ICO launches consultation on stronger regulatory action and continues with its micro-targeting investigation

The Information Commissioner today launched a consultation on stronger powers which are written into the Data Protection Bill currently going through Parliament. The Report stage in the House of Commons has been scheduled for 9th May.

Proposed new powers include no-notice inspections, compelling people and organisations to hand over information and making it a criminal offence to destroy, falsify or conceal evidence. The ICO’s ability to use many of its powers, including going to court to request a warrant to search a premises, is based on the UK’s domestic legislation, not the GDPR.

The policy also covers all 11 pieces of legislation that the ICO is responsible for including the Freedom of Information Act and the Privacy and Electronic Communications Regulations which covers nuisance calls, texts and emails.

The proposed policy reinforces the ICO’s commitment to a proportionate and risk-based approach to enforcement. The power to levy penalties of up to 4% of global turnover or £17 million, whichever is greater, has come through the General Data Protection Regulation (GDPR) and has attracted much attention. But a wider range of other powers for the ICO will be introduced by the new Data Protection Bill currently before Parliament, and will be the ones deployed most frequently.

The Information Commissioner in March had to wait four days to persuade the court to grant a warrant to enter and search the premises of Cambridge Analytica in its linked Facebook political micro-targeting investigation. This delay brought the ICO’s insufficient powers to the government’s and public attention in this high profile case. The ICO needed to quickly secure the evidence to conduct its investigation to see how personal data is actually being used and managed.

James Dipple-Johnstone, Deputy Commissioner said: “Our approach is designed to protect people’s information but also ensure that business is able to function and innovate in the digital age. We’ll target our most significant powers on repeated, wilful or serious failures to take proper steps to protect personal data and deliver information rights. Our formal regulatory action will serve as an important deterrent where it needs to.”

Will the closure of Cambridge Analytica stall the ICO’s investigation?

On 2 May, the ICO announced: "The ICO will continue its civil and criminal investigations and will seek to pursue individuals and directors, as appropriate and necessary even where companies may no longer be operating. We will also monitor closely any successor companies using our powers to audit and inspect, to ensure the public is safeguarded."

The consultation closes on 28 June. The revised policy will be subject to Parliamentary consideration and final approval.