Stinking Badges

The list of things that annoy me about the explosion of hype and bullshit around GDPR is long and boring (NOTE TO SELF: this list should be a blog post of its own). I cannot say that top of the list are those badges that folk give their products, boasting about being “GDPR Ready”, or “GDPR Compliant” when nobody actually knows what being ready or compliant looks like, but they’re top five.

Screen Shot 2018-01-16 at 21.45.42.png

I was complaining about this on Twitter, and lovely people who enjoy seeing me annoyed started to send me examples of these badges from across the internet. It is via this route that I came to Emailmovers, a data broker who make luxurious claims about their data and its relationship to the GDPR.

Not only do Emailmovers have a badge, they claim to have been working closely with both the Direct Marketing Association and the Information Commissioner’s Office on GDPR issues. Indeed, until someone kicked up a fuss about it, Emailmovers had the Information Commissioner’s logo on their website. The logo has gone now, but if you work out where it was and click, there is an invisible link to the ICO’s website where it used to be.

Emailmovers certainly put up a strong case about the nature of the data they’re selling:

1) We are clear with individuals why we need their data at the point of collection
2) We always use clear and concise language appropriate for our target audience
3) We give individuals control over their data. They are always able to decide whether to share their personal data with us or not
4) Under the GDPR principle accountability, Emailmovers is able to demonstrate that we are compliant. We always record the legal grounds for processing an individual’s personal data

I can’t say that any of this is untrue, although I am sceptical. Generally, I think that the data broking industry is irredeemable, incapable of operating lawfully either now or in the future. The data broker acquires data, accumulates and appends it, and then sells it to clients. This is the opposite of fair. However, and wherever the data was obtained from, whatever transparency or fair processing was given to the subject, it would be vague. It could not say which specific organisations would receive the data, and often, it could not even say which sectors. The data broker does not know – they sell to whoever is buying. This kills consent – which was supposed to be informed and specific since 1995 – and it kills legitimate interest. How can you assess the effect on the subject if you don’t know when obtaining the data what you’re going to do with it? If a data broker obtained individual email data under legitimate interest, they couldn’t sell it on for marketing purposes, because the client will not have consent to send the marketing in question by email.

None of this will stop the data broking industry from carrying on – when some of the biggest brokers are ICO stakeholders whose activities have gone unchecked for decades, it’s hard to imagine that the GDPR will make much of a difference.

Nevertheless, there was one thing about all this that I was able to check. I made an FOI request to the ICO asking about contact that Emailmovers had had with the Commissioner’s Office, particularly with the policy and liaison teams. If Emailmovers really had been working closely with the ICO, there would be evidence of this, right? The ICO’s response was revealing:

There was no direct contact between Emailmovers and our Strategic Liaison/ policy department concerning advice about GDPR.”

Emailmovers had made a couple of enquiries – ICO was too cautious to tell me what they asked, but they supplied the replies which offer no more than a simple (but accurate) explanation that business to business communications are covered by the GDPR, a brief observation that the ePrivacy Regulation is coming but we cannot be sure what it will say, and separately, a straightforward note that even corporate subscribers need fair processing. This is not working closely with the ICO – they asked a couple of questions and got short polite answers. There are no meetings, no detailed correspondence, nothing at all to suggest anything approaching the relationship they boast about here:

Screen Shot 2018-01-16 at 21.47.35

I can honestly say that I am in regular contact with the ICO about a variety of matters. It sounds good, but it’s true only because I nearly gave evidence in one of their prosecutions (they didn’t need me in the end), I make a lot of FOI requests to them, and I tweet at them almost daily.

