Oral evidence: The big data dilemma, HC 468Tuesday 17 November 2015
Oral evidence, 17 November 2015.
Witness
Christopher Graham, Information Commissioner, gave evidence.
Chair
Commissioner, thank you so much for coming to speak to us today. You sat very patiently while we heard from the previous panel. I am sure that you will have some opinions about what they had to say. Your position is a public-facing one. First, could you give your opinion about the very contradictory findings of the DMA and Big Brother Watch in terms of the changing attitudes of the public to sharing data? Big Brother Watch claim their researchers found that 46% of people felt they were being harmed by the collection of data by large companies, and 79% were either very or fairly concerned about their privacy online, while the DMA say that between 2012 and 2015 the number of people happy with the amount of personal information being shared increased from 56% to 60%. That is quite a difficult picture for us to understand. Could you help us?
Christopher Graham
Indeed, Chair. Thank you very much for the invitation to give evidence. I listened with interest to your last session. I thought this was going to be a debate about big data. It is obviously a big debate about data, and much more wide-ranging than the impact of the massive analysis of different datasets. The two positions you heard can be reconciled, because research we have done shows that citizens and consumers have great concerns. Whether they are happy or frightened, they simply assert that they feel they have lost control over their personal information. They want to see the regulator on their behalf pressing their rights to protection of their personal information under the law as it stands; and they want to see that law updated to deal with the new phenomena we have heard about—the internet of things, big data and the very creative exploitation of data. You were hearing two sides, but they were not incompatible. The important issue we have to resolve is how we can assert information rights granted to citizens under the data protection directive 20 years ago, but clearly a bit creaky and out of date given all the developments going on in the data world, and make sure that we do not lose sight of the fact that, even though the rules of the game have changed in terms of the technology, the rules have not changed. You do not have to abandon the data protection principles in order to make big data work. With big data, there are tremendous benefits to be had, for example in the delivery of public services. If different agencies are able to talk to one another and inferences can be drawn about the mass, clearly that is interesting, but we must not decide that that simply changes the rules of the game to such an extent that privacy and the rights of citizens no longer matter. We can have both the benefits and the rights, provided data controllers think through the implications of what they are proposing and, as we heard from the last session, do proper privacy impact assessments and think about privacy at the outset. That way it is a win-win; we can have better public services, a better health service and more targeted delivery of services without having to accept that you will get discrimination, differential pricing and all the bad things that could follow if we get big data wrong.
Chair
Some of the evidence we heard from the previous panel was that increasing awareness about what was happening to data and the purposes for which it was being used was behind some of the changes in attitudes. I notice from your written evidence that you have made clear recommendations about including education on a risk-based approach to data protection not only in HE but in the school curriculum to raise schoolchildren’s awareness about data privacy. Could you explain that a little?
Christopher Graham
We have been delivering lesson plans for primary and secondary schools about information rights, both data protection and freedom of information. We have been developing those over the past two years, with good advice to make sure they are compatible with the national curriculum and that they deliver appropriate tools for teachers working with different key stages. We want to extend that work into further and higher education. I think the point was very well made that the very inventive people who are working on new products and applications need to understand what the implications of what they are doing might be. They almost need to understand as citizens and consumers the implications of what they are doing, so that they can build in appropriate privacy at the design stage. It is educating both consumers and developers.
Chair
What would be your assessment of current levels of awareness among young people of data privacy issues?
Christopher Graham
I think it is growing. There is a myth that happy-go-lucky teenagers don’t care about their privacy. Because they tend to know more about apps than the rest of us, they are probably more savvy both about the technology and the implications. I am told there are all sorts of applications that people of my generation would think are quite leading edge but are so last year that the kids are on to something else that has more security built into it. There is perhaps a tendency to let too much hang out on social networking sites that people might live to regret later on when they are applying for jobs, but that is just the process of growing up. In terms of understanding what permissions you can give and what permissions you can withhold, each generation gets a little smarter than the last.
Matt Warman
I am sorry I came in slightly late. Could you lay out a little bit about where you see the role of the ICO at the moment and where you see it when you have what is likely to be a whole load of legislation coming through from Europe in the nearish future in some form or other, and also from this place?
