Tag: rant

Brief Encounters: an open letter to lawyers

Published 2019-06-29

“When all you have is a legal education, everything looks like a contract”
Me

Dear lawyers

The rule of law and principles of justice are the foundation of civilised society. Thank you for doing your part to prevent us from sinking into Hobbesian savagery. Getting a legal education and licence to practice is clearly a long, arduous and expensive process. Well done you, for coming out the other end with a job.

Having said that; PLEASE SHUT THE FUCK UP ABOUT THE GDPR UNLESS YOU HAVE REALLY STUDIED PRIVACY.

Seriously. A legal education and a quick scan of the text of the GDPR do not make you a privacy expert. It may equip you to start out on your privacy expertise journey with a bit of an advantage, but it certainly doesn’t confer god-like powers of acumen and omniscience on your data protection pronouncements. And yet, people will treat you as though it does, because ‘lawyer’. You are in a position of responsibility, and your professional obligations include the duty to refrain from giving advice you are not professionally competent to provide, no matter how lucrative the opportunity or how clever and powerful it makes you feel.

Even if you’ve studied privacy law in depth and detail, you should probably avoid the temptation to offer your services as an adviser on operational matters. You may not have the business experience, the tech knowledge, the communication skills or the risk management discipline necessary to do the job adequately. Your legal background is also likely to skew your assessments of risk in favour of ‘legally-defensible’ rather than ‘protecting rights and freedoms’. This does your clients and their data subjects no favours at all.

Obviously there are lawyers who do have real data protection expertise, operational (not just legal) experience, who know how to get stuff done in a business-as-usual context, and who can reliably assess ‘what stuff, when and how’. They are a tiny minority of your profession. They are not who this plea is aimed at.

As I’ve said in a previous post, I’m not advocating ‘remain in your lane’, but rather ‘don’t merge until you are up to speed’ (as the brilliant Sarah Clarke paraphrased so succinctly)

Much of the most egregious #GDPRubbish in circulation is spouted by lawyers who don’t realise how uninformed and unprepared they are (see: Dunning-Kruger Effect). Whether from a well-meaning General Counsel who read in an online article that consent is always required, or a contracts specialist within an organisation who believes that all third-party suppliers are only Processors because, well, it’s in the contracts, or a law firm desperate to cash in on the privacy gold rush; the degree of sheer nonsense being propagated by lawyers who think they know best is a disgrace to the profession as a whole. It’s got to the point where I always double-check data protection advice when I learn that it originated from lawyers – and in the large majority of cases, I find it to be at best, inadequate and misleading; and at worst, downright inaccurate.

Uninformed, inexpert data protection advice from negligent lawyers has cost organisations not only the money for fees but also the funds required to fix things when the errors are discovered. It fritters away their time, their effort and their will to do things properly. It has unnecessarily decimated databases and probably killed whole forests-worth of paperwork. It’s shocking.

My experience does not appear to be unusual – in fact, the hordes of lawyers who gave poor GDPR advice are being encouraged to make amends to their clients, for the damage they caused. We’ll see how that goes.

Your professional education has possibly primed you to view your objectives in terms of ‘winning’, or ‘closing’. Data protection isn’t like that. It doesn’t shut up and go away when you cite clauses at it, its purpose is not to provide you with clients, income, or prestige. It’s the protection of human rights, dignity and freedoms. You can’t do that with documents or clever semantic debate, no matter how hard you try (or how much you charge). Data protection advice is not a courtroom battle, you’re not looking to crush the data subject, but to help your clients understand and apply the law. You need to think differently about data protection than you would about contracts, criminal cases, or civil litigation. If you can’t do that – keep your beaks* out of it.

If you’re a lawyer getting interested in data protection then hurrah – I hope you enjoy this exciting, challenging, complex area of law. Now please keep your head down until you know a lot more than law school taught you. Things like….

