Home  |  About  |  Contact

Wednesday, 16 Jul , 2014

Post Vote LibDem Response Vs Legal Analysis Of DRIP Bill Concerns

Share this article

Just after 4.30pm (4.36 to be precise) the DRIP bill gained royal assent and became the DRIP Act.  It will be the benchmark for legality of communications data retention and access for at least 2 years.  After which the “sunset clause” repeals the Act and it will be replaced with whatever the planned formal review deems […]

Just after 4.30pm (4.36 to be precise) the DRIP bill gained royal assent and became the DRIP Act.  It will be the benchmark for legality of communications data retention and access for at least 2 years.  After which the “sunset clause” repeals the Act and it will be replaced with whatever the planned formal review deems necessary to ensure UK surveillance capability is fit for the digital age. You will have to wait until just before the Act is repealed to formally have your say in parliament. No public consultation is planned before then.dripThis comes hot on the heels of David Cameron aggressively restating his plan to establish a UK Bill of Rights and confirming that will be in his 2015 manifesto.  It will allow parliament to legally challenge decisions by the European Court of Human Rights (ECHR).  The cabinet reshuffle on the 16th July effectively culled the most influential opponents to this move and replaced them with supportive Eurosceptics. Opponents are concerned this could lead either to the UK’s expulsion from the EU Council or set a dangerous precedent leading to other, less humanitarian, EU members following suit.
The typically Tory supporting Telegraph published this story about the Deputy PM’s reaction Nick Clegg: the ‘headbangers have won’ in Cabinet reshuffle” on 17th July.  Nick was reportedly “blindsided” by this Tory move.  If individual or companies cannot find legal redress domestically for alleged abuses of privacy and human rights (like the ones that led to the Data Retention Directive being quashed), the ECHR is normally the next port of call.  I will leave you to draw your own conclusions about how surprised Mr Clegg should be.
On the bright side, this might eat into the gains UKIP were expecting at the next general election.
Below are two contrasting opinions on the new law.  Firstly, two articles from Tom Hickman (for the UK Constitutional Law Association), secondly an extract of and link to Liberal Democrat MP John Leech’s denial of issues raised by Tom.  Tom was not directly responding to John’s article, they just happen to robustly contradict each other on almost every point.

THE DRIP ACT – AN INDEPENDENT LEGAL PERSPECTIVE

Tom Hickman on the DRIP Bill: Plugging Gaps in Surveillance Laws or Authorising the Unlawful? 14th July.
Tom Hickman: Further Concerns about the DRIP Bill 16th July
Intom a blog post on Monday I expressed concerns about the lack of time for proper scrutiny of the changes to be brought in by the DRIP Bill.
Towards the end of that blog I expressed puzzlement at a change to be made to the definition of “telecommunications system” in RIPA. This definition is central to the scheme of RIPA and is the basis for many of the powers therein.
The Governments’ suggestion that this change is intended to ensure that services like webmail are caught is not particularly persuasive. The explanatory material provided no further explanation
history may identify this amendment as the most significant part of the DRIP Bill, although it is the one being given the least attention.
More….
If you have no idea what I’m talking about, you can find an end to end run down of DRIP history, content, criticisms and possible implications in my other post “Privacy On An Emergency Drip – What’s The Prognosis

THE DRIP ACT – A LIBERAL DEMOCRATIC PERSPECTIVE

Data Protection, Security, and the GDPR: Myths and misconceptions #2

Welcome back! This is a shamefully delayed sequel to my first instalment of security themed GDPR thoughts: Data Protection, Security, and the GDPR: A fraught and fuzzy relationship. Here I look back again over my pre-privacy IT and InfoSec career to spot things likely...

Where and to whom does the GDPR apply?

Yeah, I doubted my sanity going at this one too, but here I am, because working out whether or not the GDPR would apply in different practical and geographical circumstances is proving harder than it really should...for everyone. This regulation has been my almost...

GDPR – You’ve analysed the gaps, but can you close them?

  There is a critical gap for most firms: An inability to interpret and leverage gap analysis, data discovery, and mapping output to actually implement technical data processing change. This article is about the challenges most large firms are facing when trying...

GDPR – The Compliance Conundrum

There is one question related to the General Data Protection Regulation that will arguably cause more ulcers than any other: How much is enough? In some portions of the GDPR 'good' is straightforward. In many others we are asked to respect principles of fairness and...

Opinion: The role of automated data discovery in a GDPR programme

Do you have any online profiles or posts featuring those 4 magic characters: G D P R? If so, whether you are a business decision maker, IT body, security body, charity boss, employed data protection pro, or job seeking data protection pro (less and less likely), you...

When Business Culture Eats Cybersecurity For Breakfast – Part One

A four-part story of budget cuts, blamestorming, breaches and massive bumps in the road to mature security. Wild Speculation & IT Transformation Do you remember Nick Leeson? On February 23rd 1995 he sent a fax telling bosses at Barings Bank he was ill and wanted...

Cyber Insurers Dictating Cybersecurity Standards?

A run down of the key challenges with choosing and using cyber insurance called out in the last few months. It looks entirely possible you will have 'adequate' security dictated by your insurers, so it is your job to understand the risk based yardstick they're using...

There Is No Such Thing As Information Security Risk

Having worked in IT and Information Security for 13 years, I've come to the conclusion that there is no such thing as information security risk. There are just business risks that have one or more security or IT related causes. There is a fundamental and persistent...

We welcome the Children’s Commissioner report “Who knows what about me?” which shows how children’s data is routinely collected online. The report points out that children are among the first to be ‘datafied’ from birth, including policy and practice in schools, and comments on the datafication of children in the education sector; school databases, classroom…read the full article on the Defend Digital Me blog

Read more

Children’s Comissioner on concerning use of school children’s data

We welcome the Children’s Commissioner report "Who knows what about me?" which shows how children’s data is routinely collected online. The report points out that children are among the first to be ‘datafied’ from birth, including policy and practice in schools, and...

The IT Asset Disposal Vicious Cycle

Most retired equipment is ground up for minimal financial and recycling return... ...that model is financially, environmentally, and socially unsustainable. The way we all do business is changing. Increasing numbers of staff work flexibly and use their own kit....