UK promises big data law shake-up... while also keeping the EU happy, of course. What could go wrong? The UK has named a new Information Commissioner and announced a bullish approach to reforming data laws post-Brexit. That is, if it's all OK with the European Union. Digital Secretary Oliver Dowden promised the UK would "seize the opportunity" offered by the UK's departure from the EU "by developing a world-leading data policy …
of the UK telling the EU what it's job is. Apparently the UK has decided that it's OK for the UK to (re)join the Lugano Convention although the EC don't quite see it that way.
Now the UK is telling the EU that the UKs data laws are OK with the EU. Surely that's for the EU to decide ?
Well since we were a founding member of and signatory to Luango (which include some non-EU states) up until we left the EU and nothings substantively changed so why shouldn't we apply to rejoin after Brexit? Oh, I remember, the EU commission has got to use every bureaucratic leave available to it, to be a right pain in the ass.
Considering the UK government has made a habit of breaking promises, violating treaties, reneging on agreements it has signed just months prior and is filled with people happily breaking international law nobody in their right mind would want to get them involved in anything formal. Imagine having to trust the UK government that it will do what it has signed up to. Ultimately 'Lugano' is all about trust.
Actions have consequences and I would rather sign an agreement with a crack addict than the UK government because at least with a crack addict there is a chance they will honour the agreement.
Call me cynical, but the UK govt hoping to stop "high risk cookies" while allowing all the others, sounds very much like they are pandering to the American spam ad overlords.
Seriously, innovation in cookies? Or more accurately, innovation in manipulative creepy stalking? That would largely benefit the American IT crowd.
Ublock and Ghostery FTW.
"Who makes the laws?" The UK makes its own laws, as does the EU. But as we have known all along our laws must align with the EU's in areas of interest to the EU, and that applies to all 3rd Parties, contrary to the iies still spouted by Brexiteers.
Which promises has the UK Government broken?
Which treaties have they violated?
Which agreements have they reneged on?
Which international laws have they broken?
When it comes to the EU the answers to those questions are none, none, none and none.
If only we could say the same for the EU and its members.
Maybe you should up your English if you want to be considered a thinker. And yes, those who voted Remain did think. Also, they were the ones that understood what leaving the EU means, and that is conclusively proven by this action by UKGov and the Brexiteer commenters here.
"Ah, so you'll be one of those rabid rejoiners who feel the need for other people to do your thinking for you."
You seem to have lost your way back to a place where ad hominem insults substitute for reasoned argument and substantiated facts.
Let me try to help... Follow the signs for Fakebook and Twatter then keep walking till you hear the prattle getting louder.
Byeee...
Listen to yourself - you're too scared of being British and having your own thoughts so want to defer to those lovely people in Brussels...
So less of an ad-hominem insult rather a straightforward observation regarding the limited viewpoints of EU apologists.
@Vic Not 20
"It's less understandable to be showing such evident signs of Stockholm syndrome more than 5 years later."
Oddly it seems the same issue with remain. There seem to be a few who accept the result and want to rejoin, generally people seem to be getting on with it but then there are the delusional who still talk as though the referendum to remain is ongoing. Even after seeing the EU in action vs us being outside of it some are so delusional as to be longing for our membership however dysfunctional the EU acts.
Guess its a matter of perspective.
....a rather long-winded way to give everyones health data away to the USA drug companies.....
I'm not too worried whether the EU likes it or not......the financial services/legal services are going down the pan anyway as everyone goes to various EU countries.....this will just help them on the road...
Not even bothered about the cookies, they get deleted every time I close a window anyway.
Let's face it....nobody with a brain is going to trust the English government with anything anymore...
The current (2007) Convention is between EU and EFTA states. The UK is now neither. Other countries can apply to join, but the EU has absolute final say:
"The 2007 Lugano Convention is an international treaty concluded between the EU and three of the EFTA States. A new State may join the Convention if its request to do so is approved by all contracting parties, but the competence to agree to the accession of a new Party lies exclusively with the EU."
Shouldn't UK gov really have thought about this and sorted it out before leaving the EU?
Given that the current UK gov appears to think that it is OK to sign treaties with their fingers crossed behind their back, then I am not surprised other parties are wary about any new UK signups to treaties.
"Shouldn't UK gov really have thought about this and sorted it out before leaving the EU?" Of course, along with everything else. But let's face it we haven't really left, have we it was just "Get Brexit Done" to foo the gullible. The likes of the ERG et al are fully aware of this but they know they can't say anything otherwise the house of cards will come crashing down.
"the EU commission has got to use every bureaucratic leave available to it, to be a right pain in the ass." In this part of the world we say "arse", we are not Septics or Septic lap dogs. Also, we are not applying to rejoin "Luango" it is the Lugano Convention.
