The Government’s Data Protection Bill had its Second Reading debate on Tuesday 10 October. For Open Rights Group, and other members of civil society, the test for data protect fulfilling its purpose is whether it is improving consumer rights. That is why we’ve made a specific effort to improve the representation of data subjects in the Data Protection Bill.

Currently, the Government’s Data Protection Bill will give citizens the power to instruct a select group of not for profit bodies to represent them in complaints to the data protection authority or the judiciary. This is required of the Government, as Article 80(1) is a mandatory provision in the General Data Protection Regulation, which as a member state of the European Union is directly applicable in the United Kingdom. 

 However, when given the option to further strengthen consumer rights the Government decided against it. Article 80(2), an optional power in the GDPR, would give those select not for profit bodies the option to take those same complaints without having an affected member of the public instruct them.  

This would improve consumer rights online in fundamental ways, and send an important signal out to everyone: data protection is a consumer right and with that should be given the same powers that have proven so important in other areas of consumer rights. 

Importantly, 80(2) might hold benefit for everyone involved in data protection, including businesses which are data controllers. 

DATA PROTECTION AS A CONSUMER RIGHT 

The idea that a not for profit body could take up an independent complaint against bad consumer practices is not novel. Traditional consumer rights such as competition and finance have similar powers for a select group of bodies. Some of these powers have lead to significant developments in the consumer landscape. It is time data protection is recognised as another area of consumer rights, one that is growing in importance, and should be given the same enforcement mechanisms as the others. 

Consumer rights group Which? is capable of taking a private enforcement action in civil courts against traders for infringements of consumer protection legislation. There is no need to find an individual affected to instruct Which? to take on the enforcement, instead they need merely to show that consumers have suffered a loss.

Also, in the financial sector there is the power for Which?, Citizens Advice, the Federation of Small Businesses and the Consumer Council for Northern Ireland to present “super-complaints” to the Financial Conduct Authority. It was this form of complaint, exercised by Citizens Advice, that played an important role in tackling the mis-selling of Payment Protection Insurance.

The right for independent bodies to take complaints independently of finding an affected consumer are already in the wider consumer landscape. They have been wielded with discretion and have shown to be a valuable addition to the consumer rights framework. For data protection to be a modern consumer right, it is only logical that the same accountability frameworks are brought in. Implementing Article 80(2) is the way to achieve this. 

IMPROVING THE DATA ENVIRONMENT 

In 2007, the Office of Fair Trading contributed a submission to the Government looking at private action in consumer law more generally. The Office was overwhelmingly in support of a system for private enforcement. 

Interestingly, the argument hinged on the wider effect of the system, rather than a purely consumer rights improvement standpoint. From OFT’s perspective: “An effective private actions system increases incentives of business to comply with competition law, since the potential incidence and magnitude of financial liability to a competition authority and/or a claimant will increase.”

Ultimately, according to OFT: “a system which incorporates effective public enforcement and a real possibility of private actions will increase the likelihood that anti-competitive behaviour is detected and addressed…”

Substitute anti-competitive for bad data protection and you have the potential that 80(2) holds for everyone, including businesses. The vast majority of businesses will operate within the rules of data protection, creating a stronger enforcement regime will reduce the opportunities for bad data protection practices, and for groups to profit off the back of their bad practice. 

GOVERNMENT’S VISION

The Government’s vision for the Data Protection Bill is to make the UK the safest place to live and do business online. It recognises the increasing volumes of personal data, and notes it as an increasing need to protect it. The vision even recognises that data losses can have distressing repercussions on individuals, and that victims can lose trust. It also recognises the need to create a better business environment. All of this sounds hopeful, as though the Government has identified the issues that data protection can help solve.

If the Government truly wants to achieve its vision, the small addition to improve the accountability framework for consumer rights in data protection will be a big step to take it there.