Tag: Microsoft

The UK government says reforms to police data protection rules will help simplify law enforcement data processing, but critics argue the changes will lower protection to the point where the UK risks losing its European data adequacy.

Currently going through the committee stage of Parliamentary scrutiny, the Data Use and Access Bill (DUAB) will amend the UK’s implementation of the European Union (EU) Law Enforcement Directive (LED), which is transposed into UK law via the Data Protection Act (DPA) 2018 and represented in Part Three of the act specifically.

In combination with the current data handling practices of UK law enforcement bodies, the bill’s proposed amendments to Part Three could present a challenge for UK data adequacy.

The DUAB changes the law to allow routine transfer of data to offshore cloud providers, remove the need for police to log justifications when accessing data, and enable police and intelligence services to share data outside of the LED rules.

In June 2021, the European Commission granted “data adequacy” to the UK following its exit from the EU, allowing the free flow of personal data to and from the bloc to continue, but warned the decision may yet be revoked if future data protection laws diverge significantly from those in Europe.

While the government argues that its reforms will simplify police data processing, critics say the proposals represent enough of a divergence from EU law that it will likely undermine the UK’s LED adequacy.

They add that many of the government’s changes to police data protection rules are a response to a widespread lack of compliance with key provisions in the DPA 2018, such as the need to log justifications when accessing data or implement controls that limit the offshoring of sensitive law enforcement data to non-law enforcement bodies, including cloud providers.

Computer Weekly contacted the Home Office about every concern raised, and the threat to the UK’s LED adequacy created by the government’s proposed changes to the law enforcement data protection regime.

“We have introduced some targeted amendments in the Data Use and Access Bill to improve public trust and to drive up law enforcement efficiency by simplifying the legislation. We are committed to data adequacy and had the UK’s adequacy decisions in mind when producing this bill,” said a spokesperson.

“Any changes to our data protection regime must not come at the expense of security, and high standards of protection will continue to be applied.”

The adequacy process

In exiting the EU, the UK became a “third country” under the bloc’s rules, which means the European Commission (EC) will have to periodically assess whether the country’s data protection framework and practices provide an essentially equivalent level of protection for EU citizens’ data.

The EC will therefore have to make two separate adequacy determinations under both the General Data Protection Regulation (GDPR) and LED by the end of June 2025.

Data protection experts previously claimed to Computer Weekly in February 2021 that any adequacy decision made under the LED would be principally political in nature if it fails to directly address how the data practices of the UK’s criminal justice sector and intelligence services undermine the data and fundamental rights of EU citizens. If this is not addressed, they said a positive adequacy decision could be open to legal challenges in the European courts.

In October 2024, the UK Parliament’s European Affairs Committee (EAC) – in a warning about the risks of the UK losing its data adequacy – highlighted many of the same issues as the experts Computer Weekly spoke to, noting these would be of “interest and potential concern” to both the EC and European Court of Justice (CJEU) as they consider the UK’s adequacy statuses.

This includes potential divergence on data protection standards that would make it harder for people to exercise their data rights; the possibility that the UK government undermines end-to-end encryption; the independence and effectiveness of the Information Commissioner’s Office (ICO); aspects of the UK’s national security regime under the Investigatory Powers Act 2016, including data collection and retention, surveillance powers and practices, and the role of the Investigatory Powers Tribunal; and any legal cases which provide grounds for concern about UK data protection standards.

The EAC also highlighted potential risks posed by onward transfers of data from the UK to other third countries, including under the UK-US Cloud Agreement.

However, the EAC’s findings were published a day before the DUAB was announced, and two days before the text was published online, meaning its inquiry focused on the previous government’s Data Protection and Digital Information (DPDI) Bill – which was dropped from the legislative agenda during the UK’s pre-general election “wash up” period.

While the EC’s adequacy decision will rest on the exact contents of DUAB – for which there is still no official Keeling Schedule – it will be looking to assess whether the framework provides an essentially equivalent level of data protection for EU citizens’ data.

