Author: admin

The UK’s data protection regulator, the Information Commissioner’s Office (ICO), has issued a reprimand to a school in Essex in respect of its use of facial recognition technology (FRT) which infringed the UK GDPR.

The data controller, Chelmer Valley High School, are an academy school located in Essex providing education for around 1,200 students ages 11 to 18. The reprimand concerned FRT which processes biometric data to uniquely identify people and is likely to result in high data protection risks. The school had been using fingerprint technology to manage the cashless catering and canteen since 2016 and introduced FRT in March 2023.

The school was reprimanded for failing to:

1. Complete a data protection impact assessment (DPIA) – organisations must carry out a DPIA before you process personal data when the processing is likely to result in a high risk to the rights and freedoms of individuals. Under Article 35(4) of the UK GDPR, the ICO has published a list of processing activities that require a DPIA to be completed prior to the processing. The published list states that the processing of biometric data requires a DPIA where this is combined with any of the criteria from the European guidelines. These guidelines include the processing of data concerning vulnerable data subjects (such as children), and the use of new technological solutions. The school’s DPO has not completed a DPIA prior to the introduction of FRT in March 2023. Instead it was completed in November 2023 after the FRT had already been introduced.
2. Seek valid explicit consent from the students for the processing of biometric personal data – it had been relying on assumed consent for facial recognition, except where parents or carers had opted children out of the processing. Article 4(11) of the UK GDPR is clear that consent requires an affirmative action, and as such consent on an opt-out basis would not have been valid or lawful. Further to this, the majority of students would have been considered sufficiently competent to provide their own consent given Article 8 of the UK GDPR sets the age of which a child can give consent to the processing of personal data at 13 years old. The parental opt-out deprived students of the ability to exercise their rights and freedoms in relation to the processing between March and November 2023. The school has since refreshed consents by obtaining explicit opt-in consent from students.
3. Seek advice from their Data Protection Officer and consulting with parents or students before commencing with the processing. The ICO believed that had the school sought advice from their DPO, many of the compliance issues would have been identified prior to the processing commencing.

The reprimand recommends several further actions the school should take. Although such recommendations are not legally binding directions, it includes: completing a DPIA prior to new processing operations, or upon changes to the nature, scope, context or purposes of processing for activities that pose a high risk to the rights and freedoms of data subjects; amend the current DPIA to give thorough consideration to the necessity and proportionality of cashless catering, and to mitigating specific, additional risks such as bias and discrimination; and amend privacy information given to students so that it provides for their information rights under the UK GDPR in an appropriate way.

This enforcement action exemplifies of the importance of completing a DPIA prior to commencing any processing that is likely to result in a high risk to the rights and freedoms of individuals – it is clear that completing a DPIA as a “tick-box” exercise after commencing the processing will not be enough to comply with data protection laws.

If you would like to keep up to date on the latest in data protection, please get in touch to subscribe to our newsletter, The Data Download.

The King’s Speech last week gave us our first glimpse of the Government’s priorities for the new Parliament. 

From a tech perspective, in the run-up to the King’s Speech, the press were widely reporting that an AI Bill would be included. Although artificial intelligence (AI) did get a mention, there are two bills sitting under the Department for Science, Innovation and Technology and not one of them has AI in the title. These are:

• Digital Information and Smart Data Bill: which our team has summarised here.
• Cyber Security and Resilience Bill: which, considering the severe impact of the IT outage across the private sector and critical national infrastructure last week, seems very well timed.

In the King’s Speech itself, the Government stated it will “seek to establish the appropriate legislation to place requirements on those working to develop the most powerful artificial intelligence models”.

What does this mean?

This ties back to the Labour manifesto which stated that a Labour Government would ensure the safe development and use of AI models by introducing “binding regulation” on companies developing the most powerful AI models, and with what Peter Kyle (the now Minister for Science, Innovation and Technology) said at London Tech Week in June 2024: “At the moment there’s a voluntary code regulating AI, particularly frontier AI […] We would legislate to require the frontier AI labs to release their safety data. That’s to make sure we legislate the standards that are already in the voluntary code”.

There is some discussion now on how the Government might achieve this and under which bill – perhaps by granting a Secretary of State the power to create secondary legislation in relation to codes and standards? This could possibly be as part of the Cyber Security and Resilience Bill as the cybersecurity aspects of LLMs is something the AI Safety Institute has continued to focus on and, following the July global IT outage, this will not abate. Watch this space.

However, what does look possible is that for the many solutions underpinned by the “most powerful models” the Government may be hoping (with some justification) that by putting these standards on a statutory footing this will both wash through all industries, build greater trust and increase adoption. As companies move to increased AI adoption with potentially increased investment in digital, it will be interesting to see the impact of increased workers’ rights and whether this leads companies to increasingly focus on AI governance. Especially as employee rights and cybersecurity obligations are strengthened across all sectors and industries under this new Government and two significant and well known risks of implementing AI solutions are the cybersecurity of the solution and whether outputs produce discriminatory effects. Of course this may already take place by virtue of compliance with the EU AI Act for those providers or users with exposure to the EU market or EU customers.

What is clear is that while an AI Bill is not imminent, the use or reliance on outputs of AI are now well publicised and likely to get increased scrutiny, so a “buyers beware” approach is necessary in the absence of an AI governance regime that assesses and mitigates the risks while ensuring AI forms part of a digital transformation journey with maximum use and efficiency gain.

