[ORG PM] ORG policy update 29 September 2017

Fri Sep 29 13:51:02 BST 2017

https://wiki.openrightsgroup.org/wiki/ORG_policy_update/2017-w39

  ORG policy update/2017-w39

This is ORG's Policy Update for the week beginning 25/09/2017.
If you are reading this online, you can also subscribe to the email
version or unsubscribe
<https://lists.openrightsgroup.org/listinfo/parliamentary.monitor>.

      ORG’s work

  * ORG Scotland submitted a response to the consultation lead by the
    Independent Advisory Group on Biometrics. Read the full response on
    why Scotland needs a biometrics commissioner here
    <https://scotland.openrightsgroup.org/policy/2017/09/29/regulating-the-use-of-biometrics-across-scotland/>.
  * Save the date for ORGCon 2017 - it will take place on Saturday 4
    November at Friends House on Euston Road in London. We have a second
    smaller event planned on Sunday 5 November in a different location
    (TBC). This year is all about the Digital Fightback. Confirmed
    speakers include Graham Linehan, Noel Sharkey, Helen Lewis, Jamie
    Bartlett and Nanjira Sambuli. Tickets are on sale now
    <https://orgcon.openrightsgroup.org/>!

Planned local group events:

  * Join ORG Glasgow
    <https://www.meetup.com/ORG-Glasgow/events/243106505/> for a free
    screening of The Internet’s Own Boy on 2 October. The Internet’s Own
    Boy tells the life story of programmer, writer, political and
    internet activist Aaron Swartz, an internet pioneer and free speech
    campaigner. Following the screening, Scotland Director Matthew Rice
    will be available for a discussion and will give information about
    how to get involved in initiatives in Glasgow and Scotland.
  * ORG Cambridge
    <https://www.meetup.com/ORG-Cambridge/events/243160003/> would like
    to invite you to join them on 3 October for their monthly meetup to
    discuss the current state of digital rights, what we've done in the
    past month, and what we are planning to do in the upcoming months.
  * Join ORG Edinburgh
    <https://www.meetup.com/ORG-Edinburgh/events/243523585/> and the
    Open Government Network for an event on 5 October on the history of
    identity debates in Scotland and the UK. Our speakers will talk
    about the current situation and status of government proposals, and
    will discuss people's concerns before meeting with the Government.
  * ORG London <https://www.meetup.com/ORG-London/events/243072098/> is
    organising an informal pub gathering on 10 October with Myles
    Jackman to discuss the current state of digital rights legislation
    in the UK, including the progress of the Digital Economy Act.

      Official meetings

  * Javier Ruiz attended a discussion with Liam Byrne organised by Demos
    and the Guardian.
  * Jim Killock attended a meeting with Julie Grant, Australian eSafety
    Commissioner, regarding the online safety agenda and the problems
    encountered in the UK.

      UK Parliament

Both Houses of Parliament are on recess and will be back after party
conferences on 10 October.

        Second Reading of the DPBill will be on 10 October

The Data Protection Bill is due to be debated in the Second Reading in
the House of Lords on 10 October.

ORG has been concerned about the draft Bill not containing provisions
allowing independent privacy organisations to raise complaints without
naming data subjects. Article 80(2) of the EU’s General Data Protection
Regulation is a derogation (option) that would allow it but the UK
decided not to include it in the Bill. Such a provision would help
investigate harmful data processing practices.

The Bill will allow people to lodge a complaint themselves or designate
a qualifying organisation to file a complaint on their behalf. However
affected data subjects are not always willing to come forward as they
might not wish to be publicly associated with certain companies. This is
where independent privacy organisations would come in to uphold people’s
right to privacy. The current data protection landscape could
accommodate independent privacy groups that would be able to tackle this
gap in consumer protection.

For a more detailed analysis of the draft DPBill read this blog post by
Amberhawk <http://amberhawk.typepad.com/amberhawk/>.

      Other national developments

        TfL is consulting on permanently collecting customers’ data on
        the underground

Transport for London (TfL) intends to make £322 million by collecting
and possibly selling commuters’ location data. TfL ran a data collection
trial at the end of 2016
<https://tfl.gov.uk/info-for/media/news-articles/save-the-data-for-transport-trial>.
During the trial, they tracked wifi signals from people’s devices who
moved around the London Underground. (Read our blog from November 2016
<https://www.openrightsgroup.org/blog/2016/tfl-needs-to-give-passengers-the-full-picture-on-wifi-collection-scheme>when
the trial ran.)

