Head in the Sandbox

The Information Commissioner’s Office recently held a workshop about their proposed Regulatory Sandbox. The idea of the sandbox is that organisations can come to the ICO with new proposals in order to test out their lawfulness in a safe environment. The hoped-for outcome is that products and services that are at the same time innovative and compliant will emerge.

There is no mention of a sandbox process in the GDPR or the DPA 2018. There is a formal mechanism for controllers to consult the ICO about new ideas that carry high risk (prior consultation) but the circumstances where that happens are prescribed. It’s more about managing risk than getting headlines. Unlike Data Protection Impact Assessments, prior consultation or certification, the design and operation of the sandbox is entirely within the ICO’s control. It is important to know who is having an influence its development, especially as the sandbox approach is not without risk.

Although Mrs Denham is not above eye-catching enforcement when it suits her, the ICO is often risk averse, and has shown little appetite for challenging business models. For example, the UK’s vibrant data broking market – which is fundamentally opaque and therefore unlawful – has rarely been challenged by Wilmslow, especially not the bigger players. They often get treated as stakeholders. The sandbox could make this worse – big organisations will come with their money-making wheezes, and it’s hard to imagine that ICO staff will want to tell them that they can’t do what they want. The sandbox could leave the ICO implicated, having approved or not prevented dodgy practices to avoid the awkwardness of saying no.

Even if you disagree with me about these risks, it’s surely a good thing that the ICO is transparent about who is having an influence on the process. So I made an FOI request to the ICO, requesting the names and companies or organisations of those who attended the meeting. As is tradition, they replied on the 20th working day to refuse to tell me. According to Wilmslow, disclosure of the attendees’ identities is exempt for four different reasons. Transparency will prejudice the ICO’s ability to carry out its regulatory functions, disclosure of the names of the attendees is a breach of data protection, revealing the names of the organisations will cause them commercial damage, and finally, the information was supplied with an expectation of confidentiality, and so disclosure will breach that duty.

These claims are outrageous. DPIAs and prior disclosure exist, underpinned both by the law and by European Data Protection Board guidance. Despite the obvious benefits of developing a formal GDPR certification process (both allowing controllers to have their processing assessed, and the creation of a new industry at a time when the UK needs all the economic activity it can get), the ICO’s position on certification is supremely arrogant: “The ICO has no plans to accredit certification bodies or carry out certification at this time“. A process set out in detail in the GDPR is shunned, with the ICO choosing instead to spend huge amounts of time and money on a pet project which has no legal basis. Certification could spread expertise across the UK; the sandbox will inevitably be limited to preferred stakeholders. If they’re hiding the identities of those who show up to the workshop, it’s hard to imagine that the actual process will be any more transparent.

The ICO’s arguments about commercial prejudice under S43 of FOI are amateurish: “To disclose that a company has sent delegates to the event may in itself indicate to the wider sector and therefore potential competitors that they are in development of, or in the planning stages of a new innovative product which involves personal data“. A vital principle of FOI is that when using a prejudice-based exemption, you need to show cause and effect. Disclosure will or will be likely to lead to the harm described. How on earth could a company lose money, or become less competitive, purely because it was revealed that they attended an ICO event (which is what using S43 means)?

The ICO’s personal data and confidentiality arguments are equally weak – everyone who attended the meeting would know the identities of everyone else, and all were acting in an official or commercial capacity. This was not a secret or private meeting about a specific project; anyone with an interest was able to apply to attend. Revealing their attendance is not unfair, and there is plainly a legitimate interest in knowing who the ICO is talking to about a project into which the office is putting significant resources, and which will have an impact on products or services that may affect millions of people. The determination to hide this basic information and avoid scrutiny of the sandbox process undermines the credibility of the project itself, and makes the ICO’s claim to be an effective defender of public sector transparency ever more hypocritical.

