UK gains 'adequacy' status on data sharing with EU, but making that stick all depends on how much post-Brexit law diverges The European Union has formally voted for proposals to give the UK "adequate" status in its data protection laws, allowing data sharing to continue in the post-Brexit world. But the move could prove temporary if the UK were to move too far from the principles of the General Data Protection Regulation (GDPR) in its ambition to …
> they also mean that existing data cannot be reused for novel purposes
They really are mistaking a feature for a bug.... If data can arbitrarily be re-used for any old purpose without getting further consent, then it's not really protected is it?
Good news on the adequacy, but I'm sure we'll find some way to screw it up (followed by politicians blaming the EU for being overly purist about the law or something)
The Germans have good historical reason for being nervous about data being "re-used for novel purposes" - when the Nazis ransacked Magnus Hirschfeld's Institute for Sex Research, besides burning the books they made off with lists of addresses of gay men etc. That data was repurposed to hideous effect.
It couldn't happen here? Post-Brexit, nothing would surprise me.
a Brexit goon-squad of Tory MPs
Ah, nothing like a bit of unbiased reporting, is there?
Leaving aside the political cracks, "These restrictions limit AI because they prevent AI organisations from collecting new data before they understand its potential value and they also mean that existing data cannot be reused for novel purposes" is actually an interesting point. Much of scientific discovery has come from serendipity, those "I didn't expect that, I wonder why it happened" moments, and it would be unfortunate if this was prevented.
Instead of prescribing, in advance, the data as collected for specified, explicit and legitimate purposes, effectively trying to second-guess how it will be used, perhaps it would be better to define the things it MUST NOT be used for, and leave any grey issues to be decided by courts if necessary? It's that old difference between "everything not explicitly allowed is forbidden" and "anything not explicitly forbidden is allowed", which has always been a difference between European countries.
the ruling on the UK being an adequate jurisdiction to share data with would be reviewed on an ongoing basis as UK legislation diverges from EU law.
Which is exactly how it should be (and applies vice-versa if EU law diverges as well, of course).
None of the data that contributed to any serendipitous scientific discovery is personal data. And there are no restrictions on collecting non-personal data.
It isn't about whether the usage is "forbidden" it is about whether the collector has permission from the data subject. To put it in simple terms that even a Conservative politician can understand: I own data about me personally, and hence I can choose to whom I sell it, for what purposes, and for what price. Any attempt to retain or use personal data without permission of the subject is plain theft.
"Any attempt to retain or use personal data without permission of the subject is plain theft."
You were doing well up to here but however often theft is used in this context it isn't theft in legal terms because you haven't been deprived of it. Maybe a breach of copyright would be closer. We do need a legally defined simple term to use in this context, however.
None of the data that contributed to any serendipitous scientific discovery is personal data. And there are no restrictions on collecting non-personal data.
Graham Cobb,
That's definitely not true as regards medical discoveries. All sorts of not-terribly-nice things have been done in the name of "well that might later be useful for some research" - including retaining bits of body tissue, and in some cases whole organs, without telling the families. And that stuff, as well as medical data has definitely been used for valid medical research later.
Silicon Valley seems to have fallen into the bizarre rabbit hole of trying to hire the greatest minds of a generation in order to target adverts ever so slightly less badly - and it feels like restricting their access to data will have no bad consequences at all. There should be a slightly more nuanced discussion on medical data. While we need good protections in place for people - I think we'd also like to advance medical science - and so might want to consider different compromises (as well as different and better protection) in the medical sphere.
Do you remember the Japanese solder found on a Pacific island still fighting the Second World War? That's you, that is.
If he is that soldier - it's not like he's the only one. There's an awful lot of people on both sides still trying to fight the Brexit battle - and I suspect politics would be a lot healthier if most of them would stop. Or at least calm down.
Then again, there's always the latest fun-and-games over infinitely tiny definitions of racism and micro-aggressions for people to obsess about, so maybe life is still a tiny bit better if they're all still banging on about bloody Brexit instead...
These restrictions limit AI because they prevent AI organisations from collecting new data before they understand its potential value and they also mean that existing data cannot be reused for novel purposes
This statement is absolutely false. 99.999% (or more) of data absolutely can be collected by AI organisations as they wish and can be reused for novel purposes. The only data that cannot be collected is personal data.