I don’t accept that making a couple of enquiries equates to working closely with someone. The fact that Emailmovers make this claim on their website, and displayed the ICO logo prominently until recently makes me very uneasy about the other things they say. The GDPR sector is full of bullshit and exaggeration, fake certifications, hokey badges and bluster. As we near the supposed cliff edge of May 25th, we should all take the time to check every claim with great scepticism, and to treat the badge-toting hordes with the same caution that Humphrey Bogart treated a certain bogus Federale:

2040 vision

The turn of the year is always an opportunity to make resolutions in your personal or professional life, but it’s hardly a revelation to observe that such aspirations often evaporate. The easy option presents itself, and the temptation to take it is difficult to resist. For many years, I have claimed to be a “freelancer” but in fact, although I’ve been doing my own thing since 2008, quite a lot of my work has come from Act Now Training. Every year, I tell myself that this is the year that I will cut the apron strings completely and strike out on my own, and every year, I don’t quite get there. I’ve done some fascinating work for a variety of people, but I haven’t found enough of it myself.

2018 was already shaping up to be an interesting year, given that the much-hyped General Data Protection Regulation will finally be enforceable, and we will find out whether the apocalyptic predictions of The Certified will come to pass (SPOILER: they won’t). Reader, that isn’t interesting enough for me. Much as I am grateful to Act Now for offering me my first training course in 2005, and for all the opportunities they’ve given me since, all good things must come to an end. I had to turn down all sorts of opportunities in 2017 because of all the courses I was running, and there are a number of things I’ve always wanted to do, but simply didn’t have the time. So from March 1st, if you want to be trained by me, or use my services, it’s 2040 Training or bust.

A couple of announcements in this context:

PUBLIC COURSES!

I am running some public courses with a practical, procedure based approach in London and Manchester. The first is a ‘GDPR SOS‘ course for those bodies large and small who either haven’t prepared for GDPR’s live incarnation, or don’t know whether they have got what they might need in place. It’s commonplace in the Data Protection world to sneer at those who haven’t thrown themselves into a compliance frenzy, but rather than brag about putting up my daily rate (which some LinkedIn GDPR bods have said they would do in 2018), I thought I would put on a no-nonsense, plain English guide for those who want to get up to speed. The first courses run at the end of March, and you can find out more about them here: http://2040training.co.uk/gdprcourses/

Following on from the SOS course, I hope to be running a detailed practical course on the GDPR rights in April and May, taking into account guidance from the ICO, the Article 29 Working Party, the DP Bill / Act, and of course, the many cases and examples that we’ve already got from 20 years of Data Protection. There will also be a course on PECR and Direct Marketing.

These courses will not be ‘Article or Section X says Y’ but will be based on real-life cases and scenarios. Both, and a range of other options, are of course available in house, and everything else that I can do for you is listed on my website, a link for which is above.

MORE GUIDES!

I wrote two free guides in 2017, one on fundraising and Data Protection, the other on choosing a DPO as a service. The feedback on both has generally been very positive, apart from the DPO as a service people who didn’t like reading that experience  is an essential part of being someone’s expert. It is. Live with it.

First, I am updating the fundraising guide to make it solely about GDPR and the DP Bill to the extent that this is possible. I want to complete this soon, so if any fundraisers have any specific questions about GDPR that you’d like to see answered, especially if you read the original and know the kind of questions I featured next time around, let me know but quickly!

Send any questions, as soon as you can, to: fundraising@2040training.co.uk

Second, I will be writing a guide for GDPR and Councillors – a simple guide to Data Protection as it relates to the role of a local elected politician. It’s not going to cover what councils do, but the way in which a councillor operates their office, deals with constituents and how they store data. Once again, any questions or concerns about this area from Councillors and those who work for or with them would be very welcome. I hope to get this finished by the end of February, so any questions or comments that you can send before then would be more than welcome.

Send any questions (preferably before 20th Feb) to: councillors@2040training.co.uk

Both the updated Fundraising guide and the Councillor guide will be free and available to download from my website.

After these two are done, I will be working on a number of other guides including the use of violence warning markers under GDPR, and no matter how unpopular this will make me, a free guide for individuals who want to use their Data Protection rights. If you have thoughts or comments about this, please let me know.

EMPLOY ME!