"up until we left the EU and nothings substantively changed".So what? We left. Then we started changing things so stop lying. Pray tell, why is the UK gov. proposing changes to GDPR, as in "The UK has named a new Information Commissioner and announced a bullish approach to reforming data laws post-Brexit."
when we left the EU we became a 3rd Party, a fact Brexiteers still refuse to accept. Why? Because it proves their dishonesty and perfidy.
"Dowden said he planned to do away with endless cookie banners and only apply them when cookies pose a high risk to individuals' privacy.".
That's breaking the GDPR straightaway, no matter how many times the expression "light touch" is used.
In other breaking news, there's no "partly pregnant".
endless cookie banners
The only real problem with "cookie banners" is when (i.e. almost always) they obscure content or (at worst but commonly) prevent access to content until you've clicked on your choice.
Under the law, there's no compulsion on the potential data subject to make a choice, but the default by law in the absence of choice is essential cookies only (i.e. cookies without which the service to the user can not be delivered at all). The obtrusive cookie banner is designed to force people to choose, presumably with the hope that they'll choose to be snooped on.
Even El Reg is not entirely free of blame as its cookie banner is much larger than necessary for its content, obscures main page content, and can only be dismissed if javascript is enabled.
The ideal "cookie banner" should occupy a space otherwise not used for content, should be compact and clearly worded, and permit full unobscured access to all main content (minus all except essential cookies) even if it's ignored. It's a pity that nobody seems to have achieved this. If they had, there wouldn't be a perceived problem at all.
"Even El Reg is not entirely free of blame as its cookie banner is much larger than necessary for its content, obscures main page content, and can only be dismissed if javascript is enabled."
Plus El Reg's banner's "Customise Settings" and "Accept All Cookies" buttons are different colours, which is one of the "dark patterns" that is not supposed to be allowed.
I adore this definition (i.e. cookies without which the service to the user can not be delivered at all): it is concise and clear while perfectly capturing the essence of the matter. With it in mind I propose that cookie banners are in fact not necessary at all: everything that is essential in this sense can be done with session cookies which are not restricted by the EU cookie law (1) at all since that only requires consent for cookies *stored* on user equipment and session cookies by definition aren't. Given this, any gripes about cookie banners ought to be directed not at the EU, but at those who put the banners on websites.
(1) ePrivacy Directive (2002/58/EC), also, crucially, the Planet 49 (C-673/17) CJEU decision: GDPR definition of consent applies to cookie consent.
"With it in mind I propose that cookie banners are in fact not necessary at all: everything that is essential in this sense can be done with session cookies which are not restricted by the EU cookie law (1) at all since that only requires consent for cookies *stored* on user equipment and session cookies by definition aren't."
Firstly ePrivacy/PECR does not require cookie banners at all! Banners are the mechanism of (some) websites to inform about the cookies and to obtain the consent for them that PECR mandates.
Secondly, session cookies *are* stored (i.e. in memory), otherwise how could a session cookie by sent back to a website after it was initially presented to the browser. "Stored" does not imply some form of "permanent" storage (i.e. on disk), a cookie stored in memory is still stored, the duration of storage is not important. Therefore session cookies are treated the same as "normal" cookies with regard to PECR.
There is no point in cool I banner whatsoever.
It is just an annoyance that does not achieve anything.
Only a bureaucratic idiots would think up such idea and then you really need something as inflexible as the EU to continue sticking to this rule even after it became obvious that it does not work as expected.
This post has been deleted by its author
Is the rule that sites must have such pop-ups?
Or that they must obtain consent before gathering tracking information?
I suspect the latter: that the pop-ups are actually the creation of companies trying to cover their backs whilst tricking site visitors into giving consent to continued tracking.
"I suspect the latter: that the pop-ups are actually the creation of companies trying to cover their backs whilst tricking site visitors into giving consent to continued tracking."
I've noticed that many of the more reputable websites, on clicking the "customise" option, show essential cookies on (can't change that) and ALL other cookie options default to off. And yes, I do always scroll down and check, just in case they are not as reputable as they appear! I find it quite rare these days to come across sites that require the visitor to manually turn off cookies for each (3rd party( provider, one at a time. Even US based sites, surprisingly. I wonder if they saw a hit to their site visitor counts? Maybe their analytics showed enough people choose to not allow cookies and then giving up and leaving on being faced with 100 on/off button.
"I've noticed that many of the more reputable websites, on clicking the "customise" option, show essential cookies on (can't change that) and ALL other cookie options default to off."
The goody-two-shoes company John Lewis & Partners is one site which does not act that way. All cookies are on by default. As a result the site has gone from being almost the first place I look for items, to being the last.
This is explicitly in breach of the regulations regarding consent. If you only get to exercise the right of consent after the thing you might withhold consent for has already happened, that's an actionable breach.
Unfortunately your chance as an individual of getting the ICO to act on it is almost nil.
