ICO calls on businesses to get their digital house in order

“Commercial players need to win the trust of suspicious and canny consumers who are fed up with being taken for fools by big brands and big businesses with their often opaque and tricky privacy statements,” said the Information Commissioner, Christopher Graham.

Speaking on Tuesday 15 July at the launch of the Information Commissioner’s Office (ICO) annual report, Graham called for organisations from all sectors to regain consumer trust and confidence in how they handle personal information to enable the effective delivery of digital services.

Graham also had a stern warning for the public sector and government: "The Edward Snowden revelations about state surveillance, the botched communications around care data and access to patient records in the NHS and the all-too-common foot-dragging by public authorities around the publication of inconvenient truths about policy and performance – all these serve to make it more difficult to secure the necessary public support for the introduction of new and better ways of delivering public services in the cash-strapped public sector.”

ICO needs stronger enforcement powers, says Information Commissioner
Authority to audit any and all data controllers and public authorities for compliance with information rights (data protection and freedom of information) laws. (At present, the ICO only has compulsory audit powers over public authorities.)

Prison sentences for people who deliberately steal other people’s personal information.

Currently people can only be only fined for this offence under section 55 of the Data Protection Act 1998. The legislation has been amended to allow for custodial sentences but the amendment has not been brought into force. This was a result of lobbying by those working in the media industry, who feared that the introduction of custodial sentences for this offence would interfere with press freedoms. However, the Levesson Report did recommend custodial sentences for this offence following the phone-hacking scandal, and it will be interesting to see whether the Government brings the amendment into force when it implements the recommendations of the Levesson Report.

Lower threshold for Civil Monetary Penalty Notices for breaches of the Privacy and Electronic Communications Regulations (PECR). The ICO is struggling with being able to issue Civil Monetary Penalty Notices for unrequested SMS text messages and live telemarketing calls because of the need to prove substantial damage and distress. The ICO has submitted a business case to the Department for Culture Media and Sport (DCMS) to reduce the burden of proof and the DCMS is expected to issue a consultation paper imminently. http://www.dma.org.uk/news/dma-warns-government-against-delaying-action-nuisance-calls-and-text-spam-complaints-rise

ICO needs better funding
Speaking at the launch of the report, Graham warned: “To do our job properly… we need more sustainable funding.” In the last financial year the ICO has resolved 15,492 data protection complaints – up 10% on the previous 12 months – while calls to its advice line rose by more than 15%. Currently, the ICO’s data protection work is funded by notification fees while the Government funds its freedom of information work. This, however, is not sustainable as the Government has cut the ICO’s funding every year since 2009 and notification fees will be abolished under the current draft of the European Data Protection Regulation. The ICO wants the government to introduce a graduated information rights levy, based on the size of the organisation and the amount of personal information it processes (‘polluter pays principle’).

An independent Information Commissioner
Christopher Graham also called for the Information Commissioner to be made an Officer of Parliament rather than a non- departmental Government body. This would make him/her totally independent from Government.

It will be interesting to see what action the Government takes on Graham’s recommendations particularly as the General Election is only 10 months away.