Response to the Data Protection Bill debate and Green Paper on Online Strategy

Lord Jim Knight asked in debate in July about artificial intelligence and ethics, what plans the Government have to engage children in this discussion about their data. He picked this up again yesterday in the Second Reading of the Data Protection Bill (DP Bill)and again reminded the Government, they need to get their own house in order, before they can comply with the Bill.
The launch of the government Online Safety Strategy Green Paper consultation today, also puts children at the heart of the digital debate. How we do that needs careful discussion and informed understanding of technology. This is understandably often lacking, as the range of technology rapidly outpaces law, and knowledge across society. But the strategy fails to join up much of what is needed in the thinking in the DP Bill and applied online activities, the nuts and bolts of how the Internet and mobile phones work, with the reality of data collection and digital environments. Much of this is data collection is passive and growing in smart cities for example.
There is a big gap for government in both as it fails to address its own use of children’s data across government and education, as it farms out school pupil privacy and health data to commercial companies, while it is quick to point the finger at where others — notably social media and gaming — can improve.
The debate on changing the laws in this area, too often assumes that requiring parental approval means children are safer online. Baroness Lane Fox pointed out that this is basically flawed. Discussion of protection has to be about more than sexting, bullying and porn, and serious issues around exploitation in online grooming, and also address the hidden commercial exploitation of children’s digital identity and ad targeting, in-app sales by companies and grooming children as a future customer base. Risks that parents and charities that focus on physical protection do not see.
Many speakers at second reading in the House of Lords yesterday (Links to debate [part 1] [part 2]) picked up the child protection theme, but in somewhat of a panic rather than informed way. There was a widely stated belief that the age of 13 should be raised, but none mention the risk to child participation and privacy as a result of age verification (AV) requirements. While people are well intentioned to protect children from inappropriate material, this AV will not do that. Attempts to enforce and over police, will likely harm participation, and there is a pervasive unevidenced myth, that children do not care about privacy. That needs to change in the coming discussions.
There were several suggestions that the age of AV in the Data Protection Bill should go out to consultation. The Online Strategy Green Paper and consultation does address AV but only as relates to blocking pornography. There are no real questions in the consultation. It is rather an invitation to comment by December 7. Perhaps general AV should have been included.

Highlights on the GDPR provisions in the DP Bill most relevant for children and education

When it comes to the use of ‘information society services’ (online services targeted at a child, except counselling services), the framing of the discussion on “consent” in Article 8 and parental verification of age, are vitally important.
The UK has set the requirements for parental approval and age verification to 13. But this does NOT enable children from age 13 to consent to the gathering of personal data by companies. Consent is not age, but capacity dependent. This age-based model to protect the virtual child [1], is fundamentally flawed.
It does not give children or parents new rights. It creates the responsibility for providers of ‘information society services’ to ask for age verification if their services are targeted at a child, and if the child answers as under 13, the provider must ask for approval from the holder of parental responsibility before collecting the child’s personal data in use of its services. It’s a shortsighted, if well intentioned tool, but bad-by-design.
Clause 8(2) of GDPR, has not been explicitly transposed. Done poorly, it will mean a big data grab that does more to harm, than helps children’s privacy and exploitation and targeting by companies, because it will be with “consent” and likely undermine protections by design elsewhere. It will also put the onus on 13-18 year olds rather than companies for their own online protections, based on knowledge companies must present in clear language and child-friendly privacy policies. Not what we have today.
It risks that personal data are collected that would not otherwise have been necessary, essentially exploiting age verification to capture valuable data on familial relationships. If this becomes standard practice, this legislation will be harmful not helpful to children’s privacy.
Age verification if it’s going to be meaningful and not just a nuisance, like the new cookie law, must be “a narrow form of ‘identity assurance’ – where only one attribute (age) need be defined, ” as Phil Booth writes, and that needs carefully done.
We need to see clarification and safeguards for privacy and safe child participation online, not just block it with a focus only on child protection.
Article 17 Right to erasure Our fear after the Queen’s Speech and Statement of Intent, was that the government would use the possible derogations to water down the rights that the GDPR gives all citizens. There needs to be much more clarity to distinguish between the rights to object to processing, on correction, erasure and right-to-be-forgotten which are often conflated, as in the Bill.
Profiling – automated decision making GDPR Article 71 The Explanatory Notes and Bill both fail to mention explicitly that these measures under GDPR, “should not concern a child”. We’d like this to be explicit on the face of the bill.
The GDPR under article 80(2) is not in the UK Bill but would grant various groups and associations the right to file a collective action on the grounds of a violation of the Data Protection Act, without a data subject having to ask them to do so first. However, the government has excluded that right from the draft UK Data Protection Bill. We believe this should be included, and we’re glad to see the ICO does too.
The UK Bill Clause 15 would leave the Bill open to any amendment by Statutory Instrument, which feels a far too broad, open-ended power, and as we saw in the 2016 school census expansion of nationality data, can be misused.
The Immigration exemption is ludicrously broad. A get-out-of-jail-free-card for government to do anything it likes, taking away each of our protections today. Policy needs to be transparent and open with the people if affects, not permit secret goings on with no rights to understand or question it. At a time when immigration enforcement is notably and publicly packed with errors, secrecy, and direct interventions are causing harm and distress. This clause must go.
The exemption exercised in GDPR 9(2)(i) requires provision for “suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy.” i.e. the duty to confidentiality that is built-by-design into professionals in health and education, but that the Digital Economy Act Part 5 removed. GDPR requires it is restored.
Two further clauses appear in the Intelligence services Part 4. Exam Scripts are made exempt in Schedule 2, Part 4 (23), and a broad exemption for Economic well-being in Schedule 11 Other exemptions Part 4 (8) are nothing to do with GDPR. These both need clarified that they only apply to the Intelligence services and in what circumstances.

What will it mean in practice?

The GDPR sets out that the processing of personal data should be designed to serve mankind, considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality, and respecting fundamental freedoms, respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity.
There is a large section of the Online Strategy devoted to schools, yet no mention at all of educating children how their own data are used in schools, and where the education system itself is fundamentally flawed, through lack of support, training and resources to properly address data protection, GDPR readiness, and children’s digital rights.