory Service, who summarise their services as “At DPAS we help organisations safeguard the fundamental human right to have data kept private by putting in place the best possible protection to keep it secure. This is delivered in line with the General Data Protection Regulation (GDPR) and The Data Protection Act 2018.”

The idea is nonsense. It doesn’t exist. There is no right to data privacy – there is certainly no fundamental right ‘to have data kept private’. This isn’t a snide dig at someone quoting the wrong article. The concept of ‘data privacy’ is a complete misunderstanding of what Data Protection is for, and everyone who promotes it is actively thwarting the efforts of the rest of us to implement data protection in a practical way.

Article 8 of the European Convention on Human Rights says: ‘Everyone has the right to respect for his private and family life, his home and his correspondence“. This right is not absolute; it can be interfered with (only when necessary) in the interests of “national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others“. The right is not just about data – it certainly can be, as is evidenced by cases where celebrities and others use the privacy right to prevent the use of images that breach their right to privacy. But the right to privacy doesn’t have to be about data at all – you can breach a person’s right to privacy by simply observing them, by being in a place where they expect privacy, or by denying them the opportunity to do something privately. Data doesn’t have to come into it.

Clearly, if you did a Venn diagram, there would be circumstances where privacy and data protection overlap. By following the Data Protection principles when you handle a person’s private correspondence for example, you probably also do what’s necessary to protect their privacy. The same is true for confidentiality – not all confidential data is personal data, but a decent stab at the principles will probably respect both. There is, however, a significant portion of the Venn diagram where Data Protection and Privacy do not meet, and the DP part of that is important.

The notion of ‘Data Privacy’ obscures two vital elements of Data Protection. First, data protection is not only about private data. It is covers all personal data, private, secret, and public. For years, I have been banging my head against the brick wall of ‘it’s not personal data, it’s in the public domain’. Trying to explain to people that data like photographs, email addresses and other publicly available data is still personal data, just available and easier to use than some other data has long been a difficulty. There was a chink of light in Article 14 of the GDPR which clearly states that a person should be informed even when their data is accessed from ‘publicly accessible sources’. This explicit recognition that public data is still personal data is very helpful, but the notion that ‘data protection’ and ‘data privacy’ are interchangeable muddies the waters again.

Second, in related news, GDPR is not about keeping data private; it is about ensuring that personal data processing is properly regulated. For years, Data Protection has been plagued by the padlock. The Information Commissioner used it as a logo (‘but the padlock is unlocked’ is a defence that umpteen different ICO folk have used when I complained about it), and when I did a Google image search for ‘Data Protection’ today, this is the top set of results:

Screenshot 2019-05-26 at 09.17.53

The problem with the Data Protection Padlock is that it presents the legislation as something that locks data up, keeps it away from people. This understanding of data protection leads directly to the belief that disclosure of personal data is inherently problematic and exceptional, and that belief is toxic. I’m not persuaded that Victoria Climbie or Peter Connelly died solely because data about them wasn’t shared, but the pervasive fear of data sharing didn’t help. The GDPR says that ‘the protection of natural persons in relation to the processing of personal data is a fundamental right‘. The word ‘privacy‘ isn’t mentioned anywhere beyond a reference in a footnote to the ePrivacy Directive, and the processing of personal data is firmly put in the context of operating the EU’s internal market: “This regulation is intended to contribute to the accomplishment of an area of freedom, security and justice, and of an economic union“.

You can’t achieve the economic union by locking all the data away, by keeping it private. To characterise data protection law as being about ‘data privacy’ is to misrepresent its purpose completely. European Data Protection is a compromise – trade is underpinned by the use, even the exploitation of personal data, but people have rights, they have control over their data in some (but not all) circumstances, and the legislation built on foundations of transparency and fairness, not privacy. Arguably, the GDPR tries to even up the power imbalance in some circumstances, but it is not designed to lock up data and keep it private.

Of course, some people might be using ‘privacy’ as a synonym for ‘secure’ – the DPAS statement above seems to elide the two. Only a fool would want to play down the importance of security in the context of using any personal data, but the reduction of Data Protection solely to security is as destructive to a proper understanding of it as the privacy / protection mess. We’ve managed to drag Data Protection out of the IT department, and we need to stamp on this idea that security is the exemplar of good DP practice. Your data can be private and secure, but kept for no good reason, for too long, in an inaccurate state, and there could be too much of it.

Some personal data is private and should remain so. In many situations, the processing of personal data without an eye on people’s legitimate expectations of privacy, especially when monitoring, watching or listening to them, is likely to be unfair and so unlawful. There is a strong link between Data Protection and Privacy, and any attempt to divorce them would be stupid. But the use of ‘data privacy’ as a synonym for data protection is misleading and dangerous – it perpetuates a fundamental misreading of what the legislation is for, and makes the lives of everyone trying to make GDPR work effectively a thousands times harder. It’s time to take this nonsense, lock it up and throw away the key.

A cure for blindness

The first time I read the GDPR properly, something leapt out at me. For years, the received wisdom about the subject access and other rights provided by the legislation was that they were ‘applicant blind’. You could ask the person for assistance in locating their data, but you could not ask them why they were asking. Even if you knew that the person wanted to wind you up, you had to ignore that. When I got to the GDPR articles about subject rights, it struck me that this was no longer the case.

