The Data Protection Bill: The politics of privacy
Speaking to BBC Radio 4’s Political Thinking last week, Culture Secretary Matt Hancock described the outcry over the alleged (mis)use of data by Cambridge Analytical recently as a ‘turning point’ in the debate about online privacy.
Thanks to the current passage of the Data Protection Bill through parliament, which is a vehicle for introducing the European General Data Protection Regulation (GDPR), concerns about what massive corporations know about us as individuals, and how they use that information are at the forefront of the legislative process. Decisions made now may well have lasting repercussions. New Labour’s review into new technological communications led to the 2003 Communications Act and the creation of a new regulator, Ofcom. The Data Protection Bill is expanding the remit of the Information Commission, and will pave the way for further legalisation to address concerns around privacy and data ethics.
Bill is under added scrutiny because of the need to ensure cross-border data sharing can continue post-Brexit. Added to this, EU Member States must implement the GDPR directive by 25th May. In different political times, this Bill with cross –party support could have passed with little public or media attention, however the current climate of concern over our privacy; control over our borders; and the Conservatives’ fragile working majority means that the Bill has been a crucible for a political explosion – and the potential for fireworks is not over yet.
The Data Protection Bill has three key objectives: improving data rights for individuals; increasing the requirements on companies that engage with personal data; and strengthening potential sanctions should a company suffer a data breach.
Under the new legislation, organisations will be required to notify the Information Commissioner’s Office within 72 hours of a data breach taking place, if the breach risks the rights and freedoms of an individual. The ICO will also be given enhanced powers to impose sizeable sanctions in the event of a data breach – up to £17m or four per cent of global turnover, whichever is greater. For Facebook, that would be $1.6 billion; for Google, $4.4 billion – a bill even these technology giants would notice. As a result, businesses of all sizes will be under increasing pressure to review their data practices, to ensure that they are not hit with a fine that could damage their reputation and profits.
Exemptions from this include journalists, scientific and historical researchers, and anti-doping agencies. More controversially, it also introduces exemptions to data subjects’ rights for the purposes of maintaining effective immigration control and for intelligence activities. Human Rights organisation Liberty has argued that this is ‘a brazen violation of the data protection and privacy rights of migrants’.
Given the Government’s clear goal of facilitating cross-border data sharing, any derogation from EU law risks undermining this aim. Labour is particularly agitated by the need to ensure that the UK and EU’s data protection legislation is in ‘lockstep’ at the point of Brexit and beyond. They will continue to push for the incorporation of Article 8 of the Charter of Fundamental Rights to protect citizen’s privacy, the right to collective redress and new safeguards – including a Data Bill of Rights – covering all citizens, including migrants. Without this, they argue that Government are putting UK-EU data sharing at risk, an argument that will receive cross-party support.
Many companies have already begun to change their data-collection and data-handling practices in preparation for the GDPR. If nothing else, the Cambridge Analytica scandal ought to prompt organisations to take a close look at their information management processes.
Already, the big beasts have been responding. Google has announced that it will stop mining emails in Gmail to personalise ads, and recently revamped its privacy dashboard to be more user-friendly. In January, Facebook announced its own privacy dashboard (although this has yet to launch). Just this week, writing to Damian Collins, Chair of the DCMS select committee, Facebook UK’s Head of Public Policy promised to review the platform’s relationship with third party apps. With the freedom to opt in rather than the burden of opting out, businesses will need to focus their efforts on building customer trust, and making the positive case for data sharing.
This is not just a priority for business. In Parliament, the debate is being led by a new generation of digitally-aware MPs, with Labour leading the way. On the Public Bill committee, Chi Onwurah MP, former Head of Telecoms Technology at Ofcom and Darren Jones MP, who worked on EU law for BT, have both shown the value of commercial expertise.
For the newly promoted Hancock, the Bill has provided him the opportunity to make his mark (and not only by launching his own social networking app). With Theresa May’s mind on Brexit, Hancock has been able to own the Bill and prove his ability to manage controversial legislation through both Houses.
That said, there are serious questions over whether the legislation will be in place for 25th May. The Bill has become a Christmas tree for a whole host of prescient concerns: post-Brexit data-sharing, press freedom, data rights, and corporate responsibility. As we recently discussed, Hancock is determined to stop any attempt to implement Leveson 2 in its tracks. Despite overturning amendments to the Data Protection Bill committing Government to holding a Leveson-style inquiry at committee stage, Labour is widely expected to try to reinsert the requirements at Report, which begins in the next two weeks. Meanwhile, the SNP have introduced an amendment seeking to limit press freedom clauses to England and Wales, on the grounds that the original clauses constitute Westminster meddling in devolved matters.
What’s clear from the Cambridge Analytica fallout is that the Government will have to work hard to fulfil the manifesto promise to ‘make the internet work for everyone – for citizens, businesses and society as a whole’. This Bill is just the start.
Ultimately its impact will rest on how aggressively consumers wield their new rights. In the current climate, it’s seems a safe bet that that they will.