While some of the more controversial measures contained in the previous DPDI Bill – including removing the need for data protection impact assessments and abolishing the dual biometrics and surveillance camera commissioner role – have been dropped in the DUAB, many aspects of it have been carried over.

There are also a number of new measures that may create fresh adequacy-related problems, particularly changes to the international data transfer regime for police.

While an amendment to the DUAB was tabled by Liberal Democrat peer Lord Clement-Jones that would have required the secretary of state to carry out a formal impact assessment of the bill concerning the UK’s data adequacy, government ministers argued against it during the Lords first committee stage on 16 December 2024.

Responding to Clement-Jones during that debate, Baroness Jones, parliamentary under-secretary of state at the Department for Science, Innovation and Technology (DSIT), said maintaining adequacy was a priority for the government, noting that the free flow of personal data with the EU is vital to research, innovation and safety.

“For that reason, the government is doing all that it can to support its swift renewal. I reassure noble Lords that the bill has been designed with EU adequacy in mind,” she said.

“The government has incorporated robust safeguards and changed proposals that did not serve our priorities and were of concern to the EU. It is, though, for the EU to undertake its review of the UK, which we are entering into now. On that basis, I suggest to noble Lords that we should respect that process and provide discretion and not interfere while it is underway.”

A similar position has been adopted by information commissioner John Edwards, who in response to the DUAB said: “Whilst ultimately a decision for others, in my view the proposed changes in the bill strike a positive balance and should not present a risk to the UK’s adequacy status.”

However, the position of the UK government and ICO differs significantly from the views of a number of specialists familiar with both the EU LED and the UK DPA Part Three. Computer Weekly contacted the Home Office about what robust safeguards have been put in place, and which DUAB proposals have been changed that were of concern to the EU, but received no response on this point.

National security or law enforcement?

Chris Pounder – director of data protection training firm Amberhawk – wrote in a blog post that the DUAB would allow the secretary of state to designate that certain police datasets can become subject to Part Four national security rules, rather than Part Three law enforcement rules, over which the ICO has limited enforcement powers.

“The proposal has the effect of taking large volumes of personal data out of the UK’s data protection regime,” he wrote.

Part Four processing is also completely separate from the LED or GDPR and has no equivalent in EU law, effectively lifting police data out of the scope of EU law in instances where the secretary of state decides police and intelligence bodies can share the data.

The [DUAB] proposal has the effect of taking large volumes of personal data out of the UK’s data protection regime Chris Pounder, Amberhawk

Computer Weekly contacted the Home Office about the removal of policing data from the data protection regime, but received no on-the-record response on this point.

Pounder further noted that while the ICO is being abolished in favour of the “Information Commission”, the problem remains in the DUAB that the secretary of state will be able to appoint the most important members of the Commission, which has the potential to give them undue influence over the new body’s decision-making processes.

“The Commission still has to have regard for: the desirability of promoting innovation and competition; the importance of the prevention, investigation, detection and prosecution of criminal offences; and the need to safeguard national security,” he wrote. “In other words, these ‘regards’ could fetter decisions to protect the privacy of data subjects.”

Pounder added the DUAB will also permit the secretary of state to apply a “data protection test” when considering whether a country, part of a country, or a controller located in a country offers an adequate level of protection.

He said the provisions will increase the risk of divergence from EU transfer standards if the EC and UK government have differing views on what “adequate” means here. “Also I don’t understand how a country is not deemed adequate, but a controller, processor, or recipient located in that country is,” Pounder added.

While the UK has already taken steps to award its own law enforcement adequacy to countries not recognised by the EU – including the Isle of Man, Jersey and Guernsey – the EU has not yet reacted to these changes.

Thomas Barrett, a partner at CyXcel who leads the organisation’s data protection and privacy practice, and has previously advised the Home Office and Ministry of Justice on compliance with the DPA 2018, said there are certain scenarios where specialist police units within forces may have to collaborate with intelligence services for particular operations – for example, in terrorism cases where intelligence services have information but no power of arrest as police do – adding while “it raises red flags … I would be surprised how many of these are made”.