Worst of all, if disclosure of the attendees’ identity was the calamity for commercial sensitivity and personal data that the ICO claims it to be, there should be an immediate and thorough investigation of how the information I requested came to be revealed on the ICO’s website and twitter account. The entire event was recorded and a promotional video was released. Several attendees (whose names and companies I cannot be given because of confidentiality, data protection and commercial prejudice) are identified and interviewed on camera, while there are numerous shots of other attendees who are clearly identifiable. Either the ICO has betrayed the confidentiality and personal data rights of these people, putting their companies at direct commercial risk, or their FOI response is a cack-handed attempt to avoid legitimate scrutiny. Either way, I strongly recommend that the left hand and the right hand in Wilmslow make some rudimentary attempts to get to know one another.

Long ago, I was one of a number of online commentators described by the ICO’s comms people as a ‘driver of negative sentiment’. More recently, one of Denham’s more dedicated apologists accused me of being one of the regulator’s “adversaries”. I’m not a fan of the ICO, and I never have been. But this stinks. The determination to throw every conceivable exemption at a simple request to know who the ICO is talking to suggests that the office is afraid of scrutiny, afraid of having to justify what they’re doing and how they’re doing it. The incompetence of refusing to give me information that is on display on their website and Twitter account shows contempt for their obligations as an FOI regulator. The ICO has its head in the sand; as we drift out of the European mainstream into a lonely future on the fringes, their secrecy and incompetence should be matters of concern for anyone who cares about Data Protection.

Out of control

The General Secretary of the Labour Party, Jennie Formby, sent a letter to its Deputy Leader, Tom Watson, this week, expressing concern about Watson’s request that complaints about anti-semitism be copied or forwarded to him so that he could ensure that they were being dealt with properly. Formby outlined concerns about the effect on the complaints process that I am not qualified to answer, but she also raised the spectre of GDPR and Data Protection, and here, I am somewhat sceptical of her arguments.

Formby is right to say that political opinions are classed by the GDPR as special categories data and so require extra protection as compared to ordinary data like a name and address. I’m surprised that she didn’t also mention that many of the complaints would also include the religious or philosophical beliefs of complainants or the complained- about, as well as possibly their racial or ethnic origin. Why Formby didn’t want to highlight the religious and racial dimensions of complaints about anti-semitism is a bit of a poser.

To claim that Watson isn’t taking a risk by soliciting this data when he wasn’t already is clearly false. The best way to avoid Data Protection problems is not to process data in the first place, and as the third GDPR principle requires data minimisation, the safest choice for Watson is to trust the process and not receive any data. The problem arises if he doesn’t, or if he feels responsible for ensuring that it is working. If you think he’s operating purely politically, that’s your choice but I’m going to give him the benefit of the doubt. I’ve already had several heated disagreements on Twitter about this, mainly with people who are certain that he’s going to breach GDPR but uncertain about which particular element is in play.

So here’s my opinion. Tom Watson, in his capacity as Deputy Leader of the Labour Party, can process special categories data concerning complaints about anti-semitism, and Jennie Formby is wrong to argue that he cannot. It’s entirely possible that Mr Watson will follow the GDPR principles to the letter, and it’s entirely possible he will make an almighty cock-up of it. If he does, he should face the consequences. The Labour Party is no stranger to dodgy data dealings – it bought data that had been unlawfully obtained on its behalf by Emma’s Diary for the 2017 General Election, and while Emma’s Diary got fined, Labour didn’t. Sometimes, DP gets breached and nothing happens.

Formby said the following:

The suggestion that you as an individual data controller should receive and store data relating to complaints unrelated to your personal role as an MP, on a private email address, or indeed any other system, is completely unacceptable and exposes you, and the Party, to significant compliance risks.

Like all MPs, Watson is an individual data controller, but only when acting as MP for West Bromwich East and the constituency issues associated with that role. If Watson was acting as an MP and party members chose to forward their own complaints to him, or provide complaints made to them by others, it would be odd, but the Labour Party would not be responsible as Formby claims. Watson would be the controller. However, Watson is the party’s Deputy Leader and it is plain that he was acting in that capacity when he sought to receive the complaints – this is plainly a Labour Party matter, not an issue concerning the fine folk of West Brom.

