Just over a month ago, I enjoyed a series of bad-tempered Twitter exchanges with Benjamin Falk, Founder and “Chief Talker” of the personal data outfit Yo-Da. Falk has an interesting perspective on Data Protection. Instead of coming to DP through the traditional routes of information management, security, governance or the law, Falk is an ‘information economist’. He doesn’t see the subject as an issue of human rights, instead looking at it through the prism of economics. Because Data Protection is concerned with information, and there are other contexts where information is a commodity traded in a market, Falk has had the revelation that the processing of personal data is just another market, and this is the only way to understand it. Falk perceives this market as a ‘dumpster fire‘, and he alone has the solution. He has founded what he calls the “world’s first Personal Data agency” and hopes to lure people into signing up for an ill-defined service that he asserts will put them in control of their information. Somewhere along the way, money will be made.

Falk has some eye-catching ways to explain the ‘market’ he seeks to disrupt:

“personal data is best understood as a newspaper that we publish about ourselves, whether we like it or not“.

Sometimes, he thinks personal data is “a really really boring autobiography, it’s just information about yourself written down somewhere“.

Falk’s view of data subjects is that they are “an author with an information rights management problem”

I can imagine that if a person had, say, an AI program and they had to persuade gullible investors to buy into a wheeze that hadn’t really been worked out properly, this kind of eye-catching guff might get them going. However, it’s nonsense. Most personal data isn’t published or created for public consumption like a newspaper (indeed, many people have laboured for years under the misapprehension that personal data in the public domain isn’t personal data at all). Equally, a lot of personal data doesn’t fit Falk’s favourite analogy of a ‘robo-biography‘ because it is generated by people and not machines. You can’t simplify a million different controllers doing things for themselves in a million different ways. It’s complicated.

As Yo-Da’s website says, users will be able to “discover, fetch, control and erase” personal data from “any company operating in Europe”. However, the first thing you see on Yo-Da’s homepage is the following: “who earns from your personal data? everyone but you“. Falk also wants people to monetise their data. There’s not much detail however, making me wonder Falk has got this far by saying ‘AI’ a lot without a clear idea of how that will translate to the power he claims to put in subjects’ hands. After all, in order to work, Yo-Da needs to be able to successfully obtain and amalgamate data held on millions of different systems, in thousands of formats, processed for a host of different reasons by a multitude of businesses as varied as Apple, Tesco, 2040 Training and the Friendly Furry Shop. I’d like to see this in action.

The idea of individuals monetising their data is common to survey platforms like YouGov and CitizenMe, while Paul Olivier-Dehaye has been touting the automation of SARs and other data rights for years. A mock-up of the Yo-Da app shows data obtained from Starbucks (including how many coffees the user has drunk) with a suggestion at the bottom that this data be combined with that information from Transport for London or NHS England. Rather than selling data at scale like most data brokers, Yo-Da seems to encourage subjects to obtain vast quantities of data about themselves (the app shows a user having obtained data from 1200 companies) to create a “rich personal database” which presumably the user will then sell with Yo-Da’s assistance.

Falk’s ambitions are not limited to data monetisation. Yo-da, he claims, will stop subject’s rights from being infringed. The ‘dumpster fire’ of poor data protection practice in the UK is the fault of greedy consultants like me who ensure that our clients don’t actually comply with the law so we can keep charging them. Like Hercules diverting rivers to sluice the Augean stables, Falk’s tweets demonstrated a belief that Yo-Da will wipe Data Protection clean. Solving DP’s many problems is “easy to do“, he says, it’s just that nobody has actually tried (take that, Liz Denham). I don’t see how, but even if you believe that Yo-Da’s data jumble sale could change the face of DP forever, it can surely only do so if millions of people participate. Even if thousands of people sign up, Yo-Da will barely scratch the surface of how much personal data is processed across the UK and the EU. People will still be obliged to provide their data to pay their taxes, claim their benefits, use the NHS, set up a bank account or a mortgage, or be employed. The ability to get a slice of your data (it won’t be all of it) and possibly hawk it to dodgy data brokers (about the only people who I can imagine might buy it) won’t change that, and would do nothing to stop DeepMind, lost discs, the Met Police’s use of facial recognition or hospitals letting TV companies film vulnerable women without consent.

