The Queen’s Speech this week announced that there will be legislation on the Her Government’s use of data. This is a welcome and necessary step.
medConfidential has a sub-project, “All But Names”, which is named after what can currently be shared in Government.
If Government takes only the names off a dataset, but leave your phone number, address, postcode, date of birth, or any other identifiers, then the Government thinks that’s not personal data.
Current practice is sheer lunacy; and the legislation should fix it. As drafted, it doesn’t, but the status quo will not survive the scrutiny that the legislative process brings.
The Queen’s speech briefing notes contained only an announcement of “data sharing” legislation. As part of a charm offensive, the Cabinet Office Minister Matt Hancock launched what they’re calling their “Data Science Ethics” principles.
If you’re going to do something toxic, hiding it behind the moniker “science” is one old trick; just as care.data tried to present its actions as primarily about “research”. We’ll go through the principles in detail in a future blog post. What’s good about them will not take much time; what’s missing and fatally flawed will take somewhat longer.
All Individual Level Data
All individual level data in Government should be covered by the proposed legislation, and it is likely to propose that data can be copied around Whitehall at the whim of a civil servant, if they can say it helps them do something – a standard set so low that no department in Whitehall could object to it – and a standard set so low so that no department in Whitehall would object to it.
This is not a good start for this legislation. Simply making the process of copying data around Whitehall easier is not the digital transformation that GDS is renowned for.
The superficial focus on ethics, public consent, and transparency is clear – and it is welcome, but we should also look at the details of what is being proposed and how. The desire for feedback on the “principles” was so well thought out, that there was no mechanism for commenting when they announced they wanted public comment. When they found 2 scapegoats to link to as the process in a blog post, both links were broken. Symptomatic of the entire shabbily organised event.
There need be no conflict between better government, better use of data, citizen privacy, and public confidence. The conflict comes from the status quo where a department can do whatever it likes with data, as long as it doesn’t include names. The rules are so lax, that there isn’t even a list of this data. The only list of data, put together after the Talk Talk incident, covered only data with names in. How many names are on your itemised phone bill? The use of phone numbers, or other IDs, rather than the names, isn’t a reassurance, especially when the department receiving the data can match it to another dataset that already contains names it already has.
Some in government want to become “more like the telcos”. But no telco who valued their customers would copy so much data to so many other organisations outside of their direct business unit control. The powers of a civil servant to say “we want this data, and we won’t tell you what we want to use it for” are immense, endlessly misused, and an anathema to the organisations Government claim to aspire to imitate.
A telco’s approach is radically different, as they need to maintain customer confidence – not something a mandarin in Whitehall is measured against.
Consensual, Safe, and Transparent
Every data flow in Government should be consensual, safe, and transparent. The data of secret datasets comes because of the secrecy, not because of the data. Secrecy that v1 of the principles perpetuate. If every data project was listed on a webpage, so citizens could see how Government was using data; and if each citizen could see a personalised list of how data about them had been used; there would be no secrecy.
The main objection to consent from Cabinet Office is “we can’t let people opt out of fraud detection!!!”. When the NHS announced the beginning of their implementation of consent, 2 lines in the list of exemptions were the two broad fraud programmes in the NHS. The world didn’t end, and no one said anything – the consent for preventing fraud comes from the democratic process. This paragraph is now the longest “discussion” on this issue that I’ve seen. But it’s a convenient sideshow for data abusers who don’t wish to have their ways examined, let alone changed.
The ability to be secretive, invasive, and nasty is a toxic impediment to public confidence in “data science”. Hiding behind the moniker of “science” has a long and sordid history; and didn’t work out entirely well for Monsanto.
It is not the job of each civil servant to take into account all points of view. That’s what leads to utter debacles in the public sector – care.data, HS2, and the Home Secretary’s view that if “you think there is certain information that should never be available to be used in terms of dealing with crime, I have to say I take a different view” (Q78). It is up to the process and machinery of Government to ensure that diverse views and adverse impacts are all considered – yet that process rarely exists, especially when the feedback mechanisms are so broken and the Minister Wants Something Done.
Either way, as proposed, that process is absurd. The Cabinet Office seem to think that a multicoloured 7 step process will absolve Government of any responsibility.
Care.data would have passed all the tests with flying colours when it was being proposed – and would have done so up until the day it collapsed. The civil servant in charge of Theresa May’s sham marriage detection work will want any data they can get their hands on – and will claim the public interest that comes from the Home Secretary, under the public interest powers of the Crown and Secretaries of State. Yet, there is a reason DWP’s longitudinal study of benefits claimants has an external ethics board. All civil servants should only be working on projects that are in the public interest. What is Government doing that isn’t?
“Transforming the relationship between citizen and state”
Over the course of the summer, what should happen will become clearer. The question is, whether this Government will listen? The previous labour Government did…
The language in the consultation was from the 2009 Coroners and Justice Bill, which was killed off even at the height of the hype of labour’s database state. The civil service just left the language on the shelf, waiting for a co-opted minister.
When the Minister for the Cabinet Office cited privacy issues in his launch speech, he pointed to the Identity assurance scheme Verify (which entirely coincidentally goes live this week). Verify allows citizens to choose to do things; the data science project does things to people. Clearly, promotion of the old ways of large databases being slung round Whitehall, without being tracked, is still alive in bits of the Government Digital Service. Even as Verify offers an alternative approach, the old ways always try and come back.
Taking this legislation down off the shelf is doing precisely that, with the worst follies of the discredited ID cards scheme and its silo effects.
We welcome the announcement of the wish to legislate in this area, as a defined legal basis for what the consultation talked about as “transforming the relationship between citizen and state”, even if the ethics framework and actions suggest that it is more about perpetuating the status quo.
Future months will show exactly what the current practice looks like with data – it makes care.data look positively benign, and the deepmind fiasco look like the pinnacle of good governance.
We welcome legislation – scrutiny will make current practice better. It has to.