Christopher Graham
If you asked me to characterise the ICO at the moment, I would say fighting on all fronts. We are responsible for the right to privacy but also the right to know. You are looking at the data protection side of my business. I am also concerned about the freedom of information side and the interaction between the two. We are working very hard in such areas as nuisance phone calls and aggressive charity fundraising. Issues have been raised about the development of care.data and the treatment of data in the health service. Every week there seems to be a horror story at the top of my pile, and my investigation team and my enforcement team, which is being expanded, has more and more work to do. I am not complaining; it is an exciting job to do at the moment, but you are quite right to flag the fact that the general data protection regulation is coming down the track from Brussels. They are taking their time about it, but we believe we will see an agreement next year. The job of the Information Commissioner’s Office over the two-year period of transition to the new rules is to be there for data controllers and data subjects so that everyone understands what the new rules are. My organisation is very clear that we are going to have to change to respond to the new responsibilities, and we are standing on the diving board ready to go. It is taking a long time for those rules to be finalised. We are very much involved in the Article 29 Working Party in Brussels in that debate. There are things we like about the proposed changes and things we do not like, but there is still some way to go. Whether the Luxembourg presidency is going to finalise it or whether it will fall to the Dutch I do not know, but by the middle of next year we will know exactly where we are in that area. Life is never dull at the ICO, but it is particularly not dull at the moment.
Matt Warman
You mentioned a couple of recent high-profile cases. TalkTalk have now said that perhaps they had not taken all the precautions they could. Does the simple fact of getting hacked mean that you are in breach of the regulations that it is your job to oversee?
Christopher Graham
Every data controller has an obligation under the data protection principles to have in place appropriate technical and organisational measures to protect against unauthorised and unlawful processing. I am quoting from the data protection principles. When a data breach is notified to us, or we discover one, it is our job to investigate. That is what we are doing at the moment, so I must not comment further than that. I think your colleagues on the Culture, Media and Sport Committee will want to have a look at this issue as well. It is very important that the Information Commissioner is patrolling to make sure that data controllers are sticking to the rules. When something goes wrong, for whatever reason, we need to investigate and, if appropriate, use the powers Parliament has given us either to require undertakings or impose enforcement notices, or it may be appropriate to issue a civil monetary penalty. We have heard that the commissioner has the power to issue civil monetary penalties of up to £500,000 for the most egregious breaches of the data protection principles. I must not jump too far down the track. If it turned out to be bad actors, as they say in Brussels, the criminal sanction would come in, as was discussed in the last session. We will have to wait and see.
Matt Warman
Do you have data on the percentage of cases you look at where appropriate precautions were taken, so we should not be thinking about fining people who have been hacked—we should be treating them largely as victims of crime?
Christopher Graham
I noticed that TalkTalk were very quick to cast themselves as the victims—within the first 24 hours—and I cannot comment on that until we have completed the investigation. I can certainly get the Committee some statistics on the results of various investigations we have undertaken, to draw the general rather than the particular. In a situation like this the victims are the consumers whose details have been lost. An investigation I can talk about was a travel website earlier this year. We instituted a civil monetary penalty of about £130,000 because 5,000 consumer credit card details had been sold. We discovered that that company had put at risk the credit card numbers, security codes and signatures of 100,000 consumers, so if we are talking about victims those were certainly victims. That was why we imposed a civil monetary penalty. We have the powers to act where we can establish that it is the data controller who has gone wrong, but as far as TalkTalk is concerned we will have to wait until we have finished the investigation.
Matt Warman
I am trying to get a sense of how many data controllers you encounter who have been hacked despite not having gone wrong. They met a reasonable bar for securing people’s data, yet the criminals won the game.
Christopher Graham
I will have to get precise figures for you, but everyone has to accept that hackers are testing, testing, testing. It is a counsel of defeat to say you can never be secure. You can be more secure than you were last year, and you probably have to be. This has been a wake-up call for everybody. You have to put in place the most effective systems you can to make sure that customer information, which has been entrusted to companies, is looked after. The travel insurer I referred to was Staysure. We imposed a civil monetary penalty of £175,000 earlier this year. That is part of the wake-up call. A more effective wake-up call is simply for companies to look at what it does to their brand and their business. I am sure people in TalkTalk are very concerned about the number of people who will not be renewing their contracts with the company as a result of what has happened.
Matt Warman
You talked about being more secure than last year and getting better. How do you assess what is an adequate level of security? Is it done on a case-by-case basis, or is there a standard evolving that at any given moment is fixed in time?
Christopher Graham
We undertake a lot of audit work to help data controllers get things right. We are not there to catch people out. Last year we conducted 41 full audits and 17 information risk reviews, and we followed up on 56 other audits to make sure our recommendations had been followed through. That is the Information Commissioner being helpful. In the case I just quoted, Staysure, we discovered that the company had been keeping the security code information together with the credit card information. That was a straight breach of the rules, so it was not very difficult to work out that a civil monetary penalty was appropriate. You asked about the proportion of good guys and bad guys. I can get you that information. I do not have those statistics in front of me.
Carol Monaghan
Can I ask you a bit more about the consent side of data protection? In your submission, you say you envisage organisations facing problems in obtaining consent being able to apply other conditions in the Data Protection Act in order to legitimise the data processing. When might that sort of approach be appropriate?
