Impact case study database
Transforming law, policy and public debate through a new understanding of ways that internet privacy underpins critical issues
1. Summary of the impact
Internet privacy really matters. A failure to protect personal information from third party acquisition, disclosure and (mis)use leaves internet users exposed to a wide range of harms. Successive UK Governments and their agencies have been unable to keep up with the scale of this challenge in law, public policy, or action. UEA research led by Dr Paul Bernal has played a significant role in creating a better understanding of the government’s role and responsibilities, and has influenced the development of new landmark legislation, new oversight bodies, and new policy instruments. Impact overseas on government policy and on protection of digital rights of citizens has followed.
2. Underpinning research
When the World Wide Web was invented back in 1990, few could have predicted that the internet would have grown so quickly and with such profound, and frequently adverse, implications for privacy. Tim Berners Lee himself now talks about the growing threat of a ‘digital dystopia’ blighted by privacy violations. The UK Government has been slow to come to terms with the magnitude of those ever more complex threats.
UEA’s research on these issues, led by Dr Paul Bernal, is based on a long term, broad and hands on experience of the complex inter-relationships among intellectual property, human rights and internet data use in the UK. Bernal’s personal, real world, commercial and third sector experience of the complex relationships between the key rights and issues arising from the internet’s rise – between privacy and freedom of speech, between privacy and autonomy, between privacy and the ability to discover the truth – has informed the development of his UEA research over the last ten years. That work has demonstrated that the failure to protect privacy on the internet affects not just cardinal human rights such as freedom of expression and protection from discrimination, but almost all rights, including the ‘right to be forgotten’, and overt and covert political and commercial manipulation, through the use of harvested personal data.
While at UEA, Dr Bernal has published two monographs. The first, Internet Privacy Rights (2014, Cambridge University Press) [R1] made the link between privacy and autonomy, and specifically how the need to protect autonomy means that we have to protect privacy on the internet and minimise data collection and profiling. The second monograph, The Internet, Warts and All (2018) [R2], linked together the issues of free speech, privacy and truth, and covered such topics as the right to be forgotten, political manipulation by data, fake news and trolling. It showed how the lack of effective protections for internet privacy is an underlying problem for all of these. It also took the theoretical constructs of the first monograph and made them much more directly applicable to the internet as experienced by users, drawing on key internet developments from 2014 to 2018.
A series of peer-reviewed academic chapters and papers complement these monographs:
The EU, the US and Right to be Forgotten (2014) examines the legal, political and theoretical debates over the right to be forgotten, showing the links between privacy and freedom of speech in this particular context, and applying it to a critical area. [R3]
Data gathering, surveillance and human rights: recasting the debate applies the theories developed in Internet Privacy Rights to the key field of government surveillance and demonstrates that data gathering and surveillance impacts on a wide range of human rights, including freedom of speech, of association and assembly, and protection from discrimination [R4]. This piece distils work that influenced the development of the Investigatory Powers Act 2016 and underpinned evidence given to the Joint Parliamentary Committee on the Investigatory Powers Bill.
Fakebook: why Facebook makes the fake news problem inevitable, shows how Facebook’s business model – in particular its data gathering, profiling and targeting systems – are the key to the current fake news problems that have emerged from 2016 onwards and remain a critical political problem today [R5].
This body of research has revealed in detail, issue by issue, and connection by connection, the scale and complexity of the threats to internet privacy, and pointed to ways that these challenges can be addressed, though changes in policy and law, and new approaches to oversight.
3. References to the research
- Internet Privacy Rights: Rights to Protect Autonomy.
Paul Bernal.
Cambridge University Press, ( 2014). ISBN: 9781107042735
- The Internet, Warts and All: Free Speech, Privacy and Truth.
Paul Bernal.
Cambridge University Press. ( 2018) ISBN: 9781108422215
- The EU, the US and Right to be Forgotten.
Paul Bernal
In ‘Reloading Data Protection: Multidisciplinary Insights and Contemporary Challenges’.
Gutwirth, S., Leenes, R. & De Hert, P. (eds.).
Springer, ( 2014) p. 61-77 17 p. 2. ISBN: 9789400775398
- Data gathering, surveillance and human rights: recasting the debate.
Paul Bernal
The Journal of Cyber Policy, ( 2016) . DOI 10.1080/23738871.2016.1228990
- Fakebook: why Facebook makes the fake news problem inevitable.
Paul Bernal (output held on file at the UEA)
Northern Ireland Legal Quarterly, Vol 69 No 4 ( 2018), pp313.