How many normal computer end users (ie not this readership) care about being tracked, care about cookies. How many do as I did, until someone on this site told us about "I don't care about cookies", and just click accept all the time because life is to short to read all the privacy policies, all the we have these cookies which would you like.
Any UK based website which deals with EU citizen will still need to comply with GDPR rules whether they are based in the UK or elsewhere. Look how many US based website implemented the cookie banner to comply with the GDPR rules even though they have no presence in the UK.
Cookie banners are annoying though, its become just another tick box exercise for the majority of people.
Well, ahead of Brexit, I moved all of my client data/email storage to Germany knowing that something like this would be on the cards. I'm sure I'm not alone. The government seems to forget that a large fraction of companies still deal with EU clients/suppliers and will thus continue to be required to comply with GDPR, regardless of their flag-shagging little-Britain bullsh#t.
Sam Lowe, Senior Research Fellow at the Centre for European Reform, has coined the term 'Performative Divergence' for some of the UK government's divergence proposals. They don't gain anything from such a divergence but it demonstrates that the UK can now diverge. Window dressing to convince the gullible.
The Daily Express has removed 70 articles promoting promised Brexit benefits from its website so I think some people are getting quite nervous about the empty shelves and supermarket bosses talking about a cancelled Christmas. I saw some tweets from people saying they needed to show a return ticket and their hotel booking at the Schengen border when they went on their summer hols. People might start to see the Brexit consequences so there is a need for some smoke and mirrors.
I doubt this GDPR divergence is 'performative', though. It's quite clear that the people who paid for this government are the ones who call the shots. For them any consumer or privacy protection is just a nuisance.
Rishi has cleaned the market from competition for his wife's Infosys. Now that the trade deal with India is in place, they will be shipping planes of Indian IT workers in. Just need to kick up the fuss about talent shortage a bit more. Then another gift of IR35 is that these workers won't have any employment rights (incl benefits, which is right up the Tory alley).
By the way, Google how many millions Rishi wife's stake in Infosys grew since the whole IR35 malarkey started. I wish I had more sense and bought in April 2020.
Brexit was Boris's BASE jumping - He "got it done" and jumped from the EU but forgot to be prepared by wearing a parachute.
Brexit has been done, complaining about it doesn't fix anything. BASE jumping is fun and makes you feel fantastic when you get it done and land without loosing consciousness or breaking an arm or leg - but a lot of the time it needs a hell of a lot of hard work to get it done - just jumping off the wireless mast, or cliff isn't easy a lot of times - and the pandemic just means the wind was blowing.
So nothing that's happening is odd at all.
Brexit has been done, complaining about it doesn't fix anything. BASE jumping is fun and makes you feel fantastic when you get it done and land without loosing consciousness or breaking an arm or leg - but a lot of the time it needs a hell of a lot of hard work to get it done - just jumping off the wireless mast, or cliff isn't easy a lot of times - and the pandemic just means the wind was blowing.
Pandemic masked the real impact.
This post has been deleted by its author
@AC
"Really? What Brexit advantages has Britain demonstrated during the pandemic? List them."
> Successful vaccine procurement
> Not in the EU coronavirus bailout fund
> Rising wages for the lower pay scales due to reduction of reserve labour
> Out of the EU as it cracks down on AI research
> Access to cheaper food (so farmers are saying due to the Australia deal)
Off the top of my head.
> Successful vaccine procurement
Didn't need to be out of EU for that.
> Not in the EU coronavirus bailout fund
Each member submits their own recovery plan, no?
> Rising wages for the lower pay scales due to reduction of reserve labour
Citation required. How did pandemic contribute?
> Out of the EU as it cracks down on AI research
Nothing to do with pandemic
> Access to cheaper food (so farmers are saying due to the Australia deal)
Not for long, according to The Daily Mail
@AC
"Didn't need to be out of EU for that."
We did since the EU cocked it up really bad. However since very member did the 'solidarity' thing even cancelling their own plans already made you must be one of those UK supremacists who thinks the UK is smarter and better run than all those other EU member countries. Otherwise why would we be the only ones to break from the group?
"Each member submits their own recovery plan, no?"
Each member contributes to a huge bailout. Mutualising the debt of the EU. Supposed to be a one off some idiot in the EU mentioned it could be used regularly which upset Finland.
https://www.express.co.uk/news/politics/1431544/EU-news-Finland-coronavirus-recovery-fund-vote-EU-countries-latest
"Citation required. How did pandemic contribute?"
You are gonna have to clarify that question.
"Nothing to do with pandemic"
Never said it did. Its a benefit of brexit which I was asked for.
"Not for long, according to The Daily Mail "
That seems to say that its the cost of business is going up (as the world opens up again) which is to be expected. Still doesnt refute the point of access to cheaper food.
The fact that the use of cookies is not an element of the GDPR but of the separate ePrivacy directive or his lie that the Church of England could not legally keep a record of people that wish to receive their emails suggests this is not about cookies or lists at all.
