New KC legal opinion on the Data Protection and Digital Information Bill

1. This Bill to be withdrawn
2. An ICO Code of Practice to be drafted for (existing) Data Protection law in Educational Settings.
3. Regulations to correct the collection of Higher Education student monitoring of equality of opportunity from identifying to statistical data beyond the point of collection and internal use at their setting.

Given our remit in the education and children’s sector, we considered the effects on children in particular. In our 2021 report, The Words We Use in Data Policy: Putting People Back in the Picture, we explained that if the government wishes to simplify the law, it should not be rewriting another version of one part of our Data Protection law, at all, but acknowledging the failed transposition of the 1995 Directive implemented in the UK through the 1998 Data Protection Act, we should not be starting from here at all.

This Bill is an attempt to take us back in time. The GDPR came into being recognising the risks of emerging technologies and their implications for human rights, and that what had gone before was not enough to meet growing public outcry over data misuses. The UK government should be consolidating the two amended laws (the UK-GDPR and the Data Protection Act 2018) into one, comprehensive piece of data protection law — not redrafting new complex layers.

Children’s protection and recognition of needs are missing

This Bill contradicts the wide acceptance of today’s position in recital 38 of the GDPR that, “Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data. Such specific protection should, in particular, apply to the use of personal data of children for the purposes of marketing …”. Instead it says marketing should become a formally recognised legitimised interest that outweighs the rights and freedoms of individuals. This fails to understand the adTech ecosystem and real-time biding mechanisms behind the scenes of today’s online marketing activities every nano-second of every day wherever we go and whatever we do. It fails to recognise children, as well as adults, should be protected from the undue influence those systems can have on our autonomy, agency and choices we make. Including weakening of protections of data repurposing for political persuasion which is so desperately in need of protection when it comes to mis– and disinformation, to uphold democratic aims.

Children’s ability to exercise the right to rectification and erasure are removed

Recital 65 of the GDPR today will become near impossible to exercise for children later in life, if in future personal data is no longer personal some way down the line. [A] “data subject should have the right to have personal data concerning him or her rectified and a ‘right to be forgotten’ where the retention of such data infringes the law. In particular, a data subject should have the right to have his or her personal data erased and no longer processed where the personal data are no longer necessary in relation to the purposes for which they are collected or otherwise processed, where a data subject has withdrawn his or her consent or objects to the processing of personal data concerning him or her, or where the processing of his or her personal data does not otherwise comply with this Regulation. That right is relevant in particular where the data subject has given his or her consent as a child and is not fully aware of the risks involved by the processing, and later wants to remove such personal data, especially on the internet. The data subject should be able to exercise that right notwithstanding the fact that he or she is no longer a child.”  How is anyone supposed to exercise this right if the redefinition of personal data changes the nature of its status over time, and later in life the former child can no longer exercise rights they should have been able to exercise at the point of collection, but were incapable of doing so?

Safeguards for children from profiling fall away under a list of Legitimate Interests

In particular adding anything to do with children to the list of Legitimate Interests (LI) under a ‘safeguarding’ umbrella is completely unnecessary.

Legitimate interests is overwhelmingly a commercial company legal basis for data processing about children, not one used by public authorities under their public task duties. Where there is an existing LI it continues to be. Adding an open-ended ‘safeguarding’ to a recognised list of LI however, will mean companies no longer need to carry out a risk assessment for high risk processing at large scale. For example, it could cover some safetyTech companies, which may enable millions of covert photographs to be taken of children by schools or the companies, that may label children with suggested vulnerability to ‘risks’ of terrorism and extremism, to self harm, or as ‘oversharers’ or predict harm to others. Tech that is already proven to have unintended consequences including outing LGBTQ teens in the U.S. None of that would be changed by adding safeguarding to the LI list on the face of the Bill, but would mean they can continue or change the scope of their covert activity without oversight or changes to design that profile and track children, where their nudes or intimate records may be retained in the world, or who can access them. This is an area that needs more scrutiny and transparency and limitations, not less.