If something in Labour’s constitution explicitly forbids the Leader or Deputy Leader from having direct involvement in, or oversight of, complaints, Watson has a problem. Formby’s letter clearly sets out her opposition to political involvement in the complaints process, and if she can back that up with a clear reference to the party’s formal rules, any argument that I might make in Watson’s favour is severely weakened. Labour’s formal internal rules have great significance for whether his processing is lawful. But if there isn’t, as Deputy Leader, I can’t see how Watson’s claim to determine the purposes for which the party uses data isn’t valid. In all big organisations, senior people can decide how and why data is used. The controller isn’t one person, it’s the organisation itself, and so logically, more than one person is involved in determining the purposes. If the Deputy Leader isn’t an appropriate person to make these decision, who is? Is it just Mr Corbyn?

There are at least two people’s personal data involved in any complaint Watson wants to see – the complainant and the subject of the complaint. Watson has to justify the processing of the data generally, and if the data is special categories, he has to find an exemption that allows him to process the special data.

If any person chooses to forward or copy their own complaint to Watson or his staff, they plainly consent to him processing their data. He can process any data about their political, religious or philosophical beliefs or ethnicity on the basis of their explicit consent. Watson might struggle to demonstrate he has explicit consent unless the email says ‘I explicitly consent for you to process data about my religion, politics or ethnicity’, but in the real world, it’s impossible to believe that the Information Commissioner or the courts would uphold a complaint from the very same person who forwarded their own complaint. It’s nonsense.

If the complaint is submitted to Watson by a third party, this is more tricky, unless of course the person forwarding or copying the complaint (presumably an MP or other party member) gets consent from the complainant. If that consent exists, Watson is in the clear. If not, he must establish a lawful basis to process the data. In my opinion, he has a legitimate interest in receiving and monitoring complaints about anti-semitism in a party of which he is Deputy Leader, especially when a Jewish Labour MP has just left that party because of anti-semitism. Watson would need to evidence the legitimate interests assessment, but I believe he could make it out. It is surely the role of a Deputy Leader to want to make sure that complaints are being dealt with properly, especially when the issue is as important or potentially damaging as this?

If he doesn’t have consent from a complainant and the complaint contains special categories data, Watson has another hurdle to clear in terms of a special categories exemption. However, the GDPR allows the processing of special categories data in the following circumstances:

processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects

As long as a complaint was made by a current or former member, Watson can argue that his monitoring of the process is carried out in the course of the party’s legitimate activities. Alternatively, he could argue that it is necessary in the substantial public interest. I believe that ensuring that Labour is taking anti-semitism seriously meets that definition, although Watson also needs legal authorisation from the Data Protection Act 2018 to rely on that exemption. The authorisations include ensuring that equality of treatment is maintained (including the treatment of people with specific religious beliefs). I don’t think Watson needs this, but it’s there.

As far as the data of the complained-about goes, Watson plainly doesn’t have their consent and has no hope of obtaining it. However, I believe again that he has a legitimate interest in gathering the data, and if the data includes special categories like political opinions or religious beliefs, he can rely on the legitimate activities exemption quoted above. Once again, if you disagree, it’s worth noting that another exemption from the prohibition on processing special categories is the fact that the person clearly made the data public themselves. Many of the complaints about anti-Semitism come from comments made online or in public meetings and speeches – the meat of the complaint is very likely to concern public statements or utterances from the complained-about. You cannot object to Tom Watson reading a complaint about your tweets because you tweeted them into the public domain.

If Watson goes ahead with this, he has plenty of work to do. I do not believe that any of the above removes the obligations to comply with GDPR’s transparency requirements – everyone whose data he receives needs to be informed about the fact that their data will form part of the complaints process and Watson’s review. The data must be secure, not used for anything other than the complaints process, and of course, anyone whose data is being processed has rights over their data. Given the less than congenial state of intra-Labour relations, it’s not hard to imagine that the Deputy Leader might be left to his own devices should a nasty subject access request come knocking.