He added that in cases where this power is used, it has the potential to be “more targeted, more proportionate, and safer,” because only one set of data protection requirements would apply to this processing, rather than potentially three currently.

As a result, Barrett said the changes being made to UK law via the DUAB are very unlikely to materially affect the country’s LED adequacy.

“It would be counter-productive to remove adequacy over such small changes … there’s so much [law enforcement] cooperation. … Looking at the detail, I struggle to see how you really make hay of a lot of it.”

He said the real risk to LED adequacy therefore lies at “the political level”, which will be decided between the EC and the UK government.

Law enforcement transfers

Independent privacy consultant Owen Sayers, a long-term commentator on DPA Part Three compliance issues with more than 25 years of experience in delivering secure solutions to policing and the wider criminal justice sector, said for the first time UK legislation would place individual data processors – such as cloud providers – on the same broad footing as overseas law enforcement organisations, exempting them from the list of mandatory transfer conditions outlined in Article 39 of the LED.

This includes that the transfers be strictly necessary, that no data subject rights override the public interest of the transfer, that transferring to another policing body – or “competent authority” in LED parlance – would be ineffective, and that the controller provides specific instructions of how to process the data in that particular case.

Under the UK’s current law enforcement-specific data protection rules, police data controllers are bound by the DPA 2018’s stringent transfer requirements, which fully mirror EU law.

This means that, as it stands, each individual law enforcement data controller must ensure that a contract in writing exists between itself and the data processor, which sets out details of the processing, including its duration, nature, and the type and categories of personal data involved. To be valid, the contract or terms of service must be explicit in how they meet the DPA requirements.

Police data controllers are also required to ensure the processor seeks and receives permission before transferring data to a third country, for each particular transfer made. This means each transfer must be assessed on a case-by-case basis.

Police data controllers are further required to perform a case-by-case analysis and justification for all personal data offshored to such processors, and to report this to the ICO. Although police forces have used Microsoft and Amazon Web Services services for the past six years – meaning millions of these transfers will have taken place – the ICO revealed in a Freedom of Information (FoI) response to Sayers that only 148 such notifications had been received up to June 2023.

As previously reported by Computer Weekly, the use of hyperscalers under current UK law presents a number of data protection concerns, including US government access via the country’s invasive surveillance laws, and an inability to comply with the strict transfer requirements contained within the DPA 2018.

In June 2024, Computer Weekly reported details of discussions between Microsoft and Scottish policing bodies – obtained via FoI rules – in which the tech giant admitted it could not guarantee the sovereignty of UK policing data hosted on its hyperscale public cloud infrastructure.

As a result of these FoI responses, Sayers said the law is breached far more often than it is adhered to: “The evidence to show that multiple parts of the Part Three legislation are consistently breached or simply ignored by policing and their justice partners is overwhelming. In truth, the number of organisations who do apply the law as it’s currently written is less than a handful, though those that do so do it very well.”

Mariano delli Santi, legal and policy officer at the Open Rights Group (ORG), said these issues mean it is an open question whether cloud providers can adhere to Part Three requirements in practice. “Given the issues around sovereignty, is a cloud provider able to enforce the contractual agreements entered into with the police? I think that’s an issue that would cause concern,” he said.

Since the re-election of Donald Trump, delli Santi pointed out that the US government has broken several adequacy-related commitments made to the EU around enhancing scrutiny and ensuring the proportionality of their intelligence services operations.

“The Trump Administration fired members of the Privacy and Civil Liberties Oversight Board, and then doubled down with the Federal Trade Commission. Both bodies were fundamental pieces of the EU-US Data Protection Framework [DPF] which, at this point, is quite certain to be struck down by the CJEU,” he said, adding the UK-US Data Bridge, which acts as an extension of the DPF, will also go down if the EU invalidates the framework.

“It has now become obvious that the EU-US DPF will not last for long, and it has just as obviously become unfeasible to rely on US cloud providers for storing personal data unless you are willing to compromise the security and sovereignty of the data you transfer. Indeed, European lawmakers have already started to discuss this.