Seriously, I’m available. More here: www.2040training.co.uk.

Summit to hide?

On at least three occasions in the past year, a member of staff from the Information Commissioner’s Office has spoken at conferences organised under the banner of GDPR Conference or GDPR Summit. Garreth Cameron has appeared twice, and Lisa Atkinson was at the latest event on October 9th. Nothing odd about this, you would think – the ICO clearly wants to spread its message (such as it is) to a wide audience, and conferences are a way to do it. They should be wary about showing favouritism and they’re not very good at avoiding it – a certain Assistant Commissioner often appears at a certain training company’s courses, and appearing three times at one company’s commercial events comes close to being an endorsement.

But even if such regular support for a conference would otherwise be justified, in this case, I don’t think it is. It’s not easy to find out from the GDPR Summit website who is actually organises the conferences. A little bit of digging suggests that it is a company called Amplified Business Content. Amplified Business Content is also responsible for ‘GDPR Report’, which used to publish articles for free but has now gone to a subscriber model. Having an opaque company structure isn’t compliant with Data Protection because it’s not clear who the Data Controller is. Moreover, some of the material on their website is garbage – they have published quizzes with wrong answers, and harvested information without a privacy policy (though I noticed that after people on Twitter made a fuss of it, they stopped demanding email addresses to get scores on the quiz). Via GDPR Report, the organisation has pumped out reams of vague, badly-written stories including one titled ‘The Data Protection Apocalypse’ that claimed that organisations need consent for all processing – it was so bad that after a morning of criticism via Twitter and other sites, they had to delete it. Worst of all, Amplified Business Content has not notified the ICO under Data Protection – unless they are exempt (which for a conference organisation is hard to believe), this is a criminal offence.

Given that the ICO have given Amplified Business Content so much support, I wondered whether they had done any due diligence on the organisation before agreeing to speak at their events. Under FOI, I asked for the following:

Any information about due diligence carried out by the ICO before accepting invitations to speak at these events, including whether ICO staff checked if the company had a notification, and whether their materials and publications were accurate and reflected the ICO’s approach to the GDPR

Any procedure that requires ICO staff to carry out due diligence before accepting speaking engagements

The answer was that no information was held. The best they could offer was “We apply our speaking engagement policy here when making a decision whether or not to accept a request for a speaker“. Needless to say, the speaking engagement policy does not include any requirement to carry out due diligence. In other words, the fact that Amplified Business Content has not notified and has spread misleading and unhelpful information about a Data Protection apocalypse is irrelevant to Wilmslow. They’re not even expected to check whether the organisation has taken the most basic steps to comply with Data Protection law. This is remarkable, especially at a time when so many dodgy people have flooded into the Data Protection market.

Their answer to the first part of my request was more interesting, and more worrying. I asked for:

All correspondence between the ICO and Amplified Business Content or those purporting to represent GDPR Conference or GDPR Summit or GDPR Summit Europe (or other variations on the theme of GDPR Summit).

I’ve done this before, both with the Privacy Laws and Business Conference (which led to this blog) and True Swift, another organisation for whom the ICO has done several online courses. Both times, the ICO gave me detailed correspondence between themselves and the organisation, which allowed me to see, among other things, Stewart Dresner of PLB complaining that he doesn’t have special access to news about ICO activities. This time, however, the ICO has refused to give me any of the correspondence. The exemption they used is a prohibition on disclosure that applies when organisations supply data to the Commissioner when information “has been obtained by or furnished to the Commissioner under or for the purposes of the Information Acts”. In other words, ICO claims that when arranging their spots at the GDPR events, they were exercising their functions under the Data Protection Act. Needless to say, the refusal doesn’t say which function they were exercising – presumably I am expected to guess. I think the only function that could apply is the duty to promote the following of good practice under Section 51, but the idea that Parliament intended conference arrangements to be secret is a fairly bizarre idea.

