ICO conference: all change for data protection

With the greatest reform to data protection law in two decades looming, this is a decisive time for data professionals, the Information Commissioner, Christopher Graham, told over 800 data protection officers at the annual ICO Data Protection Officer Conference on 5 March 2013.

The draft EU Data Protection Regulation, due to come into force in 2016, was high on the agenda at the conference. Graham warned that the current draft is highly prescriptive and would be expensive for the Information Commissioner’s Office (ICO) to administer. “The ICO would also have to shift its focus towards processes and permissions with less emphasis on the advice and guidance role the ICO has traditionally championed,” he added.

Francoise Le Bail, Director General for Justice at the European Commission, had some good news for marketers. In her keynote speech, Le Bail said that the Commission was listening to concerns from businesses and regulators alike and that it was prepared to discuss and introduce a risk-based approach to data protection. She also confirmed that the Regulation would be less prescriptive and administration burdens would be eased on business under 250 employees.

In response to Le Bail, the Deputy Commissioner, David Smith, supported the idea of reforming data protection legislation and improving the rights for individuals. But he stressed the need to come up with a practical, proportionate and sensible package.

The ICO highlighted its funding challenges as it launched its corporate plan for the next three years: “We have to work together with partners, customers and other regulators to deliver the biggest result for our limited and stretched resources.”

Graham said a highly prescriptive regulation would be expensive for the ICO to administer, especially if the current proposal to end universal notification survived the legislative process. (The ICO’s data protection work is currently wholly funded by notification fees.)

What the ICO likes about the proposed data protection reform

• Necessary modernisation
• Enhanced rights for individuals
• Legal obligations on [data] processers
• Accountability and other new concepts
• Code of conduct and certification
• Stronger supervision and sanctions
• Improved consistency across the EU

The conference delegates enjoyed workshop sessions on a variety of topics, from data-sharing, anonymisation and the reform of data protection legislation, to privacy by design and marketing.

For the first time, the conference also featured an Information Market, where a range of exhibitors across the data spectrum were on hand to inform and discuss with delegates the data issues facing UK business. There were a number of ICO departments on hand together with companies and initiatives, including Tell Us Once, Anonymisation Network, Think Privacy and the DMA.

The conference drew to a close with a “Question Time” session where the senior management team at the ICO answered questions from delegates, and a final word from the ICO Commissioner. You can see the highlights of the ICO Data Protection Conference, including Tweets and video clips here.

Janine Paterson, Solicitor, DMA