Prepare for more allowances for big businesses to sell and purchase data, fewer consumer protections (consumers don't pay The Party so their rights or opinions don't matter), fewer ways of recourse and redress and less strict requirements on disclosure. If it's good for the donors it must be good for the statute book.
I suspect the experts at the European Commission will go through these proposals with a fine tooth comb and will recommend a tear up of the adequacy decision if they see something that waters down protections in a way that conflicts with the GDPR or infringes on the rights of EU Citizens. I don't know what the notice period is for removing an adequacy status but it won't be very long. If you're a British tech business with lots of customers across the EU today is the start of Squeaky Bum Time.
The ICO themselves have form for breaking "cookie law" themselves:
https://www.itpro.co.uk/general-data-protection-regulation-gdpr/33850/ico-admits-its-own-cookie-policy-is-non-compliant-with
https://www.theregister.com/2019/11/07/ico_jobs_microsite_set_hundreds_of_cookies_without_consent/
"The fact that the use of cookies is not an element of the GDPR but of the separate ePrivacy directive"
GDPR does have a bearing on cookies as, once the GDPR came into effect on 25/05/2018, the GDPR's definition of consent, rather than UK DPA 1998's definition, then applied with regard to PECR's requirements for "consent" for cookies from then onwards.
"or his lie that the Church of England could not legally keep a record of people that wish to receive their emails suggests this is not about cookies or lists at all."
Looking at the Telegraph article then yes, CoE *does* need relevant consent to keep people's email addresses for jumble sales mailings which CoE should have collected at whichever point individuals signed up to their email list. If they didn't do so then its CoE's fault, not the fault of PECR & GDPR.
"I suspect the experts at the European Commission will go through these proposals with a fine tooth comb and will recommend a tear up of the adequacy decision
Unfortunately the adequacy decision itself tends to suggest that this is optimistic.
For example, para 49 (section 2.5.4 Transparency) states Data subjects should be informed of the main features of the processing of their personal data [emphasis added], which directly contravenes Article 5.1(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes [emphasis added].
It seems that even the EU legislators are more interested in the free flow of personal data between Member States (Recital 3) than in the protection of fundamental rights and freedoms of natural persons (also Recital 3). I suppose it's not surprising - commercial pressure bears heavily on politicians, not only via financial contributions but also due to the need for ex-politicians to find lucrative work after their terms of office are ended.
According to the FT the EU have already responded:
In response, an EU spokesperson said that Brussels was monitoring the UK’s decision “very closely”, adding that “in [a] case of justified urgency” that threatened its citizens, it would “immediately” revoke its data-sharing arrangement with the UK.
https://www.ft.com/content/f344f7ea-2829-46d2-8943-26b73c5804da
That suggests the adequacy decision could be revoked without a notice period. Perhaps the minute the Queen signs off on the new rules.
the adequacy decision could be revoked without a notice period
Indeed. And it can be revoked in a court of law (Schrems II) as well as by the Commission so it isn't simply a political decision.
It's a precarious basis for a trading relationship and as there appears to be an appetite in the UK (not amongst the citizens, but their interests are irrelevant) to emulate the US approach to privacy (i.e. void where profit available), it's chances of holding seem quite low.
Oh, you should hire Ajit Pai then! He was a master in light touch regulations for screwing citizens to ensure his masters profits!
High-risk cookies? How they're going to define them? Good luck Britons, this looks another attempt to eat the cake and have it. Meanwhile even China is enacting stronger privacy laws - at least for businesses....
A large number of UK sites that I visit have opaque or overly complicated opt outs for cookie invasion, I just close them and go elswhere.
What they need to decide is, which do they need more, to sell me their product and possibly gain repeat business or try to grab my data to make pennies from that? If the answer is my data, they make nothing because I go elsewhere.
That the Minister of State nominally responsible for Data Protection thinks that Cookies are covered by data protection law (they aren't, they fall under PECR) should be worrying but given the current crop of idiots in Whitehall its par for the course so I'm not surprised.
What is more worrying is the fact they don't seem to realise that any significant changes to UK GDPR increase the likelihood of the UK losing adequacy status and crippling any businesses that rely on any kind of personal data transfer to/from the EU.
Still as long as their donors make a few quid its all good
When he says "remove cookie banners" he means "remove data protection rights and free up NHS patient data". Easy slip to make, understandably.
And then the adequacy decision will be reversed, yet more businesses that have hosting in the UK will move it to the EU, and the bleating will start.
They are taking the piss aren't they.
They changed the law so now small IT businesses are taxed on revenue without being able to deduct legitimate business costs, while at the same time big corporations can continue to avoid paying taxes.
For SMEs this means the flexible IT workers have become 30-50% more expensive. Innovate with that.
Meanwhile they are faffing around with non-issues that companies spent good money to be compliant with and have to continue to be compliant regardless.