Of course, all of this is bollocks. The Labour General Secretary doesn’t really care about Data Protection (neither did her predecessor). This is politics. Anyone who describes their processing arrangements as ‘elaborate’ is making it up as they go along. No political party has a good record on Data Protection, which is why it’s a shame that the Information Commissioner is so shy about taking them on. Even though I believe that Watson wants to root out anti-semitism in Labour’s ranks, I wouldn’t be surprised if part of his aim is to send a message to Formby about the process.

There is, however, a solution to the whole mess, should anyone wish to take it up. If Watson withdraws his request to see all the complaints, Formby could offer to supply him with pseudonymised versions of them. That way, Watson could carry out an appropriate supervisory role, ensuring that this most vital of tasks is carried out efficaciously, but at the same time, no directly identifiable personal data would be made available to him, and he could assure Formby that he would not attempt to identify the parties. The risk would be low, the data would be protected, and surely nobody could object to an elected Deputy Leader keeping a watchful eye on an issue that is so very important?

SPECIAL RULES FOR COMMENTING ON THIS POST

  1. Any comment containing the word ‘Israel’ goes in the bin.
  2. Any comment that is about who funds who goes in the bin.

Thank you, and good night.

The Whole Truth

A couple of days ago, the training company IT Governance reported that the Information Commissioner’s Office had banned Keith Hancock, director of a Manchester lead generation company, from being a company director for four years. The ICO had previously fined the company (Lad Media), and this was the follow-up. All good stuff, you might say, perhaps even a riposte to those awful people who say that the ICO never does anything. Except it isn’t true. The ICO didn’t ban anyone because they don’t have the power to do so. The action was taken by the Insolvency Service with the ICO’s assistance. Weirdly, the IT Governance’s scribe used quotes from the Insolvency Service’s press release without either reading or understanding what it said.

UPDATE: demonstrating the lack of class that is ITG’s hallmark, the story has now been updated without any reference to the fact that it had been wrong, or that they needed me to correct them. This is what it used to look like:

Screenshot 2019-02-15 at 20.04.11

I don’t expect IT Governance to get things right (their sales director once claimed that there had been GDPR fines of 6.2 billion against Facebook and Google), but you’d hope for higher standards from, say, the chairs of four Parliamentary Committees, right? Right? A week or so ago, a distinguished group of Parliamentarians (and Damian Collins) wrote to Jeremy Wright, Secretary of State for Culture, Media and Sport as part of a campaign to change the way the ICO is funded. The idea is that the ICO would get to recover the costs of its investigations from those found to be in breach of Data Protection law, and has been promoted by the Durham-based marketer Russell James. I think it’s a bad idea – it would require the ICO to record and cost the time they spend on every investigation, it could dissuade organisations from appealing ICO decisions (which is bad for everyone as ICO decisions need to be tested), and even where it was applied, it would see the ICO bogged down in arguments about how much they actually spent.

Leaving that aside, the letter itself is amateurish and inept. Several times, it refers to organisations being “found guilty“, something which only happens in criminal cases, thus ignoring the fact that much of the ICO’s work carried out under civil not criminal law. In similar vein, it refers to “data crimes“, a phrase presumably culled from Liz Denham’s misleading soundbite “data crimes are real crimes” (they’re not). This means that the scope of the letter isn’t clear – are they referring to civil breaches (which aren’t crimes), or are they referring to criminal offences, which in the ICO’s world are usually committed by individuals rather than organisations? I find it hard to believe that Dominic Grieve and Yvette Cooper would sign a letter than hadn’t been properly thought out, but as it turns out, they signed a letter that hadn’t even been proof-read. The penultimate paragraph includes a sentence that plainly has words missing “To strengthen the enforcement mechanism, and thus provide maximum credibility to the ICO should be able to recoup the costs of investigations…“, and most damning of all, it opens by describing the ICO as the ‘Independent Commissioner of Information’, which as Neil Bhatia pointed out would be make them the ICI, not the ICO.

UPDATE: a commenter below argues that I should not describe them as ‘civil’ breaches; rather, they should be described as breaches of administrative law. Technically, I think this is correct, although the point I was making is that they are definitely not crimes. I have made the entirely avoidable mistake of listening to the Information Commissioner, who describes them as ‘civil monetary penalties’, e.g. here. I will endeavour not to make the mistake of listening to the ICO again.