Christopher Graham
The eight data protection principles, as opposed to the seven pillars, set out the rules under which data can be processed under the data protection directive and the Data Protection Act which stems from that. The first principle is that data must be processed fairly in accordance with the rights and expectations of citizens. Then there is a series of conditions that would enable you to process information, but always subject to that fairness test. One model is what the Americans call advice and consent; another model, which is also one of the principles, is what is called legitimate interests. If a company in the big data business, for example, is mashing this dataset with that dataset to predict behaviour and all sorts of weird and wonderful things and they are claiming to do that because they have a legitimate interest in doing it, and therefore they are not seeking consent, they have to be able to show that that is not at odds with the rights and freedoms of data subjects and the principles of fair processing. If you are going to claim legitimate interest, you really have to be able to make it clear to citizens and consumers what you are doing—what the deal is—and why you are doing it. That is where the privacy impact assessment comes in—at the very basic level of design of the project. When we published our paper on big data last year, our concern was that there were people out there who believed that computer science was so wonderful that we had moved into a 21st/22nd century model and, hey, the boring old Data Protection Act did not apply because it did not work; it was so last year. This is a very dangerous principle. You can still make the data protection principles apply if you apply them at the outset and think it through. It is obviously not going to be possible to get consent for every possible element in some big data mash-up that will give you predictive behaviour, but that may not be necessary. If, however, you simply go ahead and say, “Hey, we’re doing this because that’s what we can do,” you will be in trouble. You will be in trouble with the regulator, you will be in trouble with the law and you will also be in trouble with citizens and consumers, who will go off organisations that treat them in such a cavalier way. I do not think it is binary—that it has to be consent or it has to be legitimate interest. All I would say is that where data controllers are relying on legitimate interest they have to be careful, because it may not work if you have been so tricksy that consumers and citizens do not understand what you are doing and do not like it.
Carol Monaghan
Is there a danger that as big data brings different datasets together consent will be increasingly compromised?
Christopher Graham
I am saying that it is possible to do most big data projects within the provisions of the Data Protection Act and the eight data protection principles. It is possible if you design things the right way. If you are cavalier about it and do not try, you will get caught out. I am not saying that consent is never appropriate. In certain circumstances, consent will not be possible, in which case you have to have a very compelling argument why you have a legitimate interest that does not interfere with the rights and freedoms of citizens.
Carol Monaghan
In terms of regulation, what can be done to make privacy notices, terms and conditions, tick boxes and so on, a meaningful way of gaining consent?
Christopher Graham
A lot. Whether or not it involves gaining consent at the end of the day, you need to explain to your users what you are doing. It would help if privacy notices were written in English. It would help if privacy notices were not written by lawyers whose major interest is minding the back of the company; it would help if they were not the length of some of William Shakespeare’s longest dramas; and it would help if they were written on the principle that they might not actually be read, rather than people saying they do not have time for it and just pressing the button. We have done a lot of work with Google, for example. Since Google introduced their new privacy policy in 2012, without so much as a by your leave, we have been very much on their case. Working with Google, we have got them to develop a layered approach to their privacy notice so that you can get more information about what they are doing and proposing. We have moved Google from a privacy statement as long as your arm, full of boring lawyer stuff, to something that is much more interesting, user-friendly and, frankly, used. You have probably noticed, if you use Google services, that these things pop up and they are rather more informative. In some cases that leads to, “Do you want to use this service? Do you or do you not want to tick this box?”, but where an organisation is claiming the right under the Data Protection Act to do what they are doing because of legitimate interest they still have to explain, and they have to be more innovative in evolving ways of explaining what they are doing than data protection lawyers have traditionally come up with.
Carol Monaghan
Can you require them to be revised and improved?
Christopher Graham
We start off by advising. If people wilfully do not take our advice and an issue arises, we can get into enforcement mode. We have a good code of practice on privacy notices. We are revising that at the moment because of recent developments in technology, and in privacy notices too, and we will be consulting on that shortly. Where it comes to our attention that a data controller is doing tricky things, is not making things clear, or has a downright misleading privacy policy, that can certainly involve enforcement action which, after all, is what we were doing with Google. There are ways and ways of doing enforcement. We are interested in a way of doing enforcement that gets a result that is of benefit to consumers, rather than just getting off on civil monetary penalties.
Carol Monaghan
So you can.
Christopher Graham
Yes, we can.
Chair
What is your response to the comments by the Nuffield Council on Bioethics about historical medical data, and the challenges of informed consent by those who gave consent a long time ago for their data to be used for one purpose and that data might now be repurposed?