A privacy notice is NOT A SODDING CONTRACT!! It should not look like, read like, or give the impression of being a contract. Privacy information is not a fig-leaf behind which the unsightly intimacies of data processing can be hidden, it’s a vehicle for the communication of important information about autonomy, rights, and responsibilities. It’s not an internal policy, nor is it the Ten Commandments. And it is most certainly not part of any Terms and Conditions. Using crafty euphemisms and ambiguous platitudes to dodge around telling data subjects what’s really going on might be clever lawyering, but it isn’t data protection. Privacy notices written by lawyers tend to be those which bear least resemblance to the legal obligation of transparency. Awkward.

You are probably one of the least suitable people to be a Data Protection Officer, especially if you already have a role in the organisation and even more so if that role is General Counsel. Apart from potentially lacking the professional attributes and experience described earlier, you also have a massive conflict of interest. As a lawyer, the organisation is your client. As a DPO, you have two ‘clients’ with often-opposing interests which you most balance – the organisation and the data subjects’ right and freedoms. Such conflicts of interest for a DPO role-holder are prohibited by the GDPR. If you’re an outsourced DPO, then either you need to have had a few years experience in the practical side of integrating data protection within an organisation, or you need to have a bloody good team of people around you who can make up for the deficiency. If you have neither, you are the Emperor’s new clothes and sooner or later, someone is going to see through you.

If you have never heard of e-Privacy law and can’t explain the differences between PECR Regulations 6 and 22, then you are absolutely not qualified to advise on the legality of email marketing tactics or cookie dialogues. Don’t.

If you are an intellectual property lawyer then you need to forget pretty much everything you have learned and start over with an open mind. There is no concept of ownership in data protection law, only individuals’ rights and organisational responsibilities. Arguing otherwise makes you look like a buffoon. Data is not property in the eyes of privacy law. Repeat this every night 100 times until it sinks in and your buffoonery quotient is reduced. Fundamental, statutory rights cannot be waived by contract. Arguing otherwise makes you look like an American (which isn’t inherently a bad thing, but is a fairly strong predictor that your understanding of European law is insufficient to rely on for good data protection advice. #NotAllAmericanLawyers, of course).

Contracts do not determine reality. They are not magic spells. Contracts are, in theory, supposed to reflect and document reality for future reference (nice theory, rarely found in practice). If a supplier is making their own decisions about why and what to do with the personal data they access or receive from their customers, then the supplier is a Data Controller no matter what the paperwork says. They may be processing the data unlawfully by repurposing it, but they are doing so as a Controller. Paying someone does not make them your bitch, and paying another company does not make them your Processor, unless they cannot deviate from your (clear, detailed) instructions without your permission.

The terms ‘personal data’, ‘processing’, and ‘data protection breach’, are defined in Article 4 of the GDPR. Read them. You don’t get to make up your own definitions just because your legal brain is bigger than those of the drafters’.

I’ve probably pissed off a lot of people by now, and if you’re one of them, then perhaps take a minute to examine why you are cross. Is it because the criticisms laid out here don’t apply to you? Great, forget about it. Is it because they do apply to you and you’re now feeling attacked and victimised? Please try to get over it. See this as a learning opportunity, not a telling-off. Prove me wrong, I’ll be delighted. Is it because I used rude words? In that case, do please bugger off and learn to distinguish signal from carrier wave.

If you do want to become an awesome data protection professional as well as a lawyer, then come on in, the water’s fine – but start at the shallow end and keep your water wings on or you’ll make a mess.

*see what I did there? I made a legal joke! Laugh, dammit

Tools

Published 2019-06-05

“I suppose it is tempting, if the only tool you have is a hammer, to treat everything as if it were a nail.”
Abraham Maslow

An open letter to the information security profession

Dear infosec people,

You do a tough job in a complex, high-stress and fast-paced environment. I admire the cleverness of your technical capabilities and respect the challenges you face.

Having said that; PLEASE SHUT THE FUCK UP ABOUT THE GDPR UNLESS YOU HAVE REALLY STUDIED DATA PROTECTION.

Seriously. You’re making the lives of privacy professionals really difficult, and that’s not going to lead to collegiate and constructive co-operation. You’re also occasionally making yourselves look like right knobbers to those of us who do know what we’re talking about in this area.