Here we have senior Parliamentarians putting their name to a letter that is badly written and incoherent, asking for changes to the funding of a regulator they can’t even accurately name. Russell James told me that the letter was drafted by Tom Tugendhat’s office, but it’s plain that nobody involved in its creation knows anything about Data Protection.

Bullshit is everywhere. In the same week as the ICI letter, Privacy International published a piece responding to Will.I.Am’s well-intentioned but counter-productive ideas about monetising personal data to benefit individuals. The piece included several completely false statements, including that fact that Cambridge Analytica had been fined by the ICO, and that Professor David Carroll had successfully sued the company to recover his data. I took this up with them and they attempted to correct the piece, but in doing so, they made it worse. The correction says “A previous version of the piece implied that Cambridge Analytica has been fined for their involvement in this scandal. The piece was updated on 7.02.2019 to make the text less ambiguous.” The problem with this is that the previous version didn’t imply anything: it said explicitly that Cambridge Analytica had been fined, and they haven’t. The correction goes on to say “The company has been fined for failing to respond to an access request by the Information Commissioner’s Office (ICO)”. It hasn’t. The ICO has prosecuted SCL Elections (not Cambridge Analytica) for failure to comply with an enforcement notice. Despite that famous raid, ICO hasn’t fined Cambridge Analytica or SCL, and the chances that they ever will be are roughly equivalent to me being invited to tea with the Commissioner.

You could be forgiven for asking ‘does it matter’? Does it matter that people get things wrong as long as their heart is the right place? Russell James told me repeatedly that it didn’t matter that the MPs’ letter was full of errors; what matters is that the letter was sent and the wheels are turning. It’s true that pedantry and point-scoring are an unhelpful feature of Data Protection discourse. However, there’s a difference between a conversation and a formal letter or article. More importantly, there’s a difference between pedantry and precision. If you’re talking about privacy impact assessments in the context of the GDPR and I correct you to say it’s a Data Protection Impact Assessment, I’m being a dick. We both know what you mean, and my correction adds nothing. If everyone thinks that the ICO fined Cambridge Analytica when they didn’t, it stops people asking questions about why Wilmslow has spent £2.5 million on an investigation that has resulted in a dodgy fine against Facebook and some mediocre PECR penalties on Arron Banks’ ramshackle empire. If MPs don’t understand the laws that they’re signing letters about, how do we know that they’ve scrutinised the campaign that they’re backing?

The problem is, the Commissioner’s Office are as bad as everyone else and sometimes they’re the source of the infection. Last week, the ICO tweeted that they’d fined Magnacrest Housing, when in fact, it was a court that issued the fine. When SCL Elections pleaded guilty to failing to respond to the ICO’s Enforcement Notice, the Commissioner proudly announced that they had taken action against Cambridge Analytica – although admittedly part of the same group, they’re two different companies, and nobody at the ICO wants to be precise about that because Headlines. The Commissioner herself has repeated the ‘data crimes are real crimes’ claim on many occasions, despite the fact that it’s both misleading and an unhelpful over-simplification. Denham endorsed a book she hadn’t read as “authoritative“, describing its author as someone who “flew the flag for data protection many years before it broke into the mainstream with the GDPR” when he was in fact a PR guy who jumped on the bandwagon.

Denham doesn’t even seem to be overly precise about what her job is – she was quoted by her corporate Twitter account yesterday as saying “What’s technically and legally possible is not necessarily morally sustainable in our society. That’s what the debate is about.” Denham is a regulator – it is her job to enforce the law. As several people have told me since I complained about the statement, Data Protection is principles-based and therefore not as fixed and binary as other areas of the law. I cannot deny this, but even taking it into account, the slippery and complex aspects of DP are still ultimately in the “legally possible” part of the Venn diagram. It’s none of the ICO’s business whether companies do things that are legally possible but morally questionable. If a company breaches DP or PECR, the ICO should take action. Either Cambridge Analytica broke DP law in the UK and the ICO can prove it, or they didn’t. It doesn’t matter that Alexander Nix is a smug gobshite because being a smug gobshite is not a breach of DP law.