Christopher Graham
We have been very concerned by what we learned about what has been going on in the health sector. We are engaging very closely with the Health and Social Care Information Centre. I had a meeting the week before last with Dame Fiona Caldicott. The health sector is of huge concern to the Information Commissioner. We want to make sure that we do not get the nonsense of people’s personal medical data being used for purposes they had no idea about. We are particularly concerned about information given to GP surgeries or pharmacies landing up in quite inappropriate hands. We had a recent civil monetary penalty against the pharmacy firm Pharmacy2U. We imposed a civil monetary penalty of £130,000, because information given in good faith to the local chemist was landing up in an Australian lottery scam and with the purveyor of a herbal remedy who had been in trouble with the Advertising Standards Authority for unfortunate promotions. We are also working closely to try to clear up the mess after care.data. The Information Commissioner is sufficiently imaginative to see the power of big data in medical research and in the delivery of health services in the most efficient way possible for the benefit of patients and the taxpayer. If we can play our part in that we certainly want to, but we want to see things done in the right way so that people’s fundamental rights and privacy are not trashed in the name of some higher obligation to efficiency and the onward march of science.
Jim Dowd
Before we move away from privacy notices, for want of something better to do I clicked on my Sky box which told me to read the details of its software licence. It ran to 102 pages. Needless to say I did not read them, and I am sure nobody ever has.
Christopher Graham
That is the bit I do not usually admit to.
Jim Dowd
Incidentally, where do all the proceeds of these fines go?
Christopher Graham
Not me. The Chancellor—the contingency, I mean the consolidated fund; it may be the contingency fund, I don’t know. I am not incentivised to impose civil monetary penalties. Indeed, I do not even get paid the legal expenses of going after the miscreants, but it is a very useful tool in our toolbox of enforcement powers.
Jim Dowd
Do you get much resistance to paying?
Christopher Graham
We have had cases where suddenly the company finds it has gone bust and cannot pay, or it goes into liquidation and emerges the next day as something else but very similar. We are in an interesting field. One of the recommendations that I hope might emerge from your inquiry was touched on in the last session. That is the annoying inability of whoever it is to press the button to start the possibility of a custodial penalty for criminal breaches of the Data Protection Act. That is where individuals go rogue and, without the consent of the data controller, decide to sell information to claims management companies, do the dirty on their ex-wife or something else. At the moment these cases just land up in the magistrates court and it is a fine-only regime. I say “at the moment”, but actually you passed legislation in the Criminal Justice and Immigration Act 2008 to provide for the possibility of a custodial penalty, but it has never been commenced. It is section 77 of the Criminal Justice and Immigration Act 2008. If you decide to recommend that it be commenced, it could deal with people who make £30,000 by selling car hire information to lawyers after crashes and so on and land up in the magistrates court being fined just a few thousand pounds. If you decided to make that recommendation, you would be in the illustrious company, as the previous witnesses said, of the Joint Committee on the Communications Data Bill, the Home Affairs Committee, the Justice Committee and the Culture, Media and Sport Committee. One more push and it might actually happen.
Jim Dowd
I think the report will contain a lot of recommendations by the time we finish. You say in your submission that fairness is a key principle in the Data Protection Act, and that gaining meaningful consent from people is an important part of that fairness. You also indicate that it could lead to profiling and discrimination if left unchecked. Could you give us an example of how that might arise?
Christopher Graham
If we are talking big data, when it is really big it is potentially very useful. When it gets down to granularity it is dealing with personal information. Very often, big data is not dealing with personal information; as a previous witness pointed out, in the example of the advertising hoarding that was taking flight information and meteorological information, that is not personal information, so it is not covered by the Data Protection Act. Very often, big data projects which deal with massive datasets may be dealing with anonymised information. That is not personal information. Where it is dealing with personal information, the smaller it gets, the more potentially problematic it can be, particularly where inferences are being drawn about individuals’ behaviour that are to their disadvantage: for example, differential pricing. If I get a worse deal than you online because of all sorts of inferences drawn about my purchasing behaviour, that is not fair. The eight data protection principles, as I have explained are very clear: it has to be fair. Whatever other condition of processing enables you to continue to do that, whether it is consent, in which case the responsibility lies with the data subject, or it is legitimate interest, in which case the responsibility lies with the controller, it has to be fair. If it ain’t fair, it’s not legal, and that is where the regulator comes in.
Jim Dowd
In order to sustain fairness in this area, do you think it may be necessary to ban certain types of data processing that profiles individuals to their disadvantage?
Christopher Graham
I do not think one can generalise, nor need one generalise. The law is clear that it is a breach of the first data protection principle if the processing is not fair and is not in line with data subjects’ rights under the legislation. That is where the ICO comes in. You do not have to say, “We don’t like this category, that category and that category.” The circumstances of the processing will lead to the offence, if there is an offence. In the same way, we say to data controllers that, if they are planning a big data project, they should think through the privacy implications right from the start and conduct a privacy impact assessment, just as you would a risk assessment, a PRINCE2 project management or whatever it is. These days you have to do the privacy side as well. If you do not and you get it wrong, you will be in trouble with an information commissioner who, at the moment, has power to impose civil monetary penalties of up to £500,000 and trash your reputation. Under the new regulation being forged in Brussels, data protection authorities across the European Union will have the potential to impose civil monetary penalties based on a percentage of global turnover, which will make even the Googles of this world sit up and take notice.
