ICO has slightly changed the emphasis of its work



John Edwards, Information Commissioner, said that he has slightly changed the emphasis of the ICO’s work in his first year in office.

Addressing the IAPP UK Intensive in London yesterday, he explained that the ICO is not keen to pursue the minutiae of technical compliance in every case if it sees that pursuing an issue further would in fact bring no benefit to citizens.

Consequently, he has stopped investigations when not considered as a good use of limited resources.

  • His team investigated complaints that an AI-Assisted Benefits system led to prejudiced decision-making. However, on investigation, his team found no evidence of discrimination in the algorithm.
  • The ICO received 70 complaints that the DVLA had shared data with car park companies. On investigation, his team agreed with the DVLA’s actions but not on the legal basis for them. As a result, there was no point in devoting more resources to the issue.

On some issues, he reserves the ICO’s decision, as he explained that he cannot pursue every case beyond what is proportionate to the subject matter.

Edwards told the audience that he is “humanising our work” by addressing communities previously neglected which he described as “communities of unmet need.” His example was victims of rape and serious sexual assault. Police handling of such cases can often result in “digital strip search of a victim.”

Edwards has also devoted time to new subjects, such as guidance on User Experience (UX) and also on Gaming Design to encourage companies to make them compliant with the ICO’s Children’s Code.

He has taken on the role of Chair of the Digital Cooperation Regulatory Forum which brings together several regulators with responsibilities in the digital sphere.
Routine work continues - half of the approximately 40,000 complaints a year to the ICO are about Subject Access Requests (SARs). His focus is on “regulating for outcomes” and he uses the full range of the sanctions available to him. As a “graduated response”, he has issued seven public reprimands to organisations for not responding properly to SARs. His message to business is that “non-compliance with data protection law is not profitable.”

Responding to the government’s emphasis on data sharing for innovation, in the last year the ICO has launched an Innovation Advice Service, as to help the whole economy to thrive.

Making only one oblique comment on the government’s new Data Protection and Digital Information Bill, announced yesterday, his summary was “Our aims are not dependent on what the new law says.”

Lastly, Edwards confirmed that the ICO will appeal the First Tier Tribunal’s judgment in the Experian case.

PL&B will report further on the UK Data Protection and Digital Information Bill (no 2) in Privacy Laws & Business UK Report.

The Experian case will be the subject of a session at PL&B’s 36th International Conference Who’s Watching Me?