The government is trying to erode our data rights and protections. We must resist.
Image taken from BlackIllustrations.com with added text
In Autumn 2021, the Department for Digital, Culture, Media and Sports (DCMS) launched a consultation titled, Data: A New Direction. The consultation was dense, at 146 pages, but light on facts. It proposed reforms to weaken our current data protection law (GDPR). The government framed its proposals as necessary to “create an ambitious, pro-growth and innovation-friendly data protection regime that underpins the trustworthy use of data”. We believe that, as is often the case, those who are already marginalised will suffer disproportionately from the loss of these rights and protections.
In this blog post we explain why we are alarmed at these proposals. We also highlight how this consultation is part of a wider campaign, by this government, to significantly limit our existing rights and protections under law, as well as our capacity to object to discriminatory and unfair treatment. Finally, we share our thoughts on the need for our community, and others like it, to organise and fight against the erosion of our rights.
Why are we so alarmed by the changes?
Data protection law needs to be updated to keep up with technology; but not in the ways the consultation proposes.
Changes in technology can allow organisations to exploit legal loopholes in ways that can disadvantage or harm people. Data protection laws protect us from intrusive and inappropriate uses of our data and enable us to hold organisations to account if they are caught contravening accepted standards of use. That’s why it’s important that rules around how data about us is collected and used are updated so that new technologies align with societal values and expectations. However, several of the proposed reforms not only reduce organisations’ responsibility to respond to people’s queries about uses of their data, they also reduce the operational scope and independence of regulatory and enforcement agencies. As if that wasn’t bad enough, they remove restrictions on the ways organisations choose to reuse data about you. At present if such reuse falls outside the original scope of use, they have to ask your permission. However, under the proposed changes, they may not have to. Further, these reforms would give more powers to state bodies e.g the police to demand data about you from private sector firms without your consent. This will usher in even more state surveillance than we have now.
Let’s explore some real life implications of these proposed changes. The use of facial recognition technology is highly controversial and has prompted a lot of concerns, especially around its accuracy and intrusiveness. Despite this, North Ayrshire council in Scotland, procured a facial recognition technology system for use in school canteens. The justification was that this made the schools more ‘Covid secure’. Some parents were alarmed by the collection of their children’s biometrics for something as trivial as checking eligibility for school dinners. Their concerns were dismissed and ignored by the council. The parents were able to turn to both the Biometrics Commissioner and the Information Commissioner’s Office (ICO). It was only when these bodies with regulatory and enforcement powers stepped in and civil society organisations like DefendDigitalMe brought the case to the attention of the media, that the council backed down and the schools paused the rollout. The ICO is by no means a perfect regulator. However, if the Biometrics Commissioner role is folded into the ICO and the latter’s scope of operation is narrowed as is being proposed, who would these parents have appealed to?
Similarly, without the rights afforded under the current GDPR-aligned data protections regime, the Uber drivers who challenged Uber’s pay structures wouldn’t have been able to gather the data they needed to build their case. The resulting Supreme Court ruling has made it possible for gig workers (who are disproportionately Black and Brown) all over the UK to push for better conditions. Data rights impact so many aspects of life.
The Brexit excuse– the lie that gutting our data protection rights will spur innovation
In understanding how we got here, it’s impossible not to mention the Brexit project. Many Brexit supporting MPs have viewed Brexit as a “one off chance for the UK to escape EU ‘red tape’”. Last year a government taskforce on innovation, growth and regulations (TIGRR) proposed GDPR should be scrapped and replaced with a ‘UK Framework of Citizen Data Rights’. The framework is worryingly light on detail but the taskforce insisted it would give people more control over their data and support growth and innovation. Well, if you believe that, we have some art doodles that we’ve converted to NFTs to sell you! The erosion of our data protections is not a prerequisite for innovation. Does the requirement to have seatbelts prevent car makers from innovating? Unless, of course by ‘innovation’ we mean reckless, irresponsible experimentation without accountability. We only have to look at the behaviour of tech companies in low income countries with limited data protections to see what that looks like.
Our experience of responding to the consultation
Rather than the government exploring the negative externalities of its proposals and presenting mitigation steps, its consultation placed the burden on respondents (mostly from civil society). The DTBC team spent many late evenings after work poring over the 300+ questions in the consultation, collating relevant stories, doing research* and writing our submission. We did this despite the sinking feeling that the government will ignore well-evidenced arguments against their proposals as they have done with various controversial bills. However, we also recognise that failing to formally state our objections gives the government room to imply broad support for their reforms.
At present we are tracking and monitoring a number of consultations on proposals to scale back existing rights and protections which also have a data and technology component to them. For example, the Human Rights Reform proposal which is a clear attack on human rights and the amendment to the Official Secrets Act which makes it easier to silence journalists. While the Police, Crime, Sentencing and Courts bill, Nationality and Borders bill and the Online Safety bill pass through houses of parliament, we will be highlighting how data-centric technologies could be used to enforce them and, where we can, opposing these bills.
This work takes time and it can’t be done well by a tiny team of three people; for example, we couldn’t answer all the questions we wanted to in the DCMS consultation. We need the wider DTBC community to get involved too.
What happens next and how we hope members of DTBC should get involved
The relentless pace of consultation releases sometimes feels like a war of attrition being waged on civil society. It’s exhausting but those amongst us with the capacity must continue to resist and protest. As Black Protest Legal Support UK have explained, if the government manages to get its way, many Black people and others from marginalised communities in the UK will find it that much harder to survive and thrive.
If you have been moved by anything we have written in this blog post, do please get in touch data-tech-black-communities[at]protonmail.com
Note *The intimidating breadth of this consultation led various civil society organisations including: Open Rights Group, Open Data Manchester, The Legal Education Foundation to create explainers and host discussion events to support wider civil society to get to grips with the government’s claims. We benefited from their hard work and if you’d like to get a deeper understanding of the proposed changes, these explainers are a good place to start.