“Based on all the above, it is now a fact that relying on US cloud services constitutes a threat to the sovereignty, security and autonomy of the UK. Until now, this has been treated as a risk-mitigation issue at best, or something to be swept under the carpet at worst.”

Highlighting the lack of clarity from the UK data regulator around cloud data sovereignty and the applicability of standard contractual clauses in this context, delli Santi said this has created a grey area in which transfers have been allowed to continue.

“The UK government, on their side, have tried to formalise this approach with the DUAB, which introduces a new data transfer regime specifically designed to accommodate the ICO’s ‘tolerant approach’ toward data transfers that lack effective safeguards, and allow data transfers to countries such as the United States by sidestepping human rights and data security concerns.

He added that “the UK needs an exit plan to progressively cut reliance on US digital infrastructure and services – and we need this plan fast”, which includes contingencies to move away holding companies or subsidiaries of US firms geographically based in Europe, which still fall under US jurisdiction.

Given the issues around sovereignty, is a cloud provider able to enforce the contractual agreements entered into with the police? I think that would cause concern Mariano delli Santi, Open Rights Group

“Any of these companies are under an obligation to cooperate with law enforcement and international security authorities in the United States, which can be ordered to hand over data without necessarily having to tell the contracting party,” said delli Santi.

According to the government’s explanatory notes published for the DUAB in October 2024 (paragraph 1022), Schedule 8 of the bill seeks to widen the transfer conditions “by expanding the list of intended recipients to specifically include processors acting on behalf of, and in accordance with a contract with, a controller”.

It added that while transfers to processors in third countries are currently permissible, “this amendment clarifies the existing law and provides legal certainty to UK controllers that they can transfer personal data to their processors operating outside of the UK”.

The explanatory notes also specify that the DUAB will no longer require “controllers to notify the commissioner on each occasion data is transferred; it simply requires notification of the categories of information” that will be transferred.

However, Sayers argued that even if the US government does utilise its various surveillance laws to gain access to UK data, the transfers would be unlawful anyway as UK law lays down a series of specific steps that must be followed for each and every transfer of a specific piece of personal data under Part Three.

“These steps are not being followed, and Microsoft has made clear that they cannot be followed – actually, they’ve said ‘impossible to operationalise’. Because the steps laid down in the DPA 2018 Part Three are not and cannot be followed, that is one of the main reasons why the processing being done on these clouds is in breach of UK law,” he said.

“It makes zero difference if the US government bogeyman tries to use the Cloud Act to look at the data or not, as the data was illegally transferred regardless of the Cloud Act.”

The steps laid down in the DPA 2018 Part Three are not and cannot be followed [which is] one of the main reasons why the processing being done on these clouds is in breach of UK law Owen Sayers, independent privacy consultant

He added: “The intention [of the new DUAB] is to put non-UK processors – principally hyperscalers – on the same broad legal footing as overseas law enforcement organisations.”

He pointed out that the bill would enable UK policing bodies to send data overseas to offshore processors with minimal restrictions. “The bill actually puts overseas processors above overseas law enforcement processors, in the respect that it completely removes obligations to record what data is transferred to them, inform the ICO or make any assessments as to whether a particular transfer is safe and consider the data subject’s rights in advance of sending the data.”

Sayers added that while these and other changes to Part Three would be directly contradictory to EU law, the most likely outcome would be the CJEU finding that the UK regime falls far below EU standards and thus moves to block UK data transfers.

He further added that individual member states may also deem UK laws to be too divergent from their domestic laws to continue to send data, noting the chance of this is high given there are 27 member states, each with their own implementation of the LED.

“You can 100% use cloud for law enforcement data, but it needs to be sovereign and fully conformant with the law. If you need to change the law to accommodate a specific provider, then you’ve picked the wrong supplier.”

Computer Weekly contacted the Home Office about the changes to the law enforcement data transfer regime, and UK policing’s track record of non-compliance with existing data rules via its use of hyperscalers.