Only two possibilities present themselves. The first is that the ICO’s policy is only to release material such as this with the consent of the organisation (which the prohibition allows), so PLB and TrueSwift consented to the disclosure and Amplified Business Content refused, which begs the question of what ABC have to hide. Their internal business arrangements are nobody’s business but theirs, but when dealing with the regulator, they should expect to be more open. I’ve made fun of Dresner following the disclosures, but the emails I received didn’t show him or his company doing anything inappropriate – the only criticism I’ve got is that the ICO should hold all organisations at arms length.

The other possibility is that the ICO is being inconsistent. They didn’t use this exemption before, but there is something awkward or embarrassing about their relationship with ABC that they want to cover up. Either way, it isn’t a good look for the transparency regulator to be hiding information about its dealings with a private company. The prohibition allows data controllers and public authorities being investigated for DP and FOI breaches to provide secret business information to the Commissioner with the confidence that it won’t be disclosed. This is entirely justifiable – otherwise, no organisation would ever give the ICO information they had withheld from an FOI or subject access applicant in case the applicant then tried to use FOI or DP to get it from Wilmslow.

This case is very different. The ICO has scant resources, and yet has regularly provided speakers to a commercial company with a spotty approach to Data Protection and is using the prohibition on disclosure to prevent legitimate scrutiny of their relationship. The prohibition does allow disclosures that are ‘necessary in the public interest’ – given ABC’s dissemination of scaremongering articles and possibly illegitimate non-notification, I am convinced that the public interest does support transparency here. Of course, the ICO might argue that if they disclose, this will deter conference organisers and others from approaching them – but who cares? This is far from a core activity for the Commissioner. If you’re not willing to be open in these circumstances, what has anyone involved in this got to hide?

Things To Come

The imminent arrival of the #GDPR, as many have already noted, has resulted in a huge amount of speculation, prediction and scaremongering. Stories of massive fines, a torrent of crippling class action lawsuits, 75000 DPO jobs and the emergence of a new volcano in the fields outside Wilmslow* have all captured our attention. Nevertheless, just when I thought I had heard everything, Lawrence Serewicz proved me wrong.

Mr Serewicz issued, with the certainty of an Old Testament prophet, this astounding claim:

Quick #gdpr prediction. By May 2019 the ICO will have issued more, in terms of number of and amount of, “fines” than in the previous years of the MPN era *combined*.

This might be the wildest prediction anyone has made since the GDPR first dropped from the sky (sidenote: feel free to link me to dafter ones). By my quick and dirty calculation, this would mean GDPR fines in excess of £9million and more than 100 fines between May 2018 and May 2019. This isn’t going to happen. Even in a parallel universe where we had a Commissioner who liked taking action, they couldn’t fire out 100 fines in one year. It is inconceivable.

It is probably fair to say that Mr Serewicz and I do not have a relationship marked by mutual respect or affection, but for once, he has inspired me. The idea of predicting what the first year of GDPR will involve is a brilliant one, and I have decided to have a go.

Below are 12 predictions about the first 12 months of GDPR in the UK. For every one that I get wrong, I will donate £20 to the charity Mind. And here’s where you can join in. Look down the list, and see if you disagree. If you spot a prediction that you think will not come true, let me know – in the comments here, on Twitter, via LinkedIn, or via email. If you are right and I am wrong, I will publicly admit that this was the case on this blog. I will celebrate your perspicacity. But if I am right, and you are wrong, you will donate £20 to a charity of your choosing. You don’t have to do anything else and I will not make fun of you. Nobody makes any money except good causes, but imagine me having to grovel and highlight your superior knowledge in print. If three people say I’m going to get one wrong and I don’t, each one makes their donation, but however many people bet against me, if I am wrong, I just pay one £20 per prediction. I will still praise those who get it right.

I will not be a smart-arse about general comments and reactions on social networking sites – if you want to join in, contact me directly and say you want to take up the charity challenge on one of these predictions.

