Non-binary: Human rights, data protection, and the proposed UK Bill of Rights

On 10 May, the annual Queen's Speech announced the UK Data Reform Bill and a new Bill of Rights to replace the UK's Human Rights Act (the HRA, which implements the European Convention on Human Rights (ECHR)).

While much focus has been made on the announcement of the Data Reform Bill, the changes to the UK's human rights regime are also worth considering from a data protection standpoint - not least because of the historic interplay between human rights and data protection, but also because of their key importance in the EU's adequacy decision with the UK.

The UK's proposed reform of human rights

The Queen's Speech only mentioned that the Government would "restore the balance of power between the legislature and the courts" by introducing a Bill of Rights, and no further mention was made to the contents of the Bill. The published notes to the Queen's Speech provides further details, and states that the responsibility to "demonstrate a significant disadvantage before a human rights claim can be heard in court will be placed on the claimant".

Separately, a consultation launched by the UK Ministry of Justice last year sheds further light on the changes that could be introduced by the Bill. In identifying issues arising from the implementation of the ECHR's rights in the UK which "distorted the proper protection of human rights" and affected matters relating to the public interest, the consultation conspicuously does not mention data protection or personal data. A separate point stands out with regards to privacy - in particular, the consultation criticised the European Commission (EC) for prioritising privacy rights over freedom of expression rights, and has indicated an intention to strengthen the right of freedom of expression in the UK.

The context of data protection and privacy rights

Despite having separate origins, the right to respect for private and family life is closely related to the right to data protection. The right to privacy is a forerunner to modern data protection rights. The ECHR expressly identified the right to privacy but not data protection, although it is worth remembering that it was drafted in 1950, before the advent of personal computing, widespread use of the internet and smartphones.

While such technological advancements doubtlessly advanced human progress, they also gave rise to new risks to human rights - particularly the right to privacy. A new understanding of privacy was required, namely one surrounding the information about a person. In 1981 the first legally binding international instrument in the data protection field, Convention 108, was developed, and this paved the way for modern data protection legislation such as the GDPR.

The 2012 European Charter of Fundamental Rights now mentions both rights side by side, with the right to respect for private and family life located in Article 7 and the right to data protection located in Article 8. Both rights have similar objectives as they both protect the autonomy and dignity of individuals, and infringing on data protection rights can certainly infringe of the right to privacy. 

However, the right to privacy is triggered in situations where the "private life" of the individual is concerned, and strives to shield the individual from incursions upon their private sphere. Conversely, data protection rights are broader as they apply whenever personal data is processed, and functions by arming individuals with rights they may exercise at their own volition regardless of their interference with an individual's private life.

Changing the balance? 

Although the rights of privacy and data protection are not absolute rights and can be limited, for instance, where there is an overriding public interest or when they come into conflict with the exercise of other rights, the issue here is one of balance. By potentially changing the weight of the freedom of expression vs privacy balance, and the individual rights vs public interest balance, the proposed Bill of Rights changes the way human rights are given effect to in the UK.

This means that the way individuals can avail of their rights to privacy in the UK will be affected, both as part of a package of fundamental rights and against other competing rights. In particular, the onus to "demonstrate a significant disadvantage" potentially means that privacy claims would have a higher bar to meet before they can be heard. Furthermore, in its adequacy decision the EC has stressed the importance of the UK adhering to its international obligations under the ECHR. Indeed this is something also noted by the ICO, who in their response to the MOJ noted that “the UK’s domestic and international commitments to human rights were particularly important elements for its adequacy decisions in respect of the UK”.

For now, a UK Supreme Court decision this year appears to indicate that, at least when balancing between rights of privacy and freedom of expression, the right to freedom of expression has not been given priority over the right to privacy. If the Bill of Rights follows through on its promise, potential privacy claims may well be routed through the broader route of enforcing data protection rights instead. It remains to be seen how the balance between public interest and human rights will be changed by the Bill of Rights, and whether its changes threaten the UK's adequacy decision.