A Home Office source told Computer Weekly that the use of cloud providers, in particular, has caused some confusion, and that measures contained within the bill are intended to give law enforcement the confidence to use cloud processors. However, they said the use of cloud services must not come at the expense of security, and high standards of protection will continue to be applied.

‘Systemic’ transfer issues

Clement-Jones highlighted how cloud service providers routinely process data outside the UK and are unable to provide necessary contractual guarantees to policing bodies, as required by Part Three. “As a result, their use for law enforcement data processing is, on the face of it, not lawful,” he told the House of Lords.

He added this non-compliance creates significant financial exposure for the UK, including potential compensation claims from data subjects for distress or loss, something that is exacerbated by the sheer volume of data pressed by law enforcement bodies: “If only a small percentage of cases result in claims, the compensation burden could reach hundreds of millions of pounds annually.”

Clement-Jones concluded that the government’s attempts to change the law suggest that past processing on cloud service providers has not been compliant with the relevant data protection laws.

As a result, he proposed an amendment “to bring attention to the fact that there are systemic issues with UK law enforcement’s new use of hyperscaler cloud service providers to process personal data”, which would strictly limit overseas transfers to law enforcement bodies with “a legitimate operating need” – that is,  not cloud service providers.

While the Lords were not invited to take a decision on Clement-Jones’s hyperscaler amendment, government minister Baroness Jones said the DUAB’s “bespoke path for personal data transfers from UK controllers to international processors is crucial … [as] we need to ensure that law enforcement can make effective use of them to tackle crime and keep citizens safe”.

One of the biggest problems in data protection is a lack of understanding and clarity [so] anything that can make it clearer and easier to follow can only be a good fit Thomas Barrett, CyXcel

She added the aim of the DUAB’s reform around international law enforcement transfers “is to provide legal clarity in the bill to law enforcement agencies in the UK so that they can embrace the technology they need and make use of international processors with confidence”.

She added: “Such transfers are already permissible under the legislation, but we know that there is some ambiguity in how the law can be applied in practice. This reform intends to remove those obstacles. The noble Lord would like to refrain from divergence from EU law. I believe that in this bill we have drafted the provisions, including this one, with retaining adequacy in mind.”

Barrett said the DUAB will clarify the law in ways that make it easier to put in place contractual provisions and other measures that adequately protect the data: “One of the biggest problems in data protection generally, but particularly here, is a lack of understanding and a lack of clarity … anything that can make it clearer and easier to follow for individuals that have to apply this stuff can only be a good fit.”

Sayers made a similar argument, noting that while many data protection practitioners believe the EU or UK GDPR to be the gold standard of legislation, they “simply fail to recognise that GDPR has a sister piece of legislation in the LED that is sufficiently different that you cannot apply GDPR thinking to it”.

He added: “This is a problem I see day in, day out, where a GDPR hammer is used to try to fix an LED nail, and even the ICO is not immune to confusing the two different sets of laws.”

According to delli Santi, the approach to transfers under the DUAB as it stands is “formalising an approach that has already been changed”. He added that given the deep commercial, governmental and cultural ties between the UK and EU, “the impact of divergence is amplified significantly”. 

Police data logging requirements

The DUAB as introduced will also seek to remove the statutory logging requirements of Part Three, which would allow police to access personal data from various police databases during investigations, without having to manually record the “justification” for the search.

The removal of police logging requirements, however, could represent a further divergence from the EU’s LED, which requires logs to be kept detailing how data is accessed and used.

“The logs of consultation and disclosure shall make it possible to establish the justification, date and time of such operations and, as far as possible, the identification of the person who consulted or disclosed personal data, and the identity of the recipients of such personal data,” says the LED.

Clement-Jones told Computer Weekly that if the law changes to allow police data transfers to, and processing in, infrastructure not owned or controlled by UK bodies, it could “absolutely” be a problem for the UK’s LED adequacy retention. He added that given these clear access and control issues, the potential removal of police logging requirements is “egregious”.