We live in an era of fake news where the President of the United States routinely gaslights the world and AI can write prose like a human. The truth matters. Facts matter. Accuracy matters (it’s one of the GDPR principles after all). We all make mistakes. I do it all the time, and the best I can do is hold my hands up and do better next time. But when you’re a big organisation with a much bigger audience than some show-off trainer like me, when you’re an MP asking for a change in how a regulator is run, and especially when you’re charged with regulating something as important as the protection of personal data of 60 odd million people, it matters a lot more. You have to care about the facts because so many people are listening, and you have to take the time to get it right.

And now, in the time-honoured tradition of this blog, I will hit ‘Publish’ and spend the next hour spotting all the typos I’ve made and editing them out before anyone notices.

Bad Policy

On July 19th 2018, Linda McKee made a simple (but admirably polite) FOI request to the Information Commissioner’s Office. McKee asked for a copy of the ICO’s special categories policy document, a requirement of the Data Protection Act 2018 when processing special categories data in certain circumstances. The DPA was passed in early May 2018, but the requirement for special categories policies had been known since the DP Bill was published in September 2017. Policy documents were not required under the previous DP regime, and having run training courses on both the Bill and the Act, I can confirm that many people in the sector were keen to see real life examples of a policy document. McKee’s request made a lot of sense.

On 17 August (maintaining the ICO’s flawless record of replying to FOIs at the last minute), Wilmslow responded. They confirmed that a policy document was held, but as there was a clear intention to publish the policy document in the future, they refused to disclose it. This seemed a bit daft to me; Section 22 of FOI is designed to protect the organisation from early publication of information. The revelation of the ICO’s special categories policy would hardly cause ripples throughout the sector. Staff would not have been diverted from their normal jobs to deal with the torrent of press attention its release would provoke. They should have coughed it up and moved on.

McKee asked for an internal review, and at this point, the Commissioner headed determinedly the wrong way. There is no fixed time limit for an internal review, which is a flaw in the legislation but nevertheless not something that the organisation should exploit, and the ICO dragged it out for MONTHS. I have to be honest, I didn’t really pay attention, aside from using the ICO’s inability to release a relatively simple document as a gag on my DPA courses. Towards the end of 2018, I checked back in on McKee’s woes, to see an interesting suggestion on the What Do They Know thread. It seemed that when the ICO replied in August, the policy hadn’t actually been finalised.

I couldn’t quite believe this, so over Christmas, I made an FOI request to clear the matter up. I asked whether the policy was held in a final approved form when the ICO replied to McKee in August, for any recorded information about whether the ICO should actually have replied that the policy was not held (because it was not finished), and for a summary of why the ICO refused the request.

And here, a brief interlude to consider a section of the FOI Act that has tantalised FOI experts for years without resolution. Section 77 makes it a criminal offence for the organisation to alter, deface, block, erase, destroy or conceal any record held by it with a view to frustrate its disclosure. So if I am working for a public authority and I pretend that a record isn’t held in order to prevent an FOI punter from receiving it, I have committed an offence. If the organisation conspires in this, the organisation can itself be prosecuted by the Commissioner.

Back to my request to the ICO. They replied (once again, remarkably close to the 20 day deadline), and told me two interesting things. First, in answer to my question about whether the policy was held in a final approved form: “The policy was not held in final approved form“. Second, any recorded information about whether any data held constituted the requested information, or whether the ICO should in fact responded that the information was not held: “We do not hold recorded information. As you will be aware the Freedom of Information Act only covers recorded information held by a public authority. However, it may help you to know that there was a verbal discussion in regard to the response to this Freedom of Information request.” So, there was a verbal discussion that people plainly remember, and the ICO thinks it might help me to know this, without even a squeak about what the discussion was about. Thanks, Wilmslow, consider me unenlightened.