The Bill contradicts the spirit of Recital 71, which states that children should have the right not to be subject to a decision, “which may include a measure, evaluating personal aspects relating to him or her which is based solely on automated processing and which produces legal effects concerning him or her or similarly significantly affects him or her[…]…In any case, such processing should be subject to suitable safeguards, which should include specific information to the data subject and the right to obtain human intervention, to express his or her point of view, to obtain an explanation of the decision reached after such assessment and to challenge the decision.”

When it comes to political opinion and data for political purposes, we have had no answer to the question what the safeguards are for teenagers? These would be required by Article 6 of the Convention 108.

The desire to use the UK population as a resource to exploit by the private sector to build data products in the short-term, and with even less oversight and fewer controls, will come at the cost of long-term risks and harms to people through greater exposure of their digital footprint and identity. The effects can last a lifetime.

Data protection is a Gatekeeper to Access Digital Identity

This bill is a disaster for the public, in particular for children and the immediate and future security of UK identity as a national asset and as a national security gatekeeper — weakening the protections around personal data and ID are a threat not only to individuals but the State. Its soft wording seems like insignificant changes but then, if so, why change it at all? In fact this Bill brings in substantive and significant change to the UK data protection regime. The UK will diverge from existing data protection law, become a lone-rider in a new wild west of data washing for data hoarders around the world, and risks the interoperability of common high standards of personal data flows across borders.

Data protection is a gatekeeper to children’s lives with lifelong consequences

In an apparent government u-turn on its recent obsession with children’s online safety, the government is writing law now that will reduce children’s digital protection. This runs contrary to everything anyone interested in the subject has recommended for a long time, including in the 2018 resolution from the International Conference of Data Protection and Privacy Commissioners, because:

“inappropriate data processing practices by e-learning platforms, opaque automated decision-making and misuse of learning analytics, risk undermining data protection and privacy rights. In the case of children and youth, this can have significant and long-term social, economic and professional consequences.”

This is furthermore, a particular high-risk for genomic data often captured without consent as a baby– for which there is no need for change by actors who want to operate to the high standards of protection expected by the public, and for public interest research — people who want this changed want to operate to lower standards, for example, by not having to tell the public broadly what they will do in advance (at the point of collection) or not giving people any choice of the purposes of re-uses to exclude, for example military or abortion research to which some object as a matter of conscience.

Genewatch UK agrees. Dr Helen Wallace, Director of GeneWatch UK has said alongside their briefing, “This is a short-sighted and extremely dangerous attempt to tear up existing safeguards for people’s DNA and genetic information. If passed, these changes will damage people’s trust in health, research and police uses of their DNA, perhaps for generations”.

The Bill should be scrapped: it makes our research regime more amateur and puts people at greater risk from harm and unwanted interference.

There is NO need to redraft the definitions of personal data nor the definition of research nor the boundaries of legitimate interests. If those changes go ahead, it will not only weaken safeguards by enabling more personal data to be labelled as “exempt” under research exemptions, but swathes of personal data will be removed outwith the definition entirely — that relabelling will not change the nature of the data or its sensitivity or its threat model when distributed or used– it only serves to enable more exploitation of the UK public by industries  (domestic, international or otherwise) without the public’s ability to object or be informed and express preferences over being used as AI training datasets without our permission as an example. Rebranding personal data as research data, simultaneously weakens its protections set around the qualifications of the people who are accredited and qualified to handle it in safe ways. It reduces recourse to redress from malicious and opaque reuses; with effects for state and border security as well as individuals, for example in the case of children’s DNA and biometrics. Overall, it makes our research environment more amateur and increases the risk for public interest researchers that public trust will be lost in the nature of their work.

In the UK have already lost the protections of fundamental rights post-Brexit, because the government made the choice not to carry them over from EU Charter of Fundamental Rights into UK law. That means in particular a weakening of the rules to uphold respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity. In a world in which automated and machine-led decision making affects us more and more at speed and scale, where we are at constant threat of identity theft and financial fraud. The Bill fails to think Big or think for the future. Instead the Bill creates a future in which digital identity can only be a state accredited ID to exercise housing and employment rights, but makes the frameworks for protecting those identities far weaker. Data protection laws are used to uphold our human rights and are not supposed to be designed to become a gateway to fraud at speed and scale, and mass exploitation in secret.