Computer Weekly contacted DSIT about the removal of the logging requirements and whether it believes this measure represents a risk to the UK being able to renew its LED adequacy decision in April 2025, but DSIT declined to comment on the record.

Speaking during the 16 December Lords debate on the bill against the removal of justification logging requirements, Clement-Jones said: “The public needs more, not less, transparency and accountability over how, why and when police staff and officers access and use records about them.”

He added that while policing systems typically capture when, how and by whom data has been accessed, they “very rarely” capture the justification. This is despite the fact that Article 63 of the LED provided a grace period from May 2018 to May 2023 for member states to implement justification recording mechanisms to bring their legacy systems into compliance with the directive – new systems procured from May 2016 onward were required to comply from the start.

To alleviate the issue, Clement-Jones tabled a further amendment to ensure the logging requirements remain, which would “prevent material divergence from the EU Law Enforcement Directive”; although this was also withdrawn.

He also highlighted that “many commodity IT solutions” procured by policing organisations do not capture justifications by default, noting that while a “transitional relief” period was put in place with the introduction of DPA 2018 to modify legacy systems installed before May 2016 – later extended to May 2023 – UK law enforcement bodies did not in general make the required changes.

“Nor, it seems, did it ensure that all IT systems procured after 6 May 2016 included a strict requirement for LED-aligned logging. By adopting and using commodity and hyperscaler cloud services, it has exacerbated this problem,” he said, noting the government now wishes to strike the justification requirements completely.

“This is a serious legislative issue on two counts: it removes important evidence that may identify whether a person was acting with malicious intent when accessing data, as well as removing any deterrent effect of them having to do so; and it directly deviates from a core part of the law enforcement directive and will clearly have an impact on UK data adequacy.”

DSIT claims that removing the logging obligation will save 1.5 million police officer hours a year and save £42.5m for the public purse, but Sayers pointed out that the published impact assessments don’t so far evidence these claims.

“The reality is that most police IT systems don’t have the means to capture the required data,” said Sayers, who was previously involved in the design and delivery of many UK national police systems.

“The factsheets identify this technology problem, which exists on cloud as well as legacy systems like the PNC [Police National Computer], but instead of addressing the issue the government simply want to strike the difficult bits out of the act.”

He added: “The real reason they don’t want to capture the information is they’ve failed to invest any money in upgrading the legacy IT, and the new systems they’ve adopted don’t capture that information by default – and can’t be made to do so.”

DSIT claims that capturing “justification is likely to be of little use in a misconduct investigation”, but Sayers poured cold water on this.

“Public trust, the safety of vulnerable people, as well as the protection of police staff from claims of improper conduct, all rest on being able to prove that access to data was legitimate,” he said.

Home Office figures show police staff misuse of data to be a significant issue, with 1,630 recorded cases investigated in the year to March 2023, the last figures available.

However, Barrett said the removal of justification logging is not a problem, adding it’s more important to have the ability to track who accessed data and when, “because if you’re a bad actor you’re not going to put down the real reason … if you’ve already got access to these kinds of systems, you’re not an idiot, and so you’re going to put something like ‘routine checks’ or some other bland, uninteresting, non-determinative thing”.

He further added that inputting justifications only increases the administrative burden on police, and that while it is very common, even in much older computer systems, to be able to log time and dates, many systems are simply not architected to record justification.

He added: “We’d be much better off making sure that all the systems are really good at recording time and access, because the reality is, in your investigation, that’s going to be the thing that you’re looking at. Not whatever fanciful thing a bad actor has decided to enter as the fake justification for the access.”

During the DUAB debate, Baroness Jones insisted the removal of logging requirements “is not a watering down of provisions. We are just making sure that the safeguards are more appropriate for the sort of abuse that we think might happen in future from police misusing their records.”

While the DUAB has since progressed to readings in the House of Commons, the police data issues were not addressed – outside of vague references to reducing the administrative burden on police officers. It is currently in the committee stage, which will be followed by the report stage and a third reading.

So far, the police data issues have not been discussed during the committee stage.

Source