The King’s Speech has outlined the new Government’s bold proposed changes to current employment legislation. Their plans include the introduction of a new Employment Rights Bill and a draft Equality (Race and Disability) Bill.

The Employment Rights Bill, promised within the first 100 days of this parliament, will make protection from unfair dismissal a ‘day one’ right for all workers. This means that employees will no longer need 2 years’ of employment to be able to claim for unfair dismissal (subject to probationary periods to assess new hires). Parental leave and sick pay will also become available from the first day of work.

The Government plans to ban “exploitative” zero-hour contracts and end ‘fire and rehire’ practices. The existing “discriminatory” age bands that apply to the National Minimum Wage will also be dropped to create a “genuine living wage”.

There are plans for Statutory Sick Pay to be made available to all workers, removing the waiting period and average earning requirement of £123 per week currently required for individuals to be eligible. Flexible working will become the default position for all workers, with employers being required to accommodate flexible working as far as is reasonable.

There is also increased protection for new mothers. Under the new Government’s plans, it will become unlawful to dismiss a woman who has had a baby for six months after their return to work (except in specific circumstances).

Amongst other changes, the Government also proposes to establish a new ‘Single Enforcement Body’ (Fair Work Agency) to strengthen the enforcement of workplace rights, and aims to remove unnecessary restrictions on trade union activity, including reversing the approach to minimum service levels taken by the previous Government.

The Government have said that their proposed draft Equality (Race and Disability) Bill will “tackle inequality for ethnic minority and disabled people by enshrining in law the full right to equal pay for ethnic minorities and disabled people”, thereby making it easier for ethnic minority and disabled people to bring equal pay claims where they have been underpaid. The Government also proposes to introduce mandatory ethnicity and disability pay reporting for employers with 250+ employees.

The Government say the changes will be a significant step towards its aim of delivering the “biggest upgrade to workers’ rights in a generation”.

Our team will be available to advise on these changes as and when we have more detail. Please do not hesitate to get in contact with a member of the team if you require assistance.

On 17 July, as part of the King’s Speech, the new UK Labour Government announced its plan to introduce the Digital Information and Smart Data (DISD) Bill.

Generally, the DISD Bill is aimed at improving access and sharing of data in general in order to benefit public services and public protection. This comes after the lapse of the Data Protection and Digital Information Bill which could not be completed at the end of the “wash-up” period before the dissolution of Parliament under the previous Conservative government.

In the Labour Party’s manifesto, the party made no specific mention to the data protection landscape in the UK. However, it did state that to “kickstart economic growth” it will “ensure [its] industrial strategy supports the development of the artificial intelligence (AI) sector, removes planning barriers to new datacentres.” The party stated it “will create a National Data Library to bring together existing research programmes and help deliver data-driven public services, whilst maintaining strong safeguards and ensuring all of the public benefit.” The concept of the National Data Library has been backed by a number business groups and MPs with a recent report by Onward (a non-profit thinktank) said a British data library would allow start-ups and scientists to easily access the data needed to build AI models, attracting talent and investment to Britain.

In a nutshell, the DISD Bill aims to:

1. Establish Digital Verification Services – to support the creation and adoption of secure and trusted digital identity products and services from certified providers to help with things like moving house, pre-employment checks, and buying age restricted goods and services.
2. Develop a National Underground Asset Register – a new digital map that revolutionises the way that pipes and cables transferring data are installed, maintained, operated and repaired. This is to give planners and excavators standardised, secure, instant access to the data they need, when they need it, to carry out their work effectively and safely.
3. Set up Smart Data schemes – to securely share customer’s data upon their request, with authorised third-party providers.
4. Make changes to the Digital Economy Act – to help the Government share data about business that use public services. This includes an electronic system for the registration of births and deaths and apply information standards to IT Supplier in the health and social care system.
5. Allow scientists to make better use of personal data – Scientists will be able to ask for broad consent for areas of scientific research and allow legitimate researchers doing scientific research in commercial settings to make equal use of the data regime.
6. Strengthen the ICO’s powers and target reform to some data laws – it will be transformed into a more modern regulatory structure, with a CEO, board and chair with new, stronger powers. This will be accompanied by targeted reforms to some data laws that will maintain high standards of protection but where there is currently a lack of clarity impeding the safe development and deployment of some new technologies. It will also promote standards for digital identities around privacy, security and inclusion. The DPDI Bill aimed to do the same.
7. Establish a Data Preservation Process – to enable coroners (and procurators fiscal in Scotland) to initiate when they decide it is necessary and appropriate to support their investigations into a child’s death. This will help coroners get access to online information they need when investigating a child’s death. For example, seeking copies of personal data from social media companies to investigate a child’s death further in relation to suicide. This complements the Online Safety Act and the fact that data protection rights only apply to living people.

It is clear that a complete reform of the UK’s data protection framework is not yet a priority for the new Labour Government. As such, this DISD Bill may come as a relief to those who were dubious about how the DPDI Bill would impact its current adequacy status from the EU given the importance of free-flowing personal data transfers between the two. However, this new government in power has not ruled out a reform of current UK data protections and its mention of “targeted reform to some data laws” gives the impression that it will explore data protection more widely in due course. Data practitioners will keep a close eye on this given the sunset clause which strictly limits the duration of the adequacy decision deadline to expire four years after its entry into force, i.e. 27 June 2025. After that period, they will only be renewed if the UK continues to ensure an adequate level of data protection.

If you would like to keep up to date on the latest in data protection, please get in touch to subscribe to our newsletter, The Data Download.

Click here for the King’s Speech 2024 briefing notes.