History of temperature changes in Nazeby by the minute can be collected with no restrictions and almost certainly has great value to some future AI. The AI developers just need to get smart about using the data they can collect and stay away from personal data. AI is not just about people.
I doubt it's a matter of getting smart, more a matter of not being greedy because a slurp of personal data will be much more valuable in their eyes then temperature records of Nazeby. What's needed is sufficient enforcement of the DPA to make such data a liability instead of an asset and that's just the opposite of what IDS & co want.
This decision is officially being made on the basis of compatibility of the legislation, so it's not totally surprising as the UK law actually pretty much replicates the GDPR, with the exception of a couple of egregious and highly questionable departures that have, it appears, been conveniently overlooked.
However, in reality, as our research has clearly established, practically nobody is actually complying with the legislation anyway, even on its most basics. So the whole exercise would seem to be pure political manoeuvring.
The purpose of the GDPR and its spin-offs was intended to be protection of data subject rights. That appears to have been entirely forgotten by all concerned.
Well, it doesn't mean this decision will survive first contact with the enemy. After all the Commission have negotiated two separate deals with the US government, that have been shot down by the ECJ.
One of the problems, for example, is that the GDPR grants exceptions for governments to do policing and intelligence gathering. However these are only allowed for EU members, so the law is actually tougher on foreign governments over domestic, which could mean the European courts kill this decision off as well. Even before the UK Parliament decides to change anything.
Well yeah, restrictions are generally created to prevent stuff, and if that is an amazing revelation to you, well let's just say that these companies probably already have you classified in the category "complete idiot".
It's like complaining that the restrictions on entering your house prevent criminal organisations from collecting new loot. Our information should not just be theirs to take, no matter how easily dazzled idiot lawmakers are by the magic two letters A & I.
Gazing into my crystal ball, I don't think this will last. For the following reasons:
We might change the law - although I suspect that will take a while.
The Euroepeans might change their laws - meaning they have to look again at all their external data relationships. This probably even longer.
The courts in Europe might reject it, as they've done with the last two agreements with the US. I'm guessing at reasonably likely.
The EU might choose to use it as leverage over some other disagreement. Also quite likely.
There's already precedent. Despite UK financial regulations not having changed since leaving the EU - the Commission are refusing to grant equivalence (the "equivalent" to "adequacy") - even though they have for the US with a very different system. In this case on the supposed argument that the UK might change things - accepting that they currently comply. And forgetting that equivalence can be revoked at one month's notice. The Commission have also been slowly removing equivalence in some areas from Switzerland, as part of bringing pressure on the Swiss to sign a new deal that replaces a bunch of their exisiting agreements that the EU no longer likes.
My strong suspicion is that if the two sides can't sort themselves out over implementing the Northern Ireland protocol - something they were supposed to have started talks on in January 2020 to have ready for leaving the transition period in 2021, but only really started in October of last year - then removing adequacy will be one of the levers the Commission will look to. There are provisions in the TCA that allow cross-retaliation, but you have to prove to independent arbitration that they're proportional. Stopping the supermarkets from shipping sausages to the Northern Irish branches is going to be pretty hard to prove as a risk to the integrity of the single market, and so proportionate retalliation might only be a 1p tarriff on battleship cosies. Whereas data adequacy and financial equivalence are purely in the EU's gift, so are prime areas for pressure. But they don't seem willing to offer the financial equivalence, in order to have it to take away, so it becomes useless as a lever. Hence granting data adequacy with minimum fuss perhaps?
Briefly... We all have a personal data space with our stuff in it. We grant time limted permissions to thrid parties to access bits of that data. Everytime they access a bit (no pun) they pay.
When the time limit expires, they have to reapply.
We control our stuff
No need for data controllers because the data is always ours
Personal blockchains for accounting purposes.
Etc
Despite some rumours to the contrary, no change is expected to the cookie opt-in popups that you get on every new web page in EU/UK.
https://www.privsecglobal.com/blog/cookie-consent-after-brexit-what-can-we-expect-in-2021
So it would be nice if browsers started to have a policy manager that can silently apply the consent to each new site for you, depending on your preferences.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