I’m generally not a fan of the ‘stay in your lane’ philosophy – breaking down silos and working together is an essential part of being effective these days. However, if you have not learned the rules of the other lanes, then carelessly blundering into them and screwing with the traffic flow is just as bad – if not worse – than hiding in a silo.

I absolutely welcome infosec people learning more about privacy/data protection – it’s the career path I took myself and have flourished upon. What sends me up the bloody wall though, is the Dunning-Kruger Effect that is evident when infosec people try to tackle data protection without having spent the time and effort to understand privacy law. Because they get it so very wrong and are uncritically parroted by other people who aren’t familiar with either professional knowledge domain, thereby spreading myths, tropes and general #GDPRubbish.

Infosec and privacy are not the same thing at all. There is overlap, but only for a small proportion of both. There is wide divergence and narrow convergence. Information security is about protecting corporate information and systems. Privacy is about protecting individuals and society. Data Protection is privacy applied to information about living people.

pie chart of data protection principles — DP principles

Data protection requires information security, but only as a small feature in a broad landscape of human right-based risks, controls, considerations and obligations. There are seven principles in data protection law, and only one of them is ‘process personal data securely’.

There are a whole bunch of individuals’ rights that have nothing to do with the security of their data. There are a pile of obligations that don’t relate to information security in any way. If you didn’t know that, or you don’t know what those principles, rights and obligations are, then please either go and learn, or belt up and refrain from undermining privacy by hijacking GDPR conversations and narrowing them to infosec-centricity.

It’s understandable that when your whole world is one topic, you’ll see everything else within those terms of reference. It’s natural to have a whole bunch of cognitive biases and assumptions. This isn’t a value judgement on your character, it’s just me pointing out an opportunity to integrate rather than colonise.

To assist you with this, here are some nuggets of data protection wisdom for you to take away and keep.

Privacy is not equivalent to confidentiality, it is the right to be free from unwarranted or arbitrary interference. This may involve a degree of confidentiality for information, but not necessarily. Data Protection is usually more concerned with why you’re doing stuff with/to people via their data than how secret the data is.
Privacy is not the binary opposite of ‘in public’. In fact, ‘in public’ is a spectrum anyway, but even if it were a single environment, it would still not be the opposite of privacy, because being amongst other people does not negate your human rights.
‘Personal data’ is wider than ‘personally-identifiable information’. It’s heavily influenced by context and association, and the same piece of info may be ‘personal data’ in one scenario but not in another. There is no binary always/never threshold. Deal with it.
ISO27001 or any other infosec standard will NOT deliver GDPR compliance. Not even close. Not even 50%. Done properly, 2700x can help you adhere to the security and accountability principles, but does nothing to address fairness, rights, transparency, rights, lawfulness (etc)
No system, tool, document set or ‘solution’ can be ‘GDPR-compliant’ in itself. Only when used in accordance with all of the data protection principles, within an organisational culture of respect for privacy, in a privacy risk-managed way, can it play a small part in GDPR ‘compliance’. Which, by the way, requires the org to have integrated strong data protection risk management as business-as-usual into EVERY process, system, activity and decision.
The GDPR is principle-based law on purpose. It leaves room for innovation, creativity, risk appetite and context. If you’re looking for a prescriptive checklist of inflexible instructions for which no nuance is required, then stop trying to understand data protection and focus on PCI-DSS instead.
The only time ‘encryption’ is the ‘answer’ to data protection, is when the question is ‘what is one way to protect the confidentiality and integrity of data within a particular digital processing environment?’.
Security controls themselves must be assessed for privacy risk. User monitoring and profiling, authentication and verification for example, carry inherent privacy risks of their own and the security justification for using them may be negated by the privacy justification for NOT using them. This is not ‘privacy stopping you from doing your job’ but ‘the lesser of two evils’.