PREDICTION 1

The total amount of GDPR fines (not including PECR and legacy DPA fines) between May 2018 and May 2019 will be less than the total of all DP CMPs up to today’s date.

Yes, this is half of Mr Serewicz’s prediction. Guess what prediction 2 is?

PREDICTION 2

The total amount of GDPR fines (not including PECR and legacy DPA fines)  issued between May 2018 and May 2019 will be less than the total number of all DP CMPs up to today’s date.

PREDICTION 3

There will be less GDPR fines (not including PECR and legacy DPA fines) between May 2018 and May 2019 than between May 2017 and May 2018.

That’s right – I predict the number of fines will decrease in GDPR’s first year of operation.

PREDICTION 4

There will not be a €20 million or UK equivalent fine before the end of May 2019.

I intend no weasel get-outs here – we all know what I mean here. There will not be a maximum possible fine in any circumstances.

PREDICTION 5

There will not be a 4% of annual turnover before the end of May 2019.

As above.

PREDICTION 6

Thinking about the lower level of penalty i.e. under Art 83(4), there will not be a €10 million or UK equivalent fine before the end of May 2019.

PREDICTION 7

Thinking about the lower level of penalty i.e. under Art 83(4), there will not be a 2% of annual turnover or UK equivalent fine before the end of May 2019.

PREDICTION 8

No UK public authority will be fined more than £1 million before the end of May 2019.

PREDICTION 9

No UK company will be fined more than £2 million before the end of May 2019.

I want to be wrong on this one as there will be deserving breaches. I don’t think I will be.

PREDICTION 10

No charity will be fined more than £50,000 before the end of May 2019, unless for a security breach.

PREDICTION 11

No GDPR class action case will have been concluded with a total damages payout of more than £1million before the end of May 2019.

PREDICTION 12

Five of the companies registered on Companies House today with ‘GDPR’ in their name, or a company name whose initials spell ‘G D P R’ will no longer be offering Data Protection services in May 2019.

BONUS ROUND

These ones just for fun as they cannot be measured

  • the number of people describing themselves as ‘Certified GDPR Practitioners’ on LinkedIn will be half what it is now
  • nobody will change their profile to say ‘Certified GDPR Practitioner’ on LinkedIn during May 2019
  • the ICO will still be asking for more staff
  • we will all wonder what all the fuss was about

AND FINALLY: do you have a prediction in the style of those above? If you do, let me know what it is. If I get at least five predictions (and a maximum of 10, I’m not made of money), next month, I will write another blog made of reader suggestions. If this comes off, I will say whether I agree with them or not, and if I disagree with them, it’s another £20 to Mind from me for every one that I get wrong. But contributors must promise that if they get it wrong, they will pay the £20.

This will go wrong in one of two ways. It will capture people’s imagination, and I have given myself a shedload of admin. Or nobody will care, and nobody will join in. But we’ve all read a pile of predictions since all this GDPR nonsense started. Let’s have a bit of fun, and raise a little bit of money for charities at the same time.

 

* In 2017, anything is possible.

Just say no

On Friday December 16th 2016, I had a routine eye test. The optician noticed swelling on the optic discs at the back of my eye, and I was dispatched to the Manchester Eye Hospital to attend their Emergency Eye Clinic. This is basically A&E for eyes, a mix of swollen eyelids, sudden blindness and people who should have just gone to an optician. I arrived at 2.45pm, and fairly quickly, I was put in the ‘people who need to be seen’ pile. However, this meant waiting for the next available doctor, and like any A&E, the wait was long.

At 5.30, having waited in a dull holding area (with the files of other patients unattended and clearly visible), I was seen by a doctor. At this point, I was bored and worried, desperate to go home but desperate to find out what was going on in my head. Swollen discs can mean all sorts of things, you see, but one of the things Google told me that they can mean is Brain Tumour.