Derek Thomas
When data are reused, is it your job to prove that the original consent no longer applies, or is it the job of the person who has the data to prove that the consent still applies?
Christopher Graham
It is the latter. If you acquire a list and you are going to use it as part of your processing operation, you are the data controller because you bought the information. You have to satisfy yourself that, if the person selling it to you says there is consent, there really is consent. The lead generator and list broker businesses are an area ripe for investigation. I would like the power to make an assessment, as we say: a power of non‑consensual audit over some of these guys who, particularly in the nuisance phone call and the high-pressure charity fund-raising businesses, are doing all sorts of interesting things I would like to investigate. I cannot do that unless I get a court order, which I will get only if I have reason to believe things are going wrong or I am invited in, and that does not happen very often. It is not the responsibility of the Information Commissioner to prove that there was not consent; it is the responsibility of the data controller or the data processor to prove that there was. In some of the interesting cases we are looking at now it is very difficult to see where there is any evidence that consent was given. Even if consent was given for the original purpose, do the data subjects whose information is being traded have any idea what is happening to their information? Where is it going? Have they given permission for it to be used for another purpose? I suspect not.
Derek Thomas
We have talked about bringing together different datasets to find new insights. That has raised concerns that in the case of previously anonymised data we can now identify to whom the data belong. How do you police that?
Christopher Graham
We are doing a lot of work on anonymisation. We have put money in to help fund the UK anonymisation network, which is full of clever computer scientists working out unbreakable codes. We have also published a code of practice on anonymisation. We want to get people to think. A lot of the cases quoted to us are fairly simple things where you mash this and that and you can identify people, but for progress to be made, for example, in very sensitive areas of medical care, you do not need to know who it is you are dealing with; it is just an instance of a particular habit of prescribing, a medical condition and so on. If people are to have confidence that their data can be used for a beneficial purpose, they have to be jolly sure that it will not have a code that can easily be cracked. Anonymisation is very important, and the Information Commissioner’s Office thought it worthwhile to invest real money to get that debate going.
Victoria Borwick
Following on from your code of practice and privacy impact assessments, have you been able to establish how fully and widely they are being used?
Christopher Graham
We are fairly optimistic. We started talking about privacy impact assessments a few years ago, building on work developed by one of the commissioners in North America about privacy by design. In 2014 we produced a code of practice where we specifically made the link between other methodologies, such as PRINCE2, so that it did not feel alien for people working on projects to build it into their project management scheme. We are also building on research we commissioned in 2013 from an outfit called Trilateral, which found there was pretty good take-up—I need to send you the figures that support this assertion—and awareness of the need for privacy impact assessments. Given the very high-profile breaches in recent months, people would need to be very deaf not to realise that that is one of the things the Information Commissioner is looking for when he comes to call. I am reasonably optimistic. It is clearly a win-win moving forward, because if you are looking at big data—rubbish in, rubbish out—you want good data to be able to draw correct inferences from the datasets you mash. Similarly, the commercial players need trust. Indeed, the Government need trust. If you are to roll out something like care.data in the health sector, there is a lot of ground to be made up and a lot of trust to be won. It raises confidence if people rolling out projects can show that they have considered the privacy side of what needs to be done, in order to win the confidence without which you simply cannot make these projects work.
Victoria Borwick
Do you wait for the data protection cases to be referred to you for investigation, or do you proactively audit?
Christopher Graham
It is a bit of both. We learn a lot from complaints. Complaints to us are data. That is how we have managed to make some of the big breakthroughs in the nuisance call business. People have taken the trouble to report on the Information Commissioner’s website, so we have leads and we can see patterns building up and work out who the bad actors are.
Victoria Borwick
That is about the constant repeat calls we all get, for protection insurance or whatever it is called, however many times you press delete, delete, delete.
Christopher Graham
Yes. A gratifyingly large number of people go on to the ICO website to report concerns about nuisance phone calls. They say, “These are the people who rang me, this is what they said, this is when it was and this is the number.” That has enabled us, for example, to execute a couple of warrants in Trafford and Hove where we found warehouses full of mobile phones with prepaid SIM cards just dialling up numbers.
Victoria Borwick
That is very valuable.
Christopher Graham
We are also doing a bit of mystery shopping. You ask whether we just wait for complaints to come in. No, we do not; we go out and buy our own prepaid SIM cards and see what calls we get. We log the information and act upon it. We also do a lot of proactive audit and advice work, not to catch people out but to help people to do things better. It is a combination of active and passive that helps us to deliver.