Elections can't come soon enough.
While I was in hospital recently, I got talking to a freelance lorry driver in the same ward, who worked through an agency, and he told me some worrying information that I later confirmed as correct.
One of these was that because of the way that they are paid, they are not eligible for even statuary sick pay, nor from sick pay from the agency (he also explained all the regular tests that they do and have to pay for to keep their licenses.)
Even me, as an IT contractor working through an umbrella, gets something that is claimed to be sick pay, not that it appears as income when I'm actually ill (the UC claims they prorata it into normal payments, and it is my responsibility to ring-fence it in my finances).
Obviously, he was champing at the bit to get back to work.
'United States, Australia, the Republic of Korea, Singapore, the Dubai International Finance Centre, and Colombia, with India, Brazil, Kenya, and Indonesia'
Doubtless all paragons of data protection. This is going to be selling out the rights of individuals in order to allow data to be exported far and wide. Still, it's an answer to those of us who wondered if Elizabeth Denham was about the least effective possible head of the ICO.
She's obviously not ineffective enough:
The Department for Digital, Culture, Media and Sport also announced on Thursday that John Edwards, New Zealand’s privacy commissioner, would succeed Elizabeth Denham as head of the Information Commissioner’s Office. It added that the role would probably be expanded “to encourage the responsible use of data to achieve economic and social goals”.
I take issue with data ownership.
I do not believe that I own the data about me. I am the subject, but ownership implies something different.
I own my house. I do not own the information about where it is, when it was built, or even that I live there.
I may expect there to be a duty of care not to disseminate some of that information, but I cannot deny people access to the data in the same way that I can prevent them coming into my house. It's just not in my control.
In many cases, the ownership of data rests with the people who collect it. For example, astronomical data is probably owned by the sponsor, astronomer or research institute who made the effort to collect it. But when it comes to personal information, it is not the laws on ownership or copyright that protect that data, but privacy legislation. That's a completely separate set of rights.
The problem with information on the Internet is that there is so much low-hanging fruit that is trivially easy for people like Google, Facebook, Microsoft et. al. to collect that others don't want to miss out, and in the past this has been using things like cookies.
I feel that there needs to be much greater awareness of exactly how much data we leak every time we use our computers and phones, not that it will make much difference now, we're too far down the road to do much about it.
Any new "touch" could hardly be lighter than the current one. Everyone, including the ICO, seems to have forgotten that the GDPR is there to protect the human rights of data subjects not their data per se. That requires two things: absolute transparency about processing and effective and affordable avenues for redress where infringements of those rights are identified. Neither has so far been manifest, at least in the UK. The ICO seems generally to have adopted a laissez faire approach to pretty much everything except:
[1] high profile cases against behemoths that are great publicity for the ICO but achieve no substantive change in behaviours;
[2] "data breaches", under an apparent assumption that a core purpose of the GDPR is IT security;
[3] breaches of PECR, which impinge on, but are a tiny percentage of, the remit of the GDPR.
Infringements of the rights of single individuals don't' appear to have a cat's chance in Hell of getting even considered, let alone acted on, despite the specific reference in several places to the fundamental rights and freedoms of the data subject and provision under the legislation for judicial remedies and compensation. However I have found these provisions to provide an apparent "get out clause" for the ICO, in that it may refuse to act, merely advising that a data subject can take the matter to court (inevitably at their own expense). How likely an action that has been rejected by the ICO is to succeed in court is an interesting but still open question.
Research we conducted over the first two years under the GDPR showed that practically no business anywhere was taking transparency seriously, and thus all were effectively denying data subjects their statutory rights under the legislation, let alone the freedom to exercise their human rights where relevant. Such issues as this are where improvements should be concentrated in order to fulfil the ostensible purpose of the legislation: the protection of data subjects' rights.
As it stands, its purpose seems to be to specify what boxes a business has to tick in order to be free to abuse its data subjects.
However I have found these provisions to provide an apparent "get out clause" for the ICO, in that it may refuse to act, merely advising that a data subject can take the matter to court
In my case I was told to just use a different service if I don't like how my data was handled by one of the big companies :-)
Quote: "....developing a world-leading data policy that will deliver a Brexit dividend for individuals and businesses across the UK...."
*
So.....which individuals? Which businesses?
*
So.....a "Brexit dividend" for Peter Thiel? ....for Palantir?
*
I think we should be told!
"So.....which individuals? Which businesses?"
Boris and his crooked cronies who will be getting their post-dated backhanders (sorry, company directorships and "consultancy" contracts) once they leave office.
It's been that way in Westminster for decades.
The Great British (glorious) public have spoken: they're fed up with clicking on cookie pop-up and SOMETHING MUST BE DONE! So, our Glorious Leadership have come up with a GREAT, GREAT plan: no pop-ups, opt-in by default. Brexit means brexit!