I believe that the disciplines of infosec and privacy can and should work collaboratively and constructively. But in order to do so, privacy pros need to be sterner about emphasising the ‘rights and freedoms’ aspect of data protection, and infosec pros need to accept that their security expertise does not equate to competence in the privacy domain.

Thank you for reading

Lots of luv and respect,

Rowenna

(This was originally going to be an exasperated sweary rant, but it turned out quite moderate and civil. Apologies to anyone I have disappointed as a result.)

More about the differences between privacy and security

Discover what the other 90% of the GDPR is all about

Online Harms

Published 2019-04-09

Following on from an infuriated storm of tweets in response to the #OnlineHarms consultation, I thought the topic was worth expounding on because the sheer fucking insanity of proposing that the Government should define ‘acceptable’ legal content and then force tech companies to police it, evidently needs to be spelled out.

Read all of it…

Human Error

Published 2016-12-06

To err is human…..to forgive, divine..

…(but to really screw things up, you need a computer….!)

One can’t help noticing a recurring theme in the spate of data breach news reports these days. The phrase “human error” is coming up an awful lot. I’d like to take a closer look at just what that phrase means, and whether it is at all a helpful description at all.

What do you think when you hear that something happened due to a “human error”? Do you think “aww, the poor person that made a mistake; how awful for them, I hope someone gives them a hug, a cup of tea and consolation that humans are fallible frail creatures who can’t be expected to get stuff right all the time” or do you – like me – think to yourself “h’mm, what this means is that something went wrong and that humans were involved. I wonder whether systems, processes and training were designed to robustly identify and mitigate risks, whether management support and provision of resources were adequate and whether this is just a case of someone getting unlucky while dodging around policies in a commonly-accepted and laxly-monitored way”

Premise; I fully believe that the statement “the breach was down to human error” is a total copout.

Why?

Let’s start with “error”. The dictionary definition says:

A mistake
The state or condition of being wrong in conduct or judgement
A measure of the estimated difference between the observed or calculated value of a quantity and its true value

The first definition is probably the one that is called to mind most often when an occurrence is described as an “error”. Mistakes are common and unavoidable, everyone knows that. I believe that the phrase “human error” is used consciously and cynically to create the perception that information incidents are freak occurrences of nature (rather like hiccups or lightning) about which it would be churlish and unkind to take umbrage; and unreasonable to demand better.

But in my humble and personal opinion, (based on nothing more than anecdote and observation) the perception thus created is a false one – in fact, breaches that occur solely as a result of genuine mistakes are rare. Even if a “oops” moment was the tipping-point; the circumstances that allowed the breach to take place are just as significant – and usually indicate a wider systemic failure of risk management which could – and should – have been done better.

Risky behaviour that leads to a breach though, is not usually a sincere mistake – it is either a calculated decision of the odds, a failure to understand the risk or ignorance of the possibility that a risk exists. Risky behaviour is *not* an unavoidable whim of Mother Universe (setting aside the philosophical implications, otherwise we’ll be here all day), but the output of a deliberate act or decision. We should not regard ‘risky behaviour which led to a realisation of the risk and unwanted consequences’ in the same way that we do ‘inadvertent screwup due to human frailty’ and to lump them together under the same heading of “human error” does a disservice to us all, by blurring the lines between what is forgivable and what we should be demanding improvements to.

The human bit

Since we’re not yet at the stage of having autonomous, conscious Artificial Intelligence; it must follow therefore that errors arising from any human endeavour must therefore always be “human errors”. Humans design systems, they deploy them, they use (and misuse) them. Humans are firmly in the driving seat (discounting for the moment that based on the evidence so far, the driver is reckless, probably intoxicated, has no concept of risk management and is probably trying to run over an ex-spouse without making it look obviously like a crime). So; whether an information security or privacy breach is intentional, inadvertent or a state in which someone got caught out doing something dodgy, describing the cause as “human error” is rather tautological and – as I’ve noted above – potentially misleading.