The relevant text in the final version (Article 12.5) is as follows:

Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:

(a)  charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

(b)  refuse to act on the request

Looking at the foundation, the basis on which the request has been made, opens the door to the applicant’s motive. An unfounded request is one for which there is no legitimate basis, a request which is unwarranted. You cannot come to a conclusion that a request is either ‘unfounded’ and ‘excessive’ in many cases without looking at the person, why they have asked and what they intend to do with the data. The word ‘manifestly’ places a high threshold – it must very obviously be the case that the request is unfounded, but nevertheless, the words are there, and they must be there to allow the controller to refuse in some circumstances. If I’m wrong, tell me what those words are there for.

Believing that GDPR allows controllers to refuse requests because of the motives of the applicant often gets me into disagreements with other DP professionals. Perhaps because the ‘applicant blind’ idea is so basic to some people’s understand of how Data Protection works, or because they disapprove of the idea, a lot of people disagree. Last year, a controversy started when anti-abortion campaigners in Dublin filmed pro-choice demonstrators, and someone on Twitter provided a template SAR request for pro-choice people to use. The idea was to (in one Tweeter’s words) ‘swamp’ the anti-abortion campaign with SAR requests, even to show up and get yourself filmed solely so that you could make a SAR. More recently, pro-Remain campaigners, angry that they are receiving entirely legal election literature from the Brexit Party, suggested making SARs to the party to find out where their data had been sourced from. Virtually every time I pointed out that the data would have come from the electoral register, rendering the SAR pointless, they said they would do it anyway to annoy the Brexit Party and waste their time.

I support the idea of abortion without any hesitation, and I commend those who campaign in favour of the right to abortion. I am also what you might call a Hard Remainer – I wish we weren’t leaving the EU, and when we do, I would support a campaign to go back in on a Full Schengen, Join the Euro platform, partly because I think these things are good on balance, and partly because it would annoy people who voted Leave. Nevertheless, I think the anti-abortion campaign were perfectly within their rights to refuse SARs where they could identify a person’s Twitter comments saying that they intended to do a SAR to waste their time, and if the Brexit Party do the same now, I believe that this would be justified. I think GDPR allows for refusals of requests that are made for reasons other than concerns about personal data.

And if you don’t agree with me, you don’t agree with the Information Commissioner either.

For years, the failed FOI campaigner Alan Dransfield has been sending angry emails and complaints to various people at the Information Commissioner’s Office, usually late at night. I know this because as well as copying in various journalists, news organisations, and politicians, he also includes me. It’s hard to know what Dransfield hopes to achieve with these screeds, which blend an aggressive misreading of how the law works, defamatory accusations against ICO staff and RANDOM words in CAPITALS. Usually these emails come out of nowhere, but his most recent missive was in response to an email from the Information Commissioner, refusing to answer a subject access request he had made to them.

If you ever wanted an extreme case to test the limits of what is acceptable, it’s Dransfield. The ICO’s refusal says that since April 2016, Dransfield has sent them over 120 requests for information under the Data Protection Act 2018 (DPA 2018), the Freedom of Information Act 2000 (FOIA) and Environmental Information Regulations 2004 (EIR). In addition, the email contains this remarkable statement:

since May 2018 we have received in excess of 290 items of correspondence from you. Many of these communications have included unsubstantiated accusations of the ICO’s complicity in various crimes and have targeted members of ICO staff with the intention of causing distress

The ICO refusal points out that having previously refused his FOI and EIR requests as vexatious, they are now no longer even acknowledging them because they are about matters which have been dealt with (something which FOI plainly allows). They then go on to say this:

Your requests for information under Article 15 of the GDPR appear to be similarly motivated. We consider that these requests are not made to legitimately establish what information we hold and how we are handling your personal data, but part of a campaign to challenge the decisions that have already been concluded within due process

As well as copying me into his legally illiterate complaints, Dransfield sometimes emails me direct to call me a dickhead or spew out misogynistic and homophobic abuse, but it’s clear that ICO staff have it much worse than me. He’s a toxic character who thrives on causing discomfort and outrage. You might say that if ‘unfounded’ works on him, it’s only because he’s such an extreme case. But Dransfield is not alone. There are other vexatious, unpleasant people whose SARs will be made in the same vein of perpetuating a complaint or a campaign. Most importantly, look at the basis of the ICO’s refusal: we’re saying no because we don’t think you’re making this request for the right reasons. The ICO believes that an unfounded request is one made for the ‘wrong’ reasons.

Assuming this is correct (and obviously this is a rare case where I think the ICO has got it right), the next question is how far this goes. For years, the UK courts argued that using SARs to pursue litigation was an abuse of process – is that use of a SAR unfounded? I think that weaponised political SARs are unfounded, and even if you disagree, I don’t think you can tell me that it’s impossible. The net result of Dransfield’s adventures in FOI was establishing a principle that has been used to refuse many requests as vexatious – exactly the opposite of what he wanted. His campaign against the Commissioner may, ironically, have the same effect in GDPR.

The ICO rejects SARs they believe have been made for the wrong reasons. If they do this for themselves, there have to be circumstances where they will agree when other controllers do this. Pandora’s Box has been opened. Controllers who are dealing with vexatious applicants or orchestrated campaigns should think very seriously about whether denying a person their subject access right is an acceptable thing to do, but they should do so in the knowledge that the UK’s Data Protection regulator has already done it.