Victoria Borwick
It is very valuable to know that. Part of the role of this Committee is to inform and make sure people understand. It reminds people that it is available to them when they hear it said today on the web, so to tell us that is really valuable. Are there particular sectors that you think are worse than others? Is the public or private sector worse? What about local or central Government? Do you have particular areas of concern? You have kindly touched on some today.
Christopher Graham
I have a continuing concern about local government. I know everyone is working very hard in local government and they are suffering cuts, but local government deals with some of the most sensitive information, after the health sector. In the health sector I recently got the power of non-consensual audit. I think I should have the same for local government. Local government deals with social care; increasingly, it is dealing with the join-up between the health service and social care. In Greater Manchester, it is going to be in charge of the NHS. It is illogical to have responsibility for the NHS in terms of having the power of non‑consensual audit when the NHS is the NHS, but as soon as it is the northern powerhouse I do not have that power. I have great hopes that the new Secretary of State will listen to the very logical case that, if I have that power in the health sector, I also ought to have it for local government.
Chris Green
The ICO is developing a privacy seal. How do you envisage that working?
Christopher Graham
The idea of a privacy seal is that it is beyond the ISO standard; it is something people can recognise as a good housekeeping seal of approval on sites that sign up to doing things properly, and are prepared to be audited for doing that. I do not want it to be an ICO symbol, because I reserve the right to investigate complaints, even in the case of those proudly carrying the badge. We have to develop a different brand and it has to be one that conveys something to consumers and is recognisable, so there is a good piece of marketing work going on at the moment. What we want to do then is identify scheme operators who can apply that brand independently of the ICO—operators who have been accredited by the UK Accreditation Service. It is a very carefully designed project. We envisage that at the beginning of next year we will be able to advertise for scheme operators. When we have the scheme operators in place the following year, in 2017, you will see that good housekeeping seal of approval. I think that will give consumers a way of recognising that this is a serious player that understands privacy and is committed to looking after their data. That will give those companies a competitive advantage.
Chris Green
We heard earlier about a relationship developing between the service provider and the user, and that whenever the relationship is changed by the service provider you can approve and say, “Yes, I agree to this.” We could imagine that, if we have a whole range of different relationships with different service providers, having to agree to these things time and time again could become quite a burden.
Christopher Graham
Yes—or not.
Chris Green
With a kitemark or a privacy seal, we could say, “I am comfortable with this company because they have a privacy seal. I do not need to read all these documents.”
Christopher Graham
You still have to make choices, don’t you? I hope the privacy seal will help to sort out the people who take it seriously from the people who couldn’t care less, but at any time companies are entitled to offer a different proposition. At the moment, my bank is putting to me a different proposition about my account and my credit card. I will decide whether I am interested in that. If not, I will take my business elsewhere. That is not about privacy; it is just that this is the deal. You were getting points; now you will not get them but something else. I need to think about that. As intelligent consumers we always need to consider choices, but what we do not want are phoney choices foisted on us with just, “Here’s a load of legal blah, which you won’t have time to read, but, hey, press the button and off we go.” Then you find that you have signed away your rights. The example I like to quote is the No. 88 bus, which runs between Altringham and Wilmslow and provides a wonderful wi-fi service. At least I thought it was wonderful until I looked at the privacy notice. The last time I looked it said, “Privacy notice: to be posted when agreed.” I did not find that very reassuring and—tell you what—I do not use the service.
Chris Green
If you see the kitemark, whatever form it takes, you would have a certain level of trust that the relationship is quite reasonable and normal.
Christopher Graham
Yes. If my bus company by a miracle got the seal and then was not providing a privacy service, it would pretty quickly lose that seal.
Chris Green
The European Union is developing a kitemark with the EU data protection regulation. Will the privacy mark be compatible with that?
Christopher Graham
Yes, and we are ahead of the game. It is one of the things that I think is in all three drafts. The Parliament, the Council and the Commission drafts talk about encouraging accreditation seals, so we are confident that ours will work under the new rules. Ours will be in place about two years before the regulation comes down the track.
Dr Mathias
In your submission you talked about wanting the introduction of a criminal offence for breaches of the Data Protection Act. Why is that necessary, especially when you have been talking about the existing Criminal Justice and Immigration Act? Can you expand on that?
Christopher Graham
My major concern is that section 77 has not been commenced yet, as you know. By the way, there is section 78 as well; it provides a defence for investigative journalists who might be caught up in this, so sections 77 and 78 both need to be commenced together. There is a criminal penalty for breaches of the Data Protection Act, but it may be that in this world of big data we need to extend that a little to deal with the problem of the de‑anonymisation of datasets, which was mentioned. If some malicious troll—
Dr Mathias
Are you saying that section does not cover it?