I believe that the ICO’s response to McKee’s request is untrue. The correct answer to her request is ‘no information held’, with advice and assistance that the data was in draft. Section 22 applies where the requested information exists but the organisation intends to publish it unchanged in the future; the ICO’s policy wasn’t complete. Look at what McKee asked for all those months ago: she asked for “your Policy designed to show compliance with Schedule 1, Part 4 of DPA 2018“. An incomplete, unapproved policy plainly does not answer the request, and the ICO should have confirmed that. The use of the exemption was a dishonest dodge to avoid admitting the truth.

If the ICO had a policy and pretended that they did not, under Section 77 it would have been a criminal offence for them to conceal its existence once it had been requested. As it happens, the ICO did the opposite – pretending that the information existed and refusing to give it out because it would be published in the future, rather than admitting that several months after the DPA was passed, the policy was not complete. Whoever decided that this was the right approach should think long and hard about a transparency regulator taking such a cynical attitude to legislation they are supposed to uphold and protect.

While QE2 tries to grab the headlines, demanding that FOI be extended to cover new organisations, her own house is far from being in order. The lack of FOI enforcement against recalcitrant and secretive government departments is an ongoing stain on the ICO’s reputation, while the lazy cynicism and lack of frankness over the office’s own activities suggests that the ICO can talk the talk, but walking the walk is beyond them. Regular readers of this blog are probably inured to my lack of faith in House Wycliffe, but for all Denham’s chasing of headlines, day to day experience of how the ICO carries out the most mundane of its functions suggests carelessness and disarray. Rather than trumpeting the press releases about extending FOI to charities and commercial bodies, more people should ask whether the ICO is capable of doing even those tasks it already has.

A case in point(lessness)

The Information Commissioner did a bit of business in Hendon Magistrates’ Court recently, as SCL Elections was fined £15000 for breaching an enforcement notice. Long ago, Professor David Carroll made a subject access request to Cambridge Analytica. As Cambridge Analytica was based in the US where SARs do not apply, they passed it to SCL Elections, a related company established in the UK, to process his request. Having received a response, Carroll claimed it was inadequate and complained to the ICO. After some correspondence, SCL and Cambridge Analytica went into administration. The ICO then served SCL with an enforcement notice over Carroll’s SAR, and SCL failed to comply with or appeal it.

On the face of it, it’s a win – fines in the Mags for breaches of ICO notices are usually in the low thousands, and after more than a year of a multi-million-pound investigation into data analytics, this seems a rare example of something actually happening. Following the humiliation of the first GDPR enforcement notice against AIQ, which had to be withdrawn and replaced, and the Facebook £500,000 penalty which was immediately appealed, you could argue that it’s a solid result for Team Wilmslow.

But the ICO reaction is weird – their website misleadingly claims that SCL was ‘also known as Cambridge Analytica’. SCL was a shareholder in Cambridge Analytica but the two companies are separate and based in different countries. Moreover, the ICO press release states “In pleading guilty, the company has accepted it should have responded fully to Professor Carroll’s subject access request and the ICO’s notice in the first place” but this is not what reality suggests. SCL’s guilty plea was helpfully tweeted out by Denham’s hagiographer Carole Cadwalladr, and it clearly says that they were pleading guilty to failing to answer the notice, not to any ‘misuse of data’.

Denham seems stuck in the past. This prosecution is, she says, ‘the first against Cambridge Analytica’ and her comment implies it won’t be the last, despite the fact that both SCL and Cambridge Analytica are being wound up. Since May 2018, the ICO’s needle on GDPR has barely twitched beyond that abortive AIQ notice, but the noise on analytics has been deafening. Whatever Cambridge Analytica did back in 2016, a massive change like GDPR requires a Commissioner completely focussed on implementing it. Stories about delays and poor decisions at the ICO are rife in the Data Protection community at the moment; the ICO can’t even keep its website up and running, and yet Denham seems dedicated to fighting old battles like a Japanese soldier lost in the Pacific who doesn’t know WW2 is over.

