Sifting Out Data Protection Rights?
“The post-Brexit re-defining of ‘fundamental rights and freedoms’ in the UK GDPR & Data Protection Act 2018 by reference to the European Convention on Human Rights - to the exclusion of the Charter of Fundamental Rights of the European Union - in the draft statutory instrument ‘The Data Protection (Fundamental Rights and Freedoms) (Amendment) Regulations 2023’ is unlikely to have a significant adverse impact on the obligations of data controllers and the rights of data subjects. However, the narrower focus of the Article 8 right to private and family life could mean that, in certain cases where the nature of the data and processing does not engage Article 8, the balance would be tipped in favour of data controllers when determining what is necessary, fair and proportionate. The amendment could also impact the proportionality of enforcement action by the Information Commissioner. The change is likely to have a particular impact on those controllers processing personal data in the context of exercising their own Convention rights, such as media organisations.”
On 11 September 2023, the Department for Science, Innovation & Technology (DSIT) issued a draft statutory instrument pursuant to the powers granted under the Retained EU Law (Revocation and Reform) Act 2023, The Data Protection (Fundamental Rights and Freedoms) (Amendment) Regulations 2023.
The Explanatory Memorandum to the draft SI states that it “amends the definition of “fundamental rights and freedoms” to refer to an alternative source of fundamental rights and freedoms, namely those under the European Convention on Human Rights (ECHR), which have been enshrined in the UK’s domestic law under the Human Rights Act 1998” to address the implications of s.2 Retained EU Law (Revocation and Reform) Act 2023, which will repeal s.4 European Union (Withdrawal) Act 2018 and have the effect of nullifying any retained EU law which will no longer be enforced, allowed or followed at the end of 2023.
Article 4(28) UK GDPR currently provides that “references to a fundamental right or fundamental freedom (however expressed) are to a fundamental right or fundamental freedom which continues to form part of domestic law on and after IP completion day by virtue of section 4 of the European Union (Withdrawal) Act 2018, as the right or freedom is amended or otherwise modified by domestic law from time to time on or after IP completion day”. Essentially the same definition was inserted at s.205(1A) Data Protection Act 2018.
The draft SI would instead define references to fundamental rights or fundamental freedoms in the UK GDPR and Data Protection Act 2018 as being “to the Convention rights within the meaning of the Human Rights Act 1998”.
The Explanatory Memorandum further states that the “impact on organisations and individuals as a result of these changes is expected to be minimal because these changes seek to replicate the current position as far as possible, while providing clarity on the rights that need to be considered in a domestic law context” and references the fact that “the protection of personal data falls within the right to respect for private and family life under Article 8 of the European Convention of Human Rights, which is enshrined in UK law by the Human Rights Act 1998”.
However, the scope of protection afforded to data protection rights under the right to respect for private and family life at Article 8 European Convention on Human Rights, is not as expansive as that under Article 8 European Charter of Fundamental Rights.
The Grand Chamber of the European Court of Human Rights determined in (1) Satakunnan Markkinapörssi Oy and (2) Satamedia Oy v Finland (Application no. 931/13), 27 June 2017 at para.137, that “Article 8 of the Convention thus provides for the right to a form of informational self-determination, allowing individuals to rely on their right to privacy as regards data which, albeit neutral, are collected, processed and disseminated collectively and in such a form or manner that their Article 8 rights may be engaged”.
The Information Commissioner recognised that this was the case in his submission to the Ministry of Justice consultation on Human Rights Act Reform in which he stated “Privacy does not necessarily engage all examples of information related to individuals in the way that data protection does; and data protection does not have to engage in the ‘private’ or ‘personal’ sphere, it also includes the public sphere”. Consequently, and in anticipation of the repeal of s.4 European Union (Withdrawal) Act 2018, the Information Commissioner had recommended that “the government explores to what extent there is scope in a British Bill of Rights to explicitly refer to data protection under the right to privacy”. The government has not, at least as yet, indicated that it intends to pursue that recommendation.
The implications of the proposed amendments are that it could be argued that where personal data is public or otherwise anodyne in nature, and the data processing activities being undertaken do not impinge on private and family life, the rights of data subjects and obligations on data controllers are correspondingly weakened where Article 8 European Convention on Human Rights does not apply, enabling data controllers to more easily establish that they meet the requirements of necessity, fairness and/or proportionality. The proportionality of enforcement action by the Information Commissioner and/or the courts could also be affected, favouring data controllers when the balancing exercise is carried out.
This principle would apply even more strongly where the data controller was itself conducting its data processing activities in the exercise of a Convention right, such as a media organisation processing personal data for the special purposes of journalism, art or literature in reliance on the right to freedom of expression and information under Article 10 European Convention on Human Rights.
The Regulations are subject to the negative procedure under Schedule 5, Part 2, para.6, Retained EU Law (Revocation and Reform) Act 2023, and have therefore been laid before each House of Parliament for 10 sitting days within which time the Sifting Committees can make a non-binding recommendation that the statutory instrument be subject to the affirmative procedure or, if no recommendation is made within the sifting period, the relevant Minister is entitled to make the SI.
Find out more about our data protection and data privacy services.