Christopher Graham
Section 55 just deals with the unauthorised obtaining or disclosure of personal information without the knowledge of the data controller. I would not like to test a de‑anonymisation or re-identification case against that. It is worth floating the idea that, in the same way as the 20-year-old directive needs updating because of developments in the digital economy and big data, possibly the Data Protection Act needs updating too. Of course, the Data Protection Act is the way in which the directive was transposed into UK law, so it probably needs a bit of a tinker as well.
Dr Mathias
What concerns me is that you are saying the legislation is not specific enough, yet if you make it too specific you will need to create more laws. Would that be right?
Christopher Graham
We could proceed immediately. I know that primary legislation takes for ever, and I cannot imagine that the Government would want to embark on a revision of the Data Protection Act until we know what the regulation says. Nothing is going to happen until the next Session of Parliament at the earliest, but the commencement of sections 77 and 78 of the 2008 Act could and should happen in very short order, because one of the ways in which you can rebuild confidence after the care.data fiasco, for example, is to reassure people about their pharmacy, GP and car information, if it goes AWOL not because the data controller got something wrong but because somebody just decided to do something bad. That is not about a civil monetary penalty; that is about taking people to court. At the risk of boring you, the problem is that when you get to court the fine will always be based on your ability to pay. If you have just been sacked, it is very easy to make the case that you have no means, so the fine will be very modest, and even if you made £35,000 by the scam you will still be fined a paltry sum. You need to have in the back of your head, “This is serious. I could go to prison. It’s not worth it; I won’t go there.” That would raise the profile of the whole concern about privacy and data protection. I am not one of those people who believes in banging up everybody—I am sure you aren’t either—but it never says that you might possibly go to prison, or there is anything between a fine of 400 quid and anything else, or the possibility of a suspended sentence or community punishment. My people investigating these activities cannot require people to attend interview because it is not a recordable offence. All this stuff is just basic, surely. This Committee is looking at the really difficult stuff of big data and the future. Here we have a little piece of legislation that nobody has got round to commencing yet, and which is absolutely fundamental to protecting privacy and instilling good data protection principles before we ever get to any of the difficult stuff.
Valerie Vaz
Has that stopped you or prevented you taking cases further?
Christopher Graham
I take cases before magistrates courts and I weep when the fine is £250 and a £100 community sentence, but it does not stop me taking the cases. It does not provide the deterrent that I want. We will continue, but it would make our investigations much easier if I could require people to attend for interview rather than asking them nicely. It would make the investigations quicker. If the offences were recordable and on the police national computer, that itself is a disincentive.
Valerie Vaz
You and some of my colleagues have touched on the regulations that are being looked at. For the record, where are we with the regulations? Presumably, you have been involved in them and in a number of issues coming up. I mentioned some of them earlier: the right to be forgotten and the reference to 5% of turnover, which I think would be helpful to you in the case of some of the bigger companies. Where are you on some of the main enactments that they are looking at?
Christopher Graham
Our position is that it is a bit of a curate’s egg—good in parts. The bits we like are where there are enhanced and relevant powers and rights for data subjects and data portability—very often access to data in digital form. We heard about the midata project. That is being legislated for. Data portability is really more relevant than the right to be forgotten. It is not really a right to be forgotten; it is a right to be de-listed, if you like, or a right to be a little more anonymous so that in certain circumstances you cannot have searches on your name that produce all sorts of outdated and irrelevant information, or spent convictions which may be outdated and irrelevant. We like the stronger fining powers for data protection authorities. As to whether it is up to 5% of global turnover, we will see. What I do not like is the lack of discretion I would have as a data protection authority. It is no good the text saying that, in the event of this, this and this happening, the data protection authority shall impose a fine of up to such and such. Better regulation is about having discretion and deciding which tools to employ. I am told that what it actually means is that you would only have to fine €1. Well, excuse me. It is not worth going through all the legal rumpty-too to fine €1. Credit us with a bit of common sense and leave it to data protection authorities to decide on the best tools to use in order to secure compliance. That is an example of the way in which the regulation in its various forms is rather over-specced. It is as if every good practice example has been thrown into the pot and then legislated for. We won’t be able to move for all these very specific obligations that are a bit box-ticking. I am hoping that over the next few months it will lighten up a bit. We know that the ICO will have to change. I do not want it to have to change to be just a circumlocution office, if you like, for the new regulation. We also remain to be convinced that the detail of the one-stop shop has been thought through. A one-stop shop is a great idea if you have cases being pursued across all the member states in different ways. That is a waste of everybody’s time and it is an annoyance for the big players. If you are to have a one-stop shop, have it, but a one-stop-shop that then has to involve all the data protection authorities with rights to appeal in all the national courts is what I have described as a one-stop shop with a branch in every town. It is really not worth having. We recognise that it is a game changer and will be a huge task for the ICO. We have a major task to inform industry and public authorities how they will have to change to comply. That will fall to my successor, not me. It is very important that Whitehall gets on with the business of pressing the starting button on the recruitment of my successor, because I run out of road at midnight on 28 June next year. We need the next Information Commissioner to be identified as soon as possible. There is a task for somebody over Christmas.