I can’t see what the SCL case has achieved. Carroll has trumpeted the criminal nature of the prosecution, claiming it proves that CA was a ‘criminal enterprise’, but the case is a relic. Under GDPR / DPA 2018, ignoring an enforcement notice is no longer a criminal offence and so there will never be another case like this. SCL might have pleaded guilty, but the substantive question of whether they gave Carroll all the data he was entitled to remains unresolved. They didn’t admit that they hadn’t, and the court cannot order them to deliver any outstanding data even if the judge thought that they should. The punishment for ignoring an enforcement notice can only ever be a financial one – a fine on conviction under the old rules, a penalty from the ICO under the new. The ICO must have known this going in.

The idea, of course, is a data controller will comply with an enforcement notice rather than face the possible punishment, but when the ICO served the notice on SCL, they were already in administration, so they were unlikely to respond in the normal way. Indeed, as the administrators confirmed, the prosecution was only possible because they gave ICO permission to take it forward. In a bizarre twist, the administrators’ guilty plea also revealed that data relating to Carroll isn’t in their possession – it is stored on the servers seized by the ICO on the celebrated Night of the Blue Jackets. So we’re in the bewildering position of the ICO starting enforcement on a defunct company, aware that the enforcement in question cannot result in any personal data being disclosed, and in the full knowledge that any relevant information is actually in their possession. It’s DP enforcement designed by MC Escher. You have to wonder why ICO didn’t just give Carroll his data themselves.

Underneath the surface froth, there are some interesting issues. SCL’s approach to the ICO (as set out in the enforcement notice) is an exemplar in how not to deal with a regulator. In my former life as a Data Protection Officer, I was guilty of a ‘make them blink first’ approach to ICO case officers, but I never did anything as stupid as to make comparisons to the Taliban in my correspondence, or to demand that the ICO stop harassing my employer. More importantly, SCL committed a glaring tactical mistake by switching their approach mid-race. Initially, they answered Carroll’s request, but then u-turned into a claim that his request was invalid because he was a US citizen (hence the remark that he was no more entitled to make a request than a member of the Taliban). In my opinion, had they stuck to their guns and argued that there was no more data, the case would have been less appealing as an enforcement issue. In deciding to change tack, the onus is on them to convince the ICO of the change, rather than getting all holier-than-thou.

Equally interesting is Carroll’s claim that he should be treated as a creditor of the business, which he outlined to the FTProf Carroll argues that the data originally held by Cambridge Analytica actually belongs to the users and should be returned to them, despite the insolvency. “I am a data creditor — just like the financial creditors,” he says. “There are outstanding obligations to me.”

I think this argument is nonsense, but the idea that data subjects own their data is a popular myth (revived with enthusiasm by the introduction of the GDPR). The problem / advantage with personal data is that it can be easily and quickly replicated; I can take a copy of your data without your permission, but unlike a conventional theft, you still have it. You can get access to the data I hold about you under a SAR or portability, but once again, I give you a copy and keep my version. Only in limited circumstances can you request that I delete it, and there are many exceptions.

Admittedly, GDPR gives the subject more control over their data than before, but it doesn’t give them ownership. It’s misleading to suggest that a data controller doesn’t really own personal data when there are so many circumstances where they can obtain, disclose, retain or destroy it without the permission of the subject, and when the opportunities for the subject to object are so limited. I don’t think Carroll understands this, but it would be interesting to see his ‘creditor’ notion tested.

Teasing this out might have been a justification for the ICO to enforce on SCL, except for the obvious fact that these issues would never be raised by doing so. If SCL hadn’t pleaded guilty, the question for the court would be whether SCL breached the notice and nothing else. Because SCL made no attempt to comply with or appeal the notice, they never had much to argue about. The enforcement notice was remarkably misguided considering ICO actually holds the data, but it is a tribute to SCL’s ineptitude that they didn’t choose to highlight this by appealing.

According to Carroll, the fight goes on with other cases, so his beef with SCL / Cambridge Analytica might one day result in something interesting, but there’s nothing here. I don’t believe that the ICO has any business enforcing Data Protection on behalf of Americans when they’re so lackadaisical about doing so on behalf of people in the UK, and so this case is an almost offensive waste of resources. But even if you disagree, all they’ve achieved here is given the corpse of SCL a good kicking, with a result that doesn’t tell us anything about the future or very much about the past.