Author: info@amberhawk.com

The blog provides a summary of seven areas where the proposed Data Protection and Digital Information No. 2 Bill (“No.2 Bill”) undermines privacy issues; these should be debated by Parliament. Some area, such as ICO independence and research, are left unexplored in this Blog. 1.   Absence of Keeling Schedules It is difficult to comment on legislation that significantly modifies existing legislation if the relevant Keeling Schedules, which detail the proposed legislative changes, are unavailable (perhaps deliberately so).  The No.2 Bill

I have come to the conclusion that the new definition of personal data in the Data Protection and Digital Information No.2 Bill (“No.2 Bill”) only applies to facial recognition CCTV if the data subject is on a watch-list. If the individual is not on a watch-list, and the camera images are deleted immediately after checking the watch-list, then personal data are not processed and there are no data protection obligations (e.g. no transparency) It then follows that if the watch-list,

The press release associated with the DPDI No.2 Bill proudly states that the Bill ensures “that the new regime [is] built on the UK’s high standards for data protection and privacy”. These new “high standards”, evidently, includes adopting a definition of “personal data” that fails to meet the data protection standards established by the text of the Council of Europe (CoE) Convention No. 108, as published in January 1981. In other words, the most enduring international binding agreement on data

Many commentators have remarked how very similar the Data Protection and Digital Information (DPDI) (No.2) Bill is to the original DPDI Bill published last June.  If this is the case, how is it that the No.2 Bill’s projected “Best Estimate” savings is £4.7 billion over a decade, whereas the “Best Estimate” savings for the original DPDI Bill (the “No.1 Bill”) is a mere £1.45 billion over a decade? Given the fact that there is no official comparison document, explanation or

The new Data Protection and Digital Information (No 2) Bill (“No.2 Bill”) has been published, minus any Keeling Schedule, and minus any indication of how the new Bill has diverged from the old.  The Department for Science, Innovation & Technology (DSIT) has this information to hand; its failure to publish it performs an unnecessary public disservice. The press release accompanying the No.2 Bill says the legislation has been “Co-designed with business from the start, this new Bill ensures that a

There is an adage (disputed by Transport for London) that if one waits at a bus-stop for more than half an hour, three or four buses will then turn up, almost in a convoy.  Curiously, this adage appears to apply to the management of digital identity. There are four recent proposals recent proposals relating to ID which have overlapped. They are: the parts of the legislation in the dormant Data Protection and Digital Information (DPDI) Bill that relates to digital

Three important facts have survived the political psycho-drama of the last two months. Despite approaching austerity, the Government remains committed to the removal or modification of all EU Regulations such as the GDPR by the end of 2023. The re-appointment of Suella Braverman (Home Office) and Dominic Raab (Ministry of Justice) increases the risks to the UK’s Adequacy Agreement, courtesy of these Ministers’ desire to fundamentally alter the Human Rights Act. Michelle Donelan returns to the DCMS as data protection

It is well publicised that the Liz Truss Government wants rid of all that Euro-“red tape” by the end of 2023.  The Data Protection and Digital Information Bill (the “Bill”) does just that for the GDPR. Previous blogs have explained the Government has used its “Brexit Freedoms” to define “personal data” below DPA1984 standards, and to legitimise widespread data sharing across the public sector (e.g. to permit disclosure to HMRC when disclosure is not necessary for its functions). This blog

This blog questions how the Data Protection and Digital Information Bill (the “Bill”) impacts on the lawfulness and compatibility of any further processing by a controller, in particular, a controller that voluntarily discloses personal data to HMRC.  This worked example illustrates how this Bill further undermines the current level of protection afforded to data subjects. In summary, the Bill allows HMRC to lawfully obtain personal data for its purposes via voluntary disclosure from any controller;  such disclosures can occur even

This blog considers how the Data Protection and Digital Information Bill (the “Bill”) impacts on the lawful bases used in the context of voluntary data sharing with public bodies. It explains how the Government is building a legal infrastructure that provides Ministerial powers to legitimise voluntary and general data sharing across the public sector which does not need to consider whether data sharing is in the “public interest”. For instance, is it “in the public interest” to disclose personal data