openDemocracyUK: Opinion

The UK government’s plan to reform data-protection laws are terrifying

Everything that Cambridge Analytica did would probably be legal under these new plans

Alex Stobart
18 November 2021, 3.26pm
Boris Johnson's government aims to put citizens' data up for sale
|
Stefan Rousseau/PA Wire/Pool via REUTERS

Personal data is personal. It’s about living human beings. But with its ‘reform’ proposals, the UK government aims to put citizens’ data up for sale on global markets. A commodity to be traded. Like pork bellies or copper or debt.

The ‘Data: A New Direction’ consultation, which ends this Friday (November 19), has introduced the biggest wholesale attack on the rights of UK citizens in decades.

In his ministerial foreward to the consultation paper, published in September, then culture secretary Oliver Dowden said reforms are needed because existing General Data Protection Regulations (GDPR) inherited from Europe are “unnecessarily complex or vague”. He said the government wants to end the “persistent uncertainty” that has prevailed since their introduction. But it uses even greater vagueness, apparently deliberately: words like ‘responsible’ (which appears 52 times in the consultation) and ‘safeguards’ (95 times) every time it’s introducing an attack on citizen rights – which the consultation never bothers to define. And, if implemented, it will produce even more uncertainty, which will last much longer than just three years.

The government justifies its proposals on the grounds that it is tackling ‘consent fatigue’, encouraging research and promoting the benefits of Artificial Intelligence (AI).

Get our free Daily Email

Get one whole story, direct to your inbox every weekday.

Consent fatigue stems from the relentless series of requests to a citizen to accept something, such as a privacy policy or cookies, with no real explicit sense or value, over and over again, to drive them into submission. Again, there are also users that show a tendency to simply accept the privacy policy without even reading it extensively, which is related to ‘consent fatigue’.

This focus ignores the vast majority of organisations in the UK that collect personal data for the purpose of providing a service, which is allowed for by GDPR if it is in performance of a contract, and where there is no evidence of a need for reform.

It tackles consent fatigue by making it irrelevant, redefining “legitimate interests” (by which organisations can collect and use personal data without the need for consent) so broadly as to mean almost anything. New, vague, definitions of legitimate interest include “internal research and development”, “business innovation purposes”, and “managing or maintaining a database to ensure that records of individuals are accurate and up to date”.

Related story

2GN04J6.jpg
Boris Johnson looks set on using our health data as a bargaining chip to keep his Brexit/US trade dream alive – but what does that mean for us?

GDPR is built on the principle of purpose limitation – that data should be collected only for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. But, arguing that “in a research context, the nature of processing activities may not be fully determined at the outset”, the proposals seek to ‘disapply’ current requirements for controllers to inform citizens when they intend to use the data for other purposes when it is for ‘research’ purposes. This is an open invitation to gaming and abuse.

On AI, the government takes a different tack, arguing that biased, discriminatory applications of AI are caused by a lack of data. On these grounds, it proposes to effectively remove citizens’ right to object to automated data processing, and determines that organisations should be able “to use personal data more freely, subject to appropriate safeguards, for the purpose of training and testing AI responsibly”. Another open invitation to gaming and abuse. (Note the use of the words ‘safeguard’ and ‘responsibly’ –what does the UK government mean?).

It goes on. Current ‘restrictions’ on data sharing between organisations are “unnecessarily inflexible and impractical”, so need to be relaxed. Citizens’ rights to access the data held about them by organisations are “time-consuming” and “costly” and should therefore be constrained. And the role of the data protection regulator, the Information Commissioner’s Office, needs to be “strengthened” by a new “growth duty” that requires it to “consider the importance of the promotion of economic growth whenever it exercises one of its regulatory functions”. The government talks about the need for trust and transparency, but every proposal it makes reduces transparency and undermines trust.

Many media owners are quietly delighted at the disastrous ‘new direction’ the government is taking on personal data

Given the comprehensive, wholesale nature of this attack on civil rights, you might have thought that it would have triggered a media furore. But it has been close to silent.

Perhaps that’s because many media owners are quietly delighted at the disastrous ‘new direction’ the government is taking on personal data. It may also be that the government’s strategy for pushing the ‘reforms’ through is working. With more than 50,000 words of dense, technical, complex (and disingenuous) argumentation – with 407 clauses and 177 questions, which never allow any discussion of the purpose of the reforms or the logic behind them – it appears designed to put people off from reading the consultations, never mind thinking through its implications... which are terrifying.

Who is bankrolling Britain's democracy? Which groups shape the stories we see in the press; which voices are silenced, and why? Sign up here to find out.

Comments

We encourage anyone to comment, please consult the oD commenting guidelines if you have any questions.
Audio available Bookmark Check Language Close Comments Download Facebook Link Email Newsletter Newsletter Play Print Share Twitter Youtube Search Instagram WhatsApp yourData