At the time, TfL had said the collected data from 5.6 million users
would be used to improve customer experience. They claimed the data is
anonymised, however, during the trial, the data was merely pseudonymised
meaning that data could eventually be identifiable.

TfL is currently in consultation about running data tracking on a
permanent basis.

Sky received a response to a Freedom of Information request
<http://news.sky.com/story/tfl-may-make-322m-by-selling-on-data-from-passengers-mobiles-via-tube-wifi-11056118> which
revealed that TfL also anticipates a significant financial benefit to be
one of the results of the scheme. The document obtained by Sky said that
the scheme will enable

    ”TfL to achieve £322m revenue generation over the next eight years
    by being able to quantify asset value based on the number of
    eyeballs/impressions and dynamically trade advertising space."

This goal is not reflected in the messaging to the public which
concentrates only on improvements to the customer experience. This
discrepancy between the TfL’s goal and the public message could be
considered misleading. TfL’s customers are limited to opting out of the
scheme only by disabling their wifi whilst using the London Underground.
For this reason, it is essential people are fully aware of the extent
and use of the collected data.

      Scotland

        Police Scotland placed 400,000 people on the Vulnerable Persons
        Database

An investigation conducted by the BBC
<http://www.bbc.co.uk/news/uk-scotland-41335762> revealed that more than
400,000 have been placed onto the Vulnerable Persons Database in
Scotland. Officers who attend incidents and crimes can add people to the
database if they consider them to be at risk of future harm.

The database was created to collate different pieces of information
about a particularly vulnerable individual into a single file. This
would allow officers to get a more complex image of a person. The file
can be shared with other government bodies at a supervisor’s discretion.

The Information Commissioner found the database in breach of the Data
Protection Act 1998
<https://wiki.openrightsgroup.org/wiki/Data_Protection_Act_1998> due to
the lack of rules for removing information from the database.
Additionally, people were not notified they are on the system.

Police Scotland is currently in a conversation with the Information
Commissioner to rectify the breach of the DPA. Their conduct diminished
people’s right to privacy. To make the database fit for purpose Police
Scotland should notify the people on the database and give them means to
request removal from it.

      Europe

        European Commission wants to privatise online censorship

The European Commission
<https://wiki.openrightsgroup.org/wiki/European_Commission> published
the Tackling Illegal Content Online communication
<https://ec.europa.eu/transparency/regdoc/rep/1/2017/EN/COM-2017-555-F1-EN-MAIN-PART-1.PDF> this
week. The document puts a lot of focus on Internet companies to remove
illegal content online that they could consider illegal.

The communication contradicts the Commission’s proposed Copyright
Directive in the way Internet service providers are perceived. The
Copyright Directive considers hosting services that carry content in any
way “active” - they are presumed to be aware of illegal activities. The
communication does not consider ISPs to be in a position where they
would have knowledge of illegal content.

The Commission’s communication puts the importance on speed and
proportion of removals. It appears that the question of whether the
content is actually illegal is secondary. The Commission intends to help
the removal of illegal content by incorporating “trusted flaggers” in
takedowns. “Trusted flaggers” are organisations which can be trusted to
submit relevant complaints about illegal content.

The Commission’s proposal appears to fully embrace privatisation of
online censorship and disregards the impacts of doing so.

EDRi <https://wiki.openrightsgroup.org/wiki/EDRi> offers a more in-depth
analysis of the Commission’s communication here
<https://edri.org/commissions-position-tackling-illegal-content-online-contradictory-dangerous-free-speech/>.

      Questions in the UK Parliament

        Question on the CJEU judgment in the Schrems case

Lord Laird asked
<https://www.theyworkforyou.com/wrans/?id=2017-09-14.HL1614.h&s=%22data+protection%22#gHL1614.q0> the
Government, what steps they have taken to implement the judgment and
findings of the European Court of Justice
<https://wiki.openrightsgroup.org/wiki/European_Court_of_Justice> (CJEU)
in the Schrems v. Data Protection Commissioner case.

Lord Ashton of Hyde responded that the European Commission's adequacy
decision on the Safe Harbor Agreement on personal data transfers was
invalidated by the Court of Justice of the EU (CJEU) in the Schrems
case. The EU-US Privacy Shield decision has since replaced the Safe
Harbor agreement.

Lord Ashton noted that the Information Commissioner provides regular
updates to the status of Privacy Shield and is an active member of the
Article 29 Working Party Privacy Shield annual joint review team.

        Question on the Privacy Shield

Lord Laird asked
<https://www.theyworkforyou.com/wrans/?id=2017-09-14.HL1613.h&s=%22data+protection%22> the
Government, whether they have received a legal opinion on the Privacy
Shield agreement between the EU and the US and whether they sought
independent legal advice.