Dowden said he planned to do away with "endless" cookie banners and only apply them when cookies pose a high risk to individuals' privacy.
And of course he has a simple, efficient, infallible, automated method of determining when a cookie poses "a high risk"?
In fact, before we get to that, he has a simple, workable, deterministic definition of "high risk"?
The ICO have never effectively enforced Data Protection (and related) law. However based on the recent job description for the new Information Commissioner and from other public comments, such as this, made by the Government it seems things are only going to get far worse in the future.
I had a long telephone conversation yesterday with the ICO Case Officer assigned to a case I raised in January this year - it sat in their backlog until it was allocated a case officer after 4 1/2 months, that case officer went on holiday almost immediately and then moved department, so did nothing with the case. 2nd Case Officer was assigned about 2 weeks later (whilst he was already on holiday), I talked to him several days after he was back and he hadn't started on the case yet, talked to him 2 weeks later and he promised to start reading submitted docs/evidence on 1st July. The next time I heard from him was an email on 2nd Aug that he had finally read all the docs (1 month later!) and had decided that he needed advice from other ICO people to decide how to proceed. After a couple of week I left a voicemail for him asking for some sort of status update - voicemail was never responded to (no email or callback), left a callback request with main ICO number about 1 week ago but never got any, called again 3 or 4 days later and requested callback from his manager (as their SLA for callbacks is 48hrs), didn't get manager callback either within the SLA so phoned again yesterday to complain and an hour or so later finally got a callback from the Case Officer.
Basically almost 3 weeks after saying he needed to talk to colleagues for advice he has talked to some people but the end result so far is only that he has drawn up a list of ICO people he needs to get advice from, he hasn't actually talked to them yet. He also explained that, as my case is complex, he needs to write a summary document to give to these people - not sure how long that will take him. He admitted that he has made no contact to date with the organisation the case relates to.
He also pointed out that a lot of the infringement/compliance issues I highlighted occurred pre-GDPR (i.e. under UK DPA 1998) - it sounded like he was basically saying "it happened in the past under the old law so there's no much we can do about it". I did point out that the org in question still retains today personal data obtained pre-GDPR which *is* covered via GDPR today.
During the conversation he used some bullshit-bingo phrases like "regulatory appetite" which I expect most people would translate to "whenever an org clearly breaks the law ICO needs to think whether they should actually bother doing something about it".
My case is now 7 1/4 months old and, at this rate, maybe the Case Officer will finish getting internal advice and have actually made initial contact with the organisation in question before Xmas but I'm not confident of that. So I'm guessing it will probably get another *year* before the case is finished with by ICO.
Also during yesterdays call I pointed out that organisation I am complaining about is one of approx 400 similar orgs who are all processing personal data in the *same* fashion via the *same* Data Sharing Agreement which is flawed and therefore the majority of the inidividual compliance issues highlighted in my complaint equally applies to all of those 400-odd orgs. I asked the Case Officer if his investigation and/or discussions with other ICO staff would take into account these sector-wide infringements/compliance failures and, basically, his answer was "no" - they will only consider the org I complained about. So if, eventually, ICO decide to uphold my case about the org in my complaint breaking the law this would also mean that the other 400-odd orgs also likely broke the law in the same fashion but ICO won't do anything about them. It's like a lion and a herd of wilderbeast - the lion may manage to pick off and kill one or two of the herd but the vast majority of the herd are unaffected :-(
This post has been deleted by its author
Did you hear the one about the ICO Case Officer who thought Belfast was not in the UK and so ICO had no jurisdiction over a Belfast-based company and advised that the matter be referred to the Irish DPC instead?
I did, 10 days ago:
"However please note that data controllers based outside of the UK in this case Belfast, do not fall under the jurisdiction of the Information Commissioners Office and we will be unable to take any further action even if it is required. We would therefore advise you to also raise your complaint with the relevant Data Protection Commission in Ireland, the details are as follows: ..."
If a Case Officer can't get even simple things like that correct then how can they be expected to deal with complex data protection related matters correctly?
"I was told that an organisation failing to respond in any way to a subject access request was not a breach of the law ..."
I'm not sure whether failing completely to respond (i.e. not even acknowledging receipt of the SAR) is a breach, I'd have to re-read PECR again to see what it says plus have several beers afterwards to try and forget the pain of reading it :-(
However regarding the situation where the org *does* acknowledge receipt (I think even an automatic email receipt ack should/would count, but definately if a human acks) but then fail to actually respond to the SAR itself within the 1 month period, I have a case open with ICO where the company in question responded to my SAR by saying "Talk to our lawyers, here's their details. We won't respond directly to anything further" and ICO has agreed with me that in doing so the company has breached their SAR obligations and therefore GDPR (enforcement action is still in-progress).
