Information Commissioner
November 2018
The Information CommissionerI think I’ve fallen for the Information Commissioner, Elizabeth Denham.
You may not know her name, but her job is to make sure that we all obey the rules relating to the management of other people’s personal data. This may seem like a dry subject but it is terribly important, and I think Miss Denham is doing an excellent job, despite the usual mixture of ignorance and lack of funding from the government.
She is my favourite sort of public servant: highly educated, articulate, experienced in her field, unfazed by the attempts of politicians to influence her, happy to ruffle important feathers and above all determined to do the right thing for the public, whose data she is protecting. She aims indiscriminately at big and small; one small ‘data broker’ was recently fined £140,000 for collecting and selling personal information to the Labour Party and the massive BT had to cough up £77,000 after sending five million nuisance emails. TalkTalk paid a £400,000 fine for exposing customer data for all to see.
She is not swayed by the eminence of the transgressor; the great and the good are treated with equal firmness. She fined The British and Foreign Bible Society £100,000 for a data breach, and even the Independent Inquiry into Child Sexual Abuse incurred a £200,000 fine for sending emails that identified possible victims of child sexual abuse. Gloucestershire Police paid £80,000 for something similar.
Most tantalisingly, her team is currently investigating the use of data analytics in political campaigns (Cambridge Analytica and the rest), and I fully expect fireworks, large fines and red faces when it is complete.
Her background for the job is spot on, having performed similar roles in her native Canada where she forced both Facebook and Google to change their practices. To our shame, she had to take a reduction in salary to work here. She earns about £160,000 pa; Ofcom and the Financial Conduct Authority (FCA) have similar regulatory responsibilities and their heads earn £350,000 and £450,000 respectively.
Her budget is also too low; on an annual income of only about £25m, she must regulate about a dozen pieces of legislation. Ofcom receives over £200m and the FCA over £600m.
This is a disgrace because there is little doubt that data is a commodity that is becoming more and more valuable and the scope for misuse is growing fast. The greater the supply of data, the more that can be extracted from it and hence the more valuable it is.
Miss Denham’s guiding principle (I suspect this has come from her, not from Whitehall) is that she wants us all to feel more comfortable about what is happening to our personal data because it is just that: personal. She believes (as does the law, now) that unless you specifically say otherwise, your personal information is your property, not a commodity to be harvested and traded, and she is prepared to fight for that position.
I’m glad she’s on our side, not least because whilst there is no doubt that she is more than ready to wield a big stick, much of her organisation’s efforts are devoted to education and guidance; preventing a problem always being preferable to clearing up a mess.
Partly because of her efforts even the most Luddite and ill-informed managers are finally starting to take data security seriously, rather than just leaving it to the boffins in the back room.
That said, a visit from her enforcement officers is already something that causes shudders in boardrooms, especially with the slight element of theatre involved; her enforcement staff swoop in wearing bright blue jackets with the ICO logo all over them and have already become nicknamed ‘the data cops’.
Surely a TV series cannot be far away.
Some links that add some information
You can read all about the Information Commissioner’s Office on its excellent website: https://ico.org.uk/
You can download the ‘Investigation Update’ into their investigation into data analytics in political campaigns with details of some of the organisations and individuals under investigation, as well as enforcement actions so far. Click here
There is a selection of short videos and seminars (or ‘webinars’ as they are known) that explain many of the issues involved on their YouTube channel: Click here