I believe that the phrase “human error” is a technically-accurate but wholly uninformative description of what is much more likely to be better described as human recklessness, human negligence, human short-sightedness, human malice or simple human incompetence. Of course; no organisation is going to hold their hands up in public to any of that, so they deploy meaningless platitudes (such as “we take data protection very seriously – that’s a diatribe for another day!), of which “the breach occurred due to human error” is one.

Take for example, the common ‘puts all addresses in the To: field of an email instead of BCC’ screwup which was the cause of an NHS Trust being issued with a Civil Monetary Penalty after the Dean Street clinic incident in 2015. Maybe the insertion of the email addresses into the wrong field was down to the human operator being distracted, working at breakneck speed to get stuff done, being under stress or simply being blissfully unaware of the requirements of data protection law and email etiquette. But they should not carry all of the culpability for this incident – where was the training? Where were the adequate resources to do all the work that needs to be done in the time available? Most of all, where the hell was the professional bulk-emailing platform which would have obfuscated all recipient emails by default and therefore be a much more suitable mechanism to send out a patient newsletter? (provided of course, that the supplier was carefully chosen, UK-based, tied to appropriate Data Processor contract clauses and monitored for compliance…etc etc). The management would seem to have a lot more to answer for than the individual who sent the email out.

So the next time you read of a data breach, privacy abuse or in fact, any other type of incident at all, and see the phrase “human error”, stop and ask yourself: “What was the error”? Was it lack of appropriate training for staff? Cutting corners to cut costs? Failure to provide the appropriate tools for the job? Mismatch between the outputs demanded and the resources provided to deliver them? None of these are inevitable Acts of Nature, the way that occasional “Oops” moments would be.

And as long as organisations are allowed hide behind the illusion of unavoidability; the less likely they are to tackle the real problems.

How To Not Be An Arse

Published 2016-02-07

(a.k.a the futility of compliance-for-the-sake-of-it programmes)

Imagine there was a law* that says “don’t be an arse to other people” which contains a list of 8 general requirements for avoiding arse-ness, including (among others) “be fair”, “be honest”, “don’t be reckless or negligent” and “don’t deny people their rights”.

Then hundreds of thousands of hours, billions of beer tokens and litres of sweat from the brows of assorted lawyers and auditors later; there were produced a number of standards and frameworks, guidance documents and checklists for helping everyone to ensure that whatever they’re doing, they’re avoiding being an arse.

At which point, everyone’s efforts get directed towards finding some technical way to acquire a clean, shiny glowing halo; ticking all of the boxes on the checklists, generating reams of ‘compliance’ paperwork, churning out Arse Avoidance Policies…….but actually ending up as almost *twice* as much of an arse because despite all of the shouting and scribbling and hymn-singing, what they are actually doing on a day to day basis looks remarkably arse-like (despite being called a “Posterior-Located Seating and Excretion Solution”; not the same thing at all) – since as it turns out, arsing around is lucrative and being well-behaved is not so much.

And then the questions is no longer “how do we avoid being arses” or even “what do we need to do to make sure we are not accidentally not arses?” but becomes “what is the bare** minimum we have to do in order not to appear to be arses?”

And that becomes the standard that (nearly) everyone decides to work to, writing long, jargon-filled statements explaining “why we are definitely not arses at all”, insisting that you must all complete a mandatory, dry-as-dust, uninformative half-hour “Anti Arse” e-learning module once a year (and calling it a “training programme” – hah!), hiring armies of lawyers to define the boundaries of “arse” and generally forgetting what it was that the law was trying to achieve in the first place. All of that costs quite a lot of money and – surprise surprise – doesn’t actually fulfill the intent of the law in the first place.

If you have to hide, obfuscate or misdirect from what you are really doing, then it’s quite likely that you are not achieving compliance with the law, no matter how much paperwork you generate or how shiny your halo looks.

It’s quite simple……just don’t be an arse.

(*in case you didn’t get it; that would be the Data Protection Act…..)

(**yes I had to get a ‘bare’ reference in there somewhere)

Tag: rant

An open letter to the information security profession

Snark attack!

To err is human…..to forgive, divine..

…(but to really screw things up, you need a computer….!)