Regarding FOI requests I read somewhere recently (might even have been on El Reg) that there is a loophole/problem with the legal situation around ICO's enforcement of FOI (i.e. badly written law) - ICO can investigate when the organisation in question has refused to provide info or where the org's response is not adequate, however they apparently *cannot* act if the org completedly ignores a FOI Request in the first place (i.e. does not even acknowledge its receipt).
Apparently a large number of both UK central gov and local gov agencies have become aware of this loophole and in the past year or two have adopted this practice for FOI Requests regarding info that is "problematic" to them.
You have to make yourself more of a nuisance than actually dealing with the case would be for the case officer. And I mean really a nuisance as them bothering senior colleagues with anything, including your legit issue, could have short term implications for their career progression.
From what I remember it was ten times worse at the height of the quangos, out of it now though thank goodness.
Cookie banners are just the usual EU Bread and Circuses, a sop to the plebs to make it seem like they're doing something useful while actually serving no useful purpose except to distract people from what their government is really up to.
UK data protection law has always been stronger than EU-mandated minimums, this is just bringing some reality to the situation.
This post has been deleted by its author
I think you'll find that 'cookie banners' (pop-ups) are actually the 'bread and circuses' of companies with surveillance-based business models. They display pop-ups to be able to claim they have consent. If they didn't snoop they wouldn't need to ask customers to give permission to snoop.
If companies stopped cookie-based snooping and provided an opt-in for those who wish to be snooped on most people would never see a pop-up.
There was talk of a browser-based mechanism similar to Do-Not-Track to allow users to do a blanket “Reject All” or (unlikely) “Accept All” and skip the cookie banners, but all the talk about “unleashing data” clearly signals the real intention is to gut the GDPR to suit the civilian surveillance-industrial complex (the UK’s completely out-of-control and unaccountable government surveillance complex is of course in complete violation of the law and in itself grounds for the EU to revoke the fiction of adequacy).
The comments here shows how many people are prepared to defend the stupidest ever rule the EU came up with, the annoying and pointless cookie banner, just because they don’t like Brexit.
If you do it, you are not driven by logic, you are driven by hatred.
You can like the EU and dislike Brexit without such stupidity, just you your brain got a change.
Can you point to the 'rule the EU came up with' that demands cookie pop-ups?
I have sites that do not try to track visitors and so do not present pop-ups to try to obtain tracking-cookie consent. I understand that this is fully compliant with EU rules, as well as being a much better experience for site visitors.
I rarely visit a site which 'needs' to save cookies, as most of my visits are for information only, which can be presented without tracking me.
I also object to the fashion for hiding so-called 'Legitimate interest' opt-outs on a second tab. I decide what interests are 'legitimate' concerning my data, not some surveillance-business / advertising site.
A couple of £million will be given to a mate of the relevant minister to develop a policy within 12 months. The policy will arrive 2 years late and £10mil over budget looking exactly the same as currently exists, except with an additional rule that the cookie consent banner must prominently feature the Union Jack (flag/whatever. Argue amongst yourselves)
This will be interesting. How do you marry the ideas of 'seizing the opportunity' in leaving the EU with not upsetting the buggers? The EU have their way of doing things and we are free to develop our own. I suspect instead we have a choice of building on our competitive advantage or appeasing the EU rules.
"I suspect instead we have a choice of building on our competitive advantage ..."
Could you explain how potentially watering down data protection rules, which protect ordinary people (and extraordinary ones such as Commentards), gives the UK a competitive advantage?
And why potentially making it more difficult for UK businesses to trade internationally (which generally involves storing some personal information) gives the UK a competitive advantage?
I'm genuinely interested to know the possible upsides.
Incidentally, the UK has long had reasonable data protection legislation (which is why GDPR did not change that much in the UK, contrary to what a bunch of shyster consultants claimed), so watering down the current data protection legislation amounts to undoing homegrown British law rather than EU law.
Have a nice weekend.
@H in The Hague
"Could you explain how potentially watering down data protection rules, which protect ordinary people (and extraordinary ones such as Commentards), gives the UK a competitive advantage?"
Take a runner. But just add thicker shoes for his own protection. Increase the height of the shoe to support the ankle more. Just add longer shorts, no make that trousers to protect against weather. And for that matter add a thicker shirt, long sleeve of course. And he is gonna need to drink so add a pack. Gotta be enough so increase the size of the container. Etc.
Regulation is about reducing what can be done. Adding regulation to everything and anything (under the principal that if its permitted its allowed instead of its permitted unless disallowed) is mounting more and more weight to achieve nothing. Just remember the piss taking about elf 'n safety. Or look at the lament of the EU not having any home grown successes like Google and Facebook.
Reducing the over-excessive rules is something the EU feared would give the UK a competitive advantage. Even they recognised it.