4. Details of the impact
Influence upon new (landmark) UK Surveillance Law
The tension between the needs of the State and the rights of the citizen in respect of internet privacy is manifest most clearly in matters of national security. In the analogue world the extent of the surveillance powers of the State were far easier to frame in law, policy and practice. The rise of the internet required a sea change in all three, and the most significant piece of legislation to have come into effect in the new digital age was the 2016 Investigatory Powers Act. Bernal submitted research evidence to a call to inform the new Act. David Anderson QC, who at the time was the Government’s Independent Reviewer of Terrorist Legislation, quoted Dr Bernal extensively in his highly influential 2015 report on surveillance “A Question of Trust” (S1).
In this report, Anderson quoted Dr Bernal on 4 points (S1):
Importantly, on power asymmetry (between authorities and general public) on the issue of transparency. This is the reason David Anderson titled the report ‘A Question of Trust’ and reflects the nature of the report and the learning from Bernal’s work: “…This reflects a fundamental imbalance. Those involved in investigatory powers have (naturally) far more information regarding the use of those powers than those in civil society. Yet, as explained by Dr. Paul Bernal: “ [i]t is not enough for the authorities just to say ‘trust us’: the public needs to know that they can trust the authorities”.” (point 12.6, p.214)
About the need of proper scrutiny over new sources of data: “The use of location data provided by mobile phones is another example of the “new dimensions of data” created by technological change” (point 4.30, p.56, fn32). The constant change in technology is one of the themes of R2, particularly Chapters 7 and 10.
Scope of investigatory powers. Anderson highlighted Bernal’s concerns on rights to a fair trial, freedom of expression and freedom of association (point 12.33, p.223, fn34), a point highlighted by his research (R4)
On bulk collection: the idea that the collection itself, regardless of whether or not a communication is read, is an intrusion into privacy which requires careful justification (point 12.35, p.223, fn 37 & 40), as noted in Chapter 7 of R2.
Dr Bernal was then invited to appear before the Joint Parliamentary Committee on the Investigatory Powers Bill and made oral and written submission drawing on key findings from his research (Chapter 7 of R2, and R4). Bernal was quoted more than 20 times in their eventual report, in the key areas, covering the impact of surveillance, invasions of privacy, and the need for more effective oversight (S3): leading, as noted above, to an additional level of oversight in the Act. Bernal later contributed to Anderson’s ‘Bulk Powers Review’ for the Investigatory Powers Bill in 2016 – the most important piece of surveillance legislation since 2000, and the first that really addressed surveillance on the internet, where his contribution is noted (S2a). Bernal was the only academic in the field of law whose advice was sought for this report.
Bernal’s research on surveillance, and his work with the National Police Chiefs Council’s Independent Digital Ethics Panel for Policing (see below), and his involvement with the Joint Parliamentary Committee’s Report (above) led to the inclusion in the New Act of a ‘Technology Advisory Panel’ to the Investigatory Powers Commissioner (as set out in Section 246 of the 2016 Act, S2b). This Panel was charged with advising about ‘the impact of changing technology’ and ‘the availability and developments of techniques to use investigatory powers while minimising interference with privacy’. These are two of the key areas Dr Bernal discussed in his evidence to the Joint Parliamentary Committee on the Investigatory Powers Act (S4 and S5) and in his research (particularly R2 and R4) as being missing from the oversight in the planned bill. The addition of this Panel significantly strengthens the oversight provisions of the new Act, while giving those charged with implementation, beginning with the Commissioner, a much closer understanding of both the fast-moving digital marketplace, and the wider human rights implications of policy and practice development. Dr Bernal was an invited speaker to the first meeting of the Panel (S6), chaired by the then Investigatory Powers Commissioner. The Panel has stayed in close touch with Dr Bernal since, for example arranging for him to meet with the Australian equivalent of the Independent Reviewer of Terrorism Legislation (see below).
Shaping the Design and Delivery of Oversight of Police Surveillance in the UK
The Police have long been part of the front line of national security surveillance in the UK. Dr Bernal’s research led him to be invited to become a founding member of the National Police Chiefs’ Council’s ‘ Independent Digital Ethics Panel for Policing’ (IDEPP), which was set up in (2015). UEA research was key to the success of this new Panel, which also included representatives of GCHQ (Government Communications Headquarters), the technology industry and other academics. The Director of Strategy, Policy and Communications at GCHQ (and a fellow member of the IDEPP Panel) says; ‘ Paul’s wider research, publications and voice has always, and continues to be, influential in shaping debates around internet privacy rights and surveillance’ (S7). The panel has provided advice to a number of police forces around the UK, as well as to the National Crime Agency covering many different areas in which digital ethics and privacy in particular are important. These have included the use of undercover online policing in operations against child sexual exploitation (infiltrating child-abuse networks), predictive policing, and algorithmic bias in policing and justice. This advice has taken a number of forms, from direct meetings with those involved in these operations to policy guides used in policing.