Valerie Vaz
That is very sad to hear, because you have been an exemplary information commissioner. I know your term was extended. Do you think the role will change once the new regulations come in? You touched on updating the DPA 1998. Presumably, new legislation will have to be made to incorporate where we are on the technology.
Christopher Graham
Yes. We are readying the ICO for having to move in a different way, but a different way to deliver the same result, which is upholding information rights on behalf of citizens and consumers, making sure that public authorities can do things sufficiently and that industry can thrive, but all sticking to the rules so that the wonderful potential of the digital economy works for all parties and delivers results, and is not based on trickery and the clever guys doing down the ignorant and the big guy doing down the little guy. The Information Commissioner is there to hold the ring. We will do it in a different way and with increased powers. I hope we will do it with increased resources. By abolishing the obligation to notify under the Data Protection Act, the new regulation poses a little problem for me, because that is £18 million of income down the tubes. We have to think of a different way of funding the regulator in fairly short order, which is another thing to think about over Christmas. There is lots to be done, but we are not daunted. We are raring to go at the ICO; we just want the starting gun to be fired on all this new stuff.
Valerie Vaz
Do you see a new DPA?
Christopher Graham
There will have to be. The Data Protection Act will have to be amended to take on board the requirements of the regulation, because the regulation will apply. It does not have to be transposed in the same way, but our law will have to flex to accommodate the fact that there is a regulation that applies in all member states. Increasingly, we are dealing with cross-border phenomena. We have to make things work within the European Union and we have to make things work with colleagues right across the globe. There is no point my raging in the UK against some American outfit unless we have good relations with the Federal Trade Commission and other partners. It will be a different job, but a different job delivering the same increasingly important objective of making sure that there is a level playing field and that the fundamental right to data protection and privacy is secured.
Valerie Vaz
Thank you for waiting while we had a vote. Thank you for all the work you have done.
Christopher Graham
Thank you very much. I still have seven months to go, so don’t write me off.
Valerie Vaz
But we might not see you before then.
Chair
You made a few recommendations to the Committee this afternoon. You mentioned that you do not have audit powers without consent. Is the issue that the threshold at court is too high to make your case, or is it that you want audit powers just within your own statutory basis?
Christopher Graham
There is the power of assessment where the Information Commissioner can come in and have a look at an organisation, but it is by consent. The previous Prime Minister, Gordon Brown, simply said that all Whitehall Departments will be subject to non-consensual audit by the Information Commissioner. Most recently, that right was extended by ministerial order to health service bodies. I am saying that it ought logically to apply to local government as well. I have written to Greg Clark about it, because it is really important. It is about confidence building. If performance needs to be improved in local authorities, we should not have to wait for a car crash. Local authorities need to know that the Information Commissioner could come in and run his eyes over the books; otherwise, I have to wait until something has gone wrong to get an information notice to carry out enforcement work.
Chair
Are there any other areas of concern or sectors where you do not have the audit powers that you feel you need?
Christopher Graham
There are quite a few. I must not run before I can walk, and there would be a question of resources to do this. I think the lead generator and list broker sector is one where it would be very logical for there to be powers of compulsory audit.
Chair
We have just been talking about the EU regulation, which is obviously going to have a huge impact on domestic legislation. Give us an idea of your assessment of the timeline for that. We are hearing conflicting reports about when those three versions might become one version and when that might make more progress.
Christopher Graham
Don’t hold me to this, because I have lost track of whether it is all going to be sorted out in the Latvian, Luxembourg or Dutch presidency. If things really go wrong it will fall to the UK presidency in the second half of 2017, which nobody seems to be aware of, to sort out. The Luxembourgers are really determined to get a political agreement by the end of the year. Then there will be a bit of to-ing and fro-ing and possibly by late spring the thing will be finalised, but there is then a two-year transition period. That is where you people come in with changes to the Data Protection Act, probably in the next Session, and the Information Commissioner will be charged with the very important matter of helping business, industry and consumers to come to terms with the new rules.
Chair
Commissioner, thank you very much. Valerie Vaz is right. You have been an outstanding commissioner in what has been a challenging time, with data expanding exponentially. I hope you will not allow the challenges of the next few months to keep you too challenged over Christmas and that you enjoy a little bit of Christmas. We may write to you to follow up some of this evidence, and perhaps some of the issues to do with the Investigatory Powers Bill. Thank you very much for your evidence and for waiting patiently.
Christopher Graham
Thank you very much indeed. Oral evidence: The big data dilemma, HC 468 36