"And why potentially making it more difficult for UK businesses to trade internationally "
Why? This is where the EU is being left behind while the rest of the world moves on. The US still wont play by EU rules and countries take great amusement slapping the EU publicly for fun, because its not the big player it dreams of being. Trading internationally means following trade rules accepted by the other country. If the EU wants to try and dictate domestic policy (it does) then small countries may try to keep up but the rest just get on with their lives.
"I'm genuinely interested to know the possible upsides."
Might be easier to explain in normal trade. The product you send to the importer must meet the importers regulations. That does not mean the importer dictates our domestic policy only what is exported to them. If they try then is it worth the effort. For financial regulations (passporting) the UK decided it isnt worth the cost (economic damage) to the global financial centre of Europe to bow to the EU, and instead will remove a bunch of regulations dictated by the EU. If the EU wish to cut themselves off from London they can have a recession in the EZ, their choice.
"Incidentally, the UK has long had reasonable data protection legislation"
Yes. Great isnt it. So lets see what gets proposed.
"so watering down the current data protection legislation amounts to undoing homegrown British law rather than EU law."
Maybe, maybe not, lets see. And lets see if it improves or not the current situation (I have no idea).
"Have a nice weekend."
You too. Hopefully a bright and sunny one.
The UK is an ant in a forest of Sequoias and the only ones profiting from this change are the big American tech-giants. They will, however, just say "Thank you!" and go on with business as usual, with the UK not getting anything in return.
The EU, however, with its 500 million affluent consumers IS in a position to demand changes in policy from both the US and China.
@StrangerHereMyself
"The UK is an ant in a forest of Sequoias"
Which benefits from trade and holds the second largest financial sector in the world. The largest in Europe.
"the only ones profiting from this change are the big American tech-giants"
Something the EU wishes it had any of yet are a US success.
"They will, however, just say "Thank you!" and go on with business as usual, with the UK not getting anything in return."
If we dont get anything from using the services then why do we? Fact is we do benefit but have become so accustomed to them just being there.
"The EU, however, with its 500 million affluent consumers IS in a position to demand changes in policy from both the US and China."
I am sure that invokes a lot of laughter but thats about it. Russia and Turkey recently having their own laughs at the impotent leadership of the EU. The US paying lip service (increased a little with Biden) but shown vulnerable under Trump. China is too important to the EU to pick on them and basically the EU is either parroting the US or ignored.
You say 500 million affluent consumers but is that figure even right?
www.telegraph.co.uk/world-news/2021/09/09/michel-barnier-demands-return-frances-sovereignty-european-courts/
Brexit negotiator Barnier shows the two faces of representing the EU and representing his country as he demands a return of sovereignty from the EU to France. I am sure twits can now cry here that there is no loss of sovereignty so what is he talking about, but for the rest its another hole in the remain lies exposed by its own.
“This is ironic in the extreme. Barnier preaching the merits of national sovereignty to curb the over-powerful EU and European Court of Human Rights,” tweeted Simon Clarke, the Tory MP for Middlesbrough South and East Cleveland.
But for all his squealing I doubt he will be much of a challenge for Marine Le Pen. Last time they voted for Macron who was to reform the EU. Plenty to laugh at.
Yes. It does indeed make the UK's Brexit elite look like a bunch of liars and/or useful(useless?) idiots: pushing, or sadly believing, that national "sovereignty" was ever an issue. Thanks for posting and exposing this.
Hopefully there will soon be a national day of apology. Where the hardcore Brexit elite will go forth into their gardens simultaneously of an evening, kneel, bow their heads and humbly ask to be forgiven for their lies and deceit.
@AC
"Yes. It does indeed make the UK's Brexit elite look like a bunch of liars and/or useful(useless?) idiots"
Erm seems like your reading/comprehension skills failed you there coward. It is the EU negotiator who has been exposed as lying and remainers as useful idiots falling for the serious deception.
So lets see if you stand by the rest of your post when you read and understand its the reverse of what you said (or get someone to explain it to you).
"Erm seems like your reading/comprehension skills failed you there coward. "
Oh. You're(sic) actually a brexit useful/less idiot yourself. And not just pointing out yet more EU/Brexit inaccuracy in the paywalled newspaper that Boris Johnson was fired from for lying. Sorry you've(sic) fallen for all of these. Get well soon.
@AC
"And not just pointing out yet more EU/Brexit inaccuracy in the paywalled newspaper"
I am guessing since your previous comment was entirely inaccurate about the article and now this, that you cant actually read the article. Probably best you dont comment on it if you have no idea what was written.
Basically the article is about Barnier demanding back sovereignty to France from the EU and ECHR. I even quoted it so you surely should have read it if responding to me?
This post has been deleted by its author
I can also read what Barnier++ said in the original French. Not through the filters of a Conservative MP & a UK right-wing newspaper. (Plus what appears to be a Brexit obsessed, deranged Register Commenter.)
(Your ' key is still broken.)
++ For the record, I'm not a supporter and will not be voting for him.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
