ICO 'free to warn Whitehall' after move from Ministry of Justice

The UK's data privacy watchdog, the Information Commissioner's Office (ICO), has been freed from the control of the Ministry of Justice.

Department for Culture Media & Sports: sponsors the ICO
Department for Culture Media & Sports: sponsors the ICO

PM David Cameron announced last Thursday that ‘sponsorship' of the ICO has moved from the MoJ to the Department of Culture, Media and Sport (DCMS).

The change comes just days after the ICO launched a probe into the MoJ for “unacceptable” delays in answering freedom of information requests.

The ICO is joining another key independent watchdog, communications regulator Ofcom, under the wing of the DCMS. Information Commissioner Christopher Graham said the switch supports its need to be free to police government departments.

Graham said: “As the independent arbiter for information rights, we need always to be able to speak up for citizens and consumers. It is important that the ICO remains free to advise and to warn different Whitehall departments as necessary. We need independence to do our job.”

Stewart Room, a data protection expert and partner at PricewaterhouseCoopers Legal LLP, agreed the change supports the ICO's need to remain independent of government – and dismissed concerns that it might reflect a reduction in its importance.

He told SCMagazineUK.com: “The ICO must be independent of the Government as matter of law. I actually think it serves the purpose of the independence of the regulator to change the sponsoring department from the Ministry of Justice – there's a lot of logic in the move to the DCMS.”

Room added: “Some people are trying to make out it's a downgrade of the importance of the ICO but I don't believe that for one moment. It's a complete red herring.”

The switch means the Culture Department will also take over responsibility for the UK's policy on data protection – at a time when controversial new Europe-wide data protection laws are being hammered out.

Under the regulations due to take force in 2018, companies who breach data privacy laws could be fined up to two per cent of their annual turnover.

The UK Government is fighting to curb the Directive's commercial impact on UK businesses – and says the ICO's change of ‘ownership' will not alter that.

“This will be a seamless shift of responsibility which will not affect delivery of the Government's objectives,” a spokesperson told SCMagazinUK.com via email. “The Government continues to be committed to strive for the best deal in Europe for UK businesses and to maximise the potential of the data-driven economy.”

All the data protection policy teams working at the MoJ will move to the DCMS and Christopher Graham said: “This gives me added confidence that the DCMS will be well prepared to cope with the demanding agenda ahead.”

The ICO's switch to ‘ownership' by DCMS came days after it launched a formal investigation into the Justice Ministry's failure to answer UK citizen's requests for information on time in “a significant number of cases”.

The ICO will examine the Justice Ministry's performance from September to November after the latest MoJ statistics showed the number of cases where it answered information requests inside the statutory 20-day time limit were “well below 85 percent” – a trigger for possible formal monitoring.

ICO deputy commissioner Graham Smith said: “We hope the Ministry of Justice uses this monitoring period to bring about significant improvements in this aspect of its service to the public.”

In a recent blog, Smith predicted the new pan-European data protection law will come into force in 2018. “Negotiations are very much ongoing, but if all goes according to plan, we'll know pretty much what's going to be in the Regulation by the end of this year,” he said. “On the most optimistic forecasts, the Regulation will be in force in June 2018, though end of 2018 might be a more realistic prospect.”

The European Commission says: “Data protection reform will address lack of trust and strengthen citizen's rights such as the right to be forgotten, the right to data portability and the right to be informed of personal data breaches.

“The reform gives national regulators enforcement powers to ensure that these new rules are properly applied. They will be able to impose fines of up to 2 per cent of a company's annual worldwide turnover.”

Meanwhile, the EU has finalised negotiations with the US on a data protection “umbrella agreement” earlier this month. On 8 September, Věra Jourová, EU Commissioner for Justice and Consumers said, "I am very pleased that today we have finalised negotiations with the US on high data protection standards for transatlantic law enforcement cooperation.”