The doctor was terrible. He examined my eyes, pulled faces, and asked lots of questions about the medical history of my family without explaining the significance of any of them. In the middle of that barrage of questions was this one: ‘Any history of tumours in your family?’. Of course, having sat there for nearly three hours with only Google Searches That Spell Imminent Death for company, this question fired out of nowhere was just perfect. After the obligatory disappearance act to consult with a more senior doctor, I was told that they wanted to scan my brain in case “God Forbid” there was a tumour in there.

I was shunted back into another holding area, then at around 7pm a very sympathetic nurse inserted a cannula into my arm so that they could put a dye into my bloodstream when scanning me (a process that never actually happened) and explained ‘We’d like to do a CT scan’. She told me where to go, and because I was evidently in a bad place mentally, made clear that if I wanted to go for a walk before the scan, that would be fine. At length (and after it became clear that the people doing the CT scan weren’t actually expecting me), I had the scan. Several hours later, they decided I had high blood pressure and I went home at 10.45pm.

Looking at the whole thing as a Data Protection professional rather than a patient, the thing that leapt out at me at the time were the boxes of paper records left unattended. During the day, the holding area I was sitting in is very busy, with at least one member of staff behind the desk able to prevent access. When I was there on the Friday evening, there were long stretches when I could have got behind the desk and read the files, and nobody would have known. It’s an open question as to whether a patient left alone with unattended medical records is a ‘personal data breach’ that would have to be reported to the Information Commissioner.

In retrospect, there is a more interesting question. Carrying out a CT scan is processing personal data – it involves the creation of a scan of the patient’s brain which is plainly sensitive personal data (under GDPR, special categories data). So, what condition did Manchester Eye Hospital have for processing my personal data, and did they provide me with adequate fair processing?

Here’s the thing: they didn’t have my consent and I suspect they think they did. They probably didn’t have Data Protection Act consent, but they definitely didn’t have GDPR standard consent. I’m sure many readers will disagree. Surely my lying down to have the scan is a “clear affirmative action”, signifying my agreement to the processing?

Well, it’s not that simple. First, there is the lack of fair and transparent processing. I was told why they wanted to do the scan, but I wasn’t told who would get access to it (which in today’s NHS could be Google), how long it would be kept for, what legal basis they were relying on and so on. Even if the DPA doesn’t demand this now, it’s hard to argue that the processing would be fair unless I was told these things. Moreover, without any fair processing, any consent I gave would not be informed and specific.

The second problem is that my consent was not freely given. I was tired after hours of sitting around, I had been given limited information by a doctor with poor communication skills and frankly I was scared that I had a brain tumour. I hadn’t eaten and or drunk very much, and my phone was dead so I couldn’t discuss it with anyone else. I do not believe I had the capacity to freely give my consent to have my brain scanned. At no point did anyone say ‘Do you consent to having your brain scanned?’, it was couched in passive language: we would like to do this, and if I didn’t object, my consent was assumed.

Then there is the power imbalance – people like to talk about ‘Our NHS’ as if we all collectively own it, but that’s bullshit. Surrounded – outnumbered – by doctors and nurses who want to do something, it’s hard to say no. Indeed, I am aware of cases where a person who refuses to do what the doctors want have been sectioned. Admittedly, as a white, middle-aged, middle-class man, I’m probably less likely to be subjected to this, but who knows. What would they have done if I had said no?

In this context, recital 43 of the GDPR is worth reading:

consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation

I think the power imbalance between the assembled medical staff and me made it impossible for me to say ‘no’, especially when considering the specifics of the situation. I had gone from a routine eye appointment to a request for a brain scan to find out if I had a brain tumour. My ability to make decisions was fried. A few months later, I got up at 7am on a Sunday to drive to Trafford Hospital where some improbably chirpy technicians did an MRI on my head. That interaction was certainly closer to consent than the CT scan, but strictly speaking, nobody asked my consent. It was a lot better, but by no means the only way in which the NHS processes data.