Influencing the internet privacy policies and practice of other UK bodies and authorities
In addition to his policy and practice work on national security-related surveillance, Dr Bernal was asked by a number of UK bodies to contribute to their understanding of, and response to, the internet privacy aspects of their key areas of operation. These include the Law Commission in their consultation for their Scoping Report in relation to Abusive and Offensive Online Communications (July 2018); the UK Competition and Markets Authority in relation to the establishment of a new Data, Technology and Analytics unit (October 2018); the Department for Digital, Culture, Media and Sport’s (DCMS) Digital Competition Expert Panel in relation to competition in digital markets (October 2018), and the DCMS investigation into Regulating Digital Campaigning (November 2018); the Competition and Markets Authority (CMA) (March 2019) over the regulation of digital markets, and potential enquiries into the regulation of social media, and the DCMS, and the Parliamentary Under-Secretary, in particular, in their project on digital identity (October-December 2020).
Reshaping the policies and practice of government and inter-government authorities overseas
Internet privacy is a global challenge. Dr Bernal’s research has been picked up in a number of countries by governments and legislative bodies, resulting in requests for advice and evidence. At the instigation of Australian academics, Dr Bernal submitted evidence to the Australian parliamentary inquiry into data retention (S8). He was cited in their eventual report, and quoted several times by the Law Institute of Victoria (LIV), the peak body for the Victorian legal profession, representing over 17,000 members, to oppose the currently proposed mandatory data retention scheme in the Telecommunications (Interception and Access) Amendment (Data Retention) Bill 2014 (S9). Australian data retention law remains contentious, however, and Dr Bernal remains involved in the debate. In 2019, Dr Bernal was one of a small number of experts invited by the UK Investigatory Powers Commissioner’s Office (as a result of his work with the Technology Advisory Panel) to meet with the Australian equivalent of the UK’s independent reviewer of terrorism legislation, with a view to providing insight to Australia in their future reform of oversight of surveillance.
Working with NGOs in a new pan-European network to support the advancement of digital rights
In 2019, Dr Bernal was invited to join the Panel of Experts for the new Digital Freedom Fund (DFF), a Netherlands-based grant making foundation that provides support for strategic litigation to advance digital rights in Europe. The Digital Freedom Fund is supported by many of the world’s major philanthropic foundations, including Open Society Foundations, the Adessium Foundation, (J. K. Rowling’s) Luminate, the Ford Foundation, and The Sigrid Rausing Trust. Dr Bernal has already advised on a series of applications for funds, including in 2020 applications surrounding privacy invasions that emerge from governments’ responses to the coronavirus pandemic. Programme Officer of the DFF reported: “For our assessment process, in order to make an informed decision, we rely on an external "Panel of Experts" in the litigation and digital rights field to provide analysis and input on the grant applications received… Bernal was one of the first experts to join the panel, back in June 2018. Since then Paul Bernal has provided important input and analysis on a wide range of grant applications we received, including applications under a special COVID-19 support fund we opened in 2020.” (S10)
Helping to influence a more privacy-friendly approach on the part of major corporations
Major corporations in the finance and technology sectors have also sought advice and evidence from Dr Bernal. This has often taken the form of keynote presentations to business workshops. In November 2018, the Google Global Counsel consulted with Dr Bernal, as part of their corporate review of issues relating to extremist content and privacy and security, including the right to be forgotten (analysed by Bernal both in R3 in 2014 and in R2 in 2018) . This was part of a wider process that led to Google expanding its Transparency Report on the right to be forgotten, and a more general gradual move by Google towards a more responsive approach to privacy concerns.
5. Sources to corroborate the impact
David Anderson QC’s Reports A Question of Trust (2015), p. 56, 214, 223. Accessed 05.02.2021.
Report of the Bulk Powers Review (2016), 1.52, p.17, 18. Accessed 05.02.2021
Investigatory Powers Act 2016, Section 246, p. 215.
Joint Committee on the Draft Investigatory Powers Bill Quotes Bernal’s research on: impact of surveillance (p. 41, 44, 51, 53, 54, 62), invasions of privacy (p. 41, 50, 54, 77), and the need for more effective oversight (p. 82, 118, 167). Accessed 05.02.2021.
Written submission to Joint Parliamentary Committee on the Investigatory Powers Bill, p128 onwards. Accessed 05.02.2021.
Oral evidence to Joint Parliamentary Committee on the Investigatory Powers Bill, p66 onwards.
Minutes of meeting with IPCO Technology Advisory Panel “Metrics of Privacy Conference”
Letters of support from Director of Strategy, Policy and Communications, GCHQ re role in IDEPP, 9.11.2020
Submission to Australian Parliamentary enquiry into Data Retention.
The Law Institute of Victoria (LIV), Telecommunications (Interception and Access) Amendment (Data Retention) Bill 2014. Cited on p.10, 17.
Testimonial from the Program Officer of Digital Freedom Fund, 25.01.2021.