Government’s Proposed Data Reforms Would Hinder the Honest and Empower the Dishonest

Government’s Proposed Data ReformsWould Hinder the Honest & Empower the Dishonest

Phil Booth unpicks the Government’s planned post-Brexit data reforms

If rules are to inspire trust, they must be the same for everyone. Nothing seems more unfair than one rule for you and another for someone else.

The current Government appears to prefer arbitrary power – rules and regulations that can be used to impose the agenda of Boris Johnson and his ministers on a whim. Like much of the Government’s agenda, its proposed data reforms are focused on creating special rules for the favoured or monied few, while overriding the very rules that protect the rest of us.

Data protection is personal – it is all about our personal data. So when the Government says that it wants to change the way this data is handled, these changes are not abstract. When companies do things with our data, they do so for profit.

Since they were first introduced, the UK’s laws on data protection have maintained a level playing field – each user of data is treated like every other, with clearly understood rules and protections that have always been as much about what someone does, as what they say they do.

The Government wants to change this and the impact will be profound. The “new direction” on which the Government is now consulting will make it harder for people to understand what is being done with their data, easier for companies and the authorities to misuse it – and more likely that things will go wrong. 

Even if what someone is doing or buying doesn’t seem to be a ‘data service’, the Government’s proposed reforms will still affect them – by changing the rules governing how every service can recycle data about people.

When the latest Data Protection Act came into force in 2018, every organisation had to adopt the same rules at the same time. There may have been a few exceptions and the odd grey area that needed working out but, in general, for those trying to do the right thing, understanding and complying with the 2018 Act was relatively straightforward.

Fiddling with people’s rights is not only an assault on individual protections, it undermines the very knowledge economy the Government claims to be promoting. It incentivises parasites and predators, and plunges us all into uncertainty.

Instead of one clear set of rules for everyone to abide by, the Government’s new consultation proposes abolishing the principle of general data protection – creating different sets of rules in different areas.

Moving away from the ‘one size fits all’ approach means creating one set of rules for industrial development – rebranded as “scientific research” – another for health, another for artificial intelligence (AI), and so on. The intent is to erect multiple differing data protection regimes that will privilege chosen data users, erode safeguards and eliminate consistency.

For instance, if a company claims to be working in AI, it will be able to evade some of the current protections – thereby filling the AI and innovation ecosystems with even more fraudsters.

These proposed reforms would mean that companies undertaking commercial research and development will potentially be allowed to follow custom data rules around NHS patients’ data, in much the same way the Home Office does on migrants’ data.

---

Mind the Transparency Gap

Those who write their own rules end up doing whatever they want. As a consequence, the types of arbitrary decision-making proposed in the consultation is likely to spread to anything that claims to ‘use AI’ – and people could find the very same secrecy and deception that the Home Office deploys against the most vulnerable being deployed against them.

The confusion introduced by these muddled reforms will also turbo-charge the denial of legitimate access to information, under the familiar excuse, ‘because of data protection’.

When everyone is operating under the same laws, there is at least a chance a person’s MP will be able to make a strong case on their behalf. When different industries follow different rules, there can be no easily-shared understanding and MPs will receive even less information from public bodies when trying to help their vulnerable constituents.

Meanwhile, the Government’s cronies will be able to profit from the dark corners. And abolishing oversight and legal impact assessments means that harms can (and will) be committed without even notionally having to care about victims.

Different parts of government will be allowed to respond to this consultation. Yet, currently, there is a deficit of detail on how the law will be changed to empower the Government, and proposed “clarifications” of the letter of the law. The Government’s own impact assessment is a fifth of the length of the consultation, and doesn’t once mention equality, suggesting a fundamental clarity deficit.

As departments submit their responses to this consultation in private, they will be able to decide on their data protection rules without anyone else being allowed to respond.

And, even while these consultations grind through Westminster, departments are carrying on regardless. The Department for Work and Pensions is already working on creating its own copy of your medical records; recording what its officials think a person’s medical condition is, rather than what their doctors say it is.

The NHS is still subject to raiding parties across Whitehall and industry that think they could profit from people’s data – as evidenced by the deeply inappropriate data disclosure powers in the Police, Crime, Sentencing and Courts Bill that, if enacted, would be toxic to trust. 

---

Ethics and Profits

The Government cannot claim that ‘unintended consequences’ have followed, when we have already seen examples of how its proposals are likely to play out.

Under the reforms for data processors, those providing otherwise legitimate services to the NHS may be empowered to siphon data – and, as things stand, pretty much every NHS contract would need to be rewritten to prevent it from happening.

Similarly, a company providing text messaging for the Department for Work and Pensions could know who has been sanctioned and who is on benefits, and – unless it was specifically and contractually prevented from doing so – could make money embedding that information in credit scores.

Companies will of course lobby for their shareholders’ profits and for weak regulations, while limiting information to truth-tellers. Indeed, there is a never-ending stream of AI companies looking to exploit the data gold mine. 

Similarly, the Government’s so-called “democratic engagement” proposal is nothing less than Cambridge Analytica legalised. The Government has clearly learned that one of the best ways to close down legal challenges against official misuse is simply to make every use legal.

Given the hugely complex, overlapping nature of these proposals, the inherent contradictions in some of them – and the entirely predictable negative outcomes – the Government will likely require several more rounds of consultation. At the very least, it is going to need to draft a bill in such a way that ministers are able to not just deny but refute the intended consequences highlighted above.

Worthwhile data reforms should make life easier for honest people and harder for those who are dishonest. The Government’s proposals appear to be designed to do the opposite.