Since my diagnosis of high blood pressure, I have spent an afternoon in a specialist diagnostic ward in one hospital, had the above MRI in another, had separate MRIs and ultrasound scans on my kidneys, a shedload of blood tests and monthly appointments at my GP. My GP aside (who is excellent at explaining everything), the standard of fair processing in all my interactions with the NHS since last December has been lamentable. I don’t know who gets access to my data, I don’t know what for, and nobody has told me how to find out. There may be a privacy notice somewhere on a website but I don’t know where it is and nobody told me how to find it.

I respect and trust my GP. Every nurse I have met, even those briefly sticking a needle in my arm, has been exemplary. The team at the ARMU at Wythenshawe Hospital are superb, both at medicine and communication (in fact, every experience I have had there has been good). But for all the fact that I can be a troll sometimes, I have never caused as much hostility and frustration as when I give my honest opinion about my experiences in the NHS. People are angry with me if I speak my mind. Criticising the NHS is modern-day blasphemy. I’m only writing this blog now because it looks like my eyes are getting better and I probably haven’t got a brain tumour (although the fact that the hospital lost the brain MRI for several months because of the virus infection in May dents my confidence in this). I worry about pointing out the Eye Hospital’s failings because I do have to go back there. Do I want to be treated by people who know that I have criticised them online? This is the power imbalance in a nutshell.

So what’s my point?

The GDPR is built on an improved model of Data Protection – organisations should be transparent, and wherever possible, subjects should be empowered. One of the most important elements in this relationship is the proper treatment of consent. Ironically, given the number of ill-informed articles claiming that GDPR requires consent for data processing, a significant effect of GDPR should be to reduce reliance of consent. Organisations, especially those like the NHS who purport to rely on it, should be much more honest with people. Sometimes you don’t have a choice at all and a thing is going to happen whether you like it or not (HELLO, ROYAL FREE HOSPITAL). Sometimes, there isn’t a real choice – ask me whether I want you to find out whether I have a brain tumour, and honestly, the answer’s no. Rationally, the answer’s probably, ‘OK then’, but it’s not much of a choice and in my case, the question wasn’t even posed.

The NHS is going to breach the GDPR as much in spirit as in practice if it continues in its dubious mantras of implied consent and ‘no decision about me without me’. The fact that a person doesn’t have to be physically forced into the scanner does not mean that they have consented, especially if they haven’t been told clearly and directly how that data will be used. In many situations throughout the NHS, medical professionals think they have consent, tell each other they have consent and they don’t. There are other options in the GDPR, of course, including a rock-solid legal condition for special categories data for the purposes of medical treatment and diagnosis. But many people in the NHS still think consent is their byword and it really isn’t.

For one thing, secondary uses for analysis and research either have to stop, or a much more open and transparent process has to be developed to contact people directly, either to be transparent or, if that’s the basis that being relied on, to seek consent. For all my many scans and blood tests since last December, I have to assume that none of them will ever be used for any purpose other than the direct diagnosis and treatment of my condition because I have never been given a hint that anything else will happen. But is that true?

For another, if the NHS is going to get to grips with GDPR philosophically, it has to be much more honest about the flawed nature of the consent it thinks it’s getting. For years, NHS staff have told me on training courses that a patient rolling up their sleeve is evidence of ‘implied consent’ to take blood (and by further implication, process the data that flows from the test). In fact, what they have at best is inferred consent; and with the power imbalance, possibly not even that.

We know for certain that the Information Commissioner will not tackle this issue because they are terrified of challenging such fundamental issues. Elizabeth Denham’s trumpeting of a slapped-wrist undertaking for the Royal Free Hospital’s misuse of 1.6 million people’s personal data was, at least for me, the final nail in the coffin of her credibility. As a friend of mine said, the chief role of each new Commissioner is make the last one seem better. I am not predicting fines or enforcement of any kind; it won’t happen. But the best thing about the GDPR is its recognition that we are human beings who deserve respect and autonomy. My experience of the NHS in Manchester is far from achieving that.