Lord Ashton responded that the Government does not intend to comment on
or publish any legal advice they may have received on these matters.

        Question on online terrorist material

Jeremy Lefroy MP
<https://wiki.openrightsgroup.org/wiki/Jeremy_Lefroy_MP> asked
<https://www.theyworkforyou.com/wrans/?id=2017-09-04.7580.h&s=%28internet+OR+cyber+OR+computer+OR+web+OR+surveillance+OR+copywrite+OR+%22data+sharing%22%29#g7580.r0> the
Secretary of State for the Home Department, among other things, how many
pieces of unlawful terrorist material have been removed from the Internet.

Ben Wallace MP
<https://wiki.openrightsgroup.org/wiki/Ben_Wallace_MP> responded that
the Counter Terrorism Internet Referral Unit
<https://wiki.openrightsgroup.org/wiki/Counter_Terrorism_Internet_Referral_Unit> (CTIRU)
referred 280,000 pieces of illegal terrorist material since February
2010 to social media providers which proceeded to remove it.

      ORG media coverage

/See ORG Press Coverage
<https://wiki.openrightsgroup.org/wiki/ORG_Press_Coverage> for full
details./

2017-09-21-IB Times-EU Buried Study That Found No Impact From Piracy On
Entertainment Industry
<http://www.ibtimes.com/eu-buried-study-found-no-impact-piracy-entertainment-industry-2592661>
    Author: AJ Dellinger
    Summary: ORG mentioned in relation to the criticism of EU copyright
    reform.
    Topics: Copyright
    <https://wiki.openrightsgroup.org/wiki/Copyright>, European Union
    <https://wiki.openrightsgroup.org/wiki/European_Union>
2017-09-21-Information Age-WhatsApp rejected UK Gov request to access
encrypted messages
<http://www.information-age.com/whatsapp-rejected-uk-gov-request-access-encrypted-messages-123468667/>
    Author: Nick Ismail
    Summary: Jim Killock quoted on automated takedowns of online content
    inevitably leading to mistakes.
    Topics: Online censorship
    <https://wiki.openrightsgroup.org/wiki/Online_censorship>
2017-09-26-The Inquirer-Campaigner found guilty under terrorism laws for
not disclosing passwords
<https://www.theinquirer.net/inquirer/news/3018107/campaigner-found-guilty-under-terror-laws-for-not-disclosing-passwords>
    Author: Dave Neal
    Summary: Jim Killock quoted on powers under Schedule 7 of the
    Terrorism Act being blanket powers not requiring suspicion.
    Topics: Terrorism Act 2000
    <https://wiki.openrightsgroup.org/wiki/Terrorism_Act_2000>
2017-09-27-Raconteur-Should tech companies enforce law?
<https://www.raconteur.net/finance/should-tech-companies-enforce-law>
    Author: Matthew Chapman
    Summary: Pam Cowburn quoted on international tech companies
    declining service potentially having effect on free speech.
    Topics: Online censorship
    <https://wiki.openrightsgroup.org/wiki/Online_censorship>
2017-09-27-Gears of Biz-Campaigner found guilty under terrorism laws for
not disclosing passwords
<http://gearsofbiz.com/campaigner-found-guilty-under-terrorism-laws-for-not-disclosing-passwords/87365>
    Author: Helen Clark
    Summary: Jim Killock quoted on powers under Schedule 7 of the
    Terrorism Act being blanket powers not requiring suspicion.
    Topics: Terrorism Act 2000
    <https://wiki.openrightsgroup.org/wiki/Terrorism_Act_2000>

      ORG Contact Details

Staff page <https://www.openrightsgroup.org/people/staff>

  * Jim Killock, Executive Director
    <https://www.openrightsgroup.org/people/staff#jim>
  * Javier Ruiz, Policy
    <https://www.openrightsgroup.org/people/staff#javier>
  * Ed Johnson-Williams, Campaigns
    <https://www.openrightsgroup.org/people/staff#ed>
  * Pam Cowburn, Communications
    <https://www.openrightsgroup.org/people/staff#pam>
  * Lee Maguire, Tech <https://www.openrightsgroup.org/people/staff#lee>
  * Myles Jackman, Legal Director
    <https://www.openrightsgroup.org/people/staff#myles>
  * Matthew Rice, Scotland Director
  * Slavka Bielikova, Policy Officer
  * Mike Morel, Communications Officer

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openrightsgroup.org/pipermail/parliamentary.monitor/attachments/20170929/b01da3c0/attachment.html>