Moreover, just imagine how Yo-Da could go wrong if it actually works. At the moment, the fact that the different aspects of your life are often held in silos is wholly to your advantage from a data protection perspective. Capitalism is trying to connect the various loose ends of your life, but there are limits.  As a middle aged man with middling health, the NHS doesn’t know how often I drink coffee at Starbucks, or how regularly I get the Tube in London rather than using a TfL bike (I would like to confirm to my GP that I never drink coffee in Starbucks and I have only used the Tube once this year on my many visits to the capital). But what else could be added? Could Yo-Da include how many orders from Beers of Europe I make? How often I go to SoLita for a burger? Yo-Da is selling a seductive idea – one might almost paraphrase it as ‘take back control’, but it probably contains the same risk of unintended consequences as that rancid propaganda. Falk positions his company as the saviour of privacy rights, but he’s encouraging people to conspire in their own exploitation by creating an intrusive and potentially prejudicial data cocktail and then flogging it to the highest bidder.

I’m ignoring the practical problem that the key to driving his plan is subject access requests, and SARs rarely provide a seamless, rich repository of information, ready to be amalgamated and exploited. SAR disclosures are often messy and incomplete, a patchwork left behind by the removal of third parties and exempt data, and often delivered in PDFs. Only data supplied direct to the controller by the subject or obtained under observation has to be supplied in a portable form. There are legitimate reasons to refuse requests altogether. Falk has asserted repeatedly that “ownership and rights mean the same thing“, and so subjects own their data, but this won’t be any help to his business model. Subjects own the copy of the data that they receive from their SAR, but that doesn’t give them automatic access to any and all data held. They don’t own the data held by the controller. The promises of control and erasure made on the Yo-Da website are embarrassingly simplistic – you can’t object to a controller processing your data under contract or legal obligation or ask them to erase the data. They can resist an erasure request because they need to establish, exercise or defend a legal claim. Only someone who doesn’t understand how limited the GDPR rights of objection are would make the grandiose claim that “Yo-Da… lets you control who processes your information“. No, it doesn’t. It never will, because the GDPR doesn’t do that.

I think Falk’s claims are hype and his understanding of data protection is fundamentally flawed. Moreover, I don’t trust him. During the period that I spent arguing with the Yo-Da Twitter account, it became clear that I wasn’t just dealing with one person. There were two distinct personalities, inverted versions of the dual identities in Hitchcock’s Psycho. The Norman Bates character – relentlessly polite no matter what the provocation, endlessly ingratiating – is fake, a bot unleashed by Falk to fool people into thinking they’re dealing with a real person. Mrs Bates – the bitter, angry and resentful persona that occasionally lashes out – is real, presumably Falk himself, unable to let the upbeat-to-the-point-of-being-deranged program do all of the talking. Falk called me a jerk for accusing him of being a bot when actually, he was just being “unswervingly polite“. In the end, he had to admit that I was right and that he was using a bot. Ethics is Data Protection’s flavour of the month, and I’m not sure that such duplicitous behaviour will fit in.

Despite the fact that Yo-Da hasn’t launched yet, the website mysteriously features testimonials from happy users, while one of the three case studies highlighting how the service works using happy Yo-Da customers is actually just Falk himself. Falk wants to charge people to use their DP rights. Somewhere in our bickering, either Falk or the bot told me that Yo-Da would be a monthly subscription based on what users can afford, but there’s no hint of that on the website. It’s the same model that Dehaye originally proposed for PersonalData.Io – just as GDPR makes personal data rights free in most cases, in come some chancers hoping to charge you for using them. And I have one last piece of evidence that when it comes to upholding data protection, in giving people “transparency into this secretive ecosystem“, Falk isn’t the champion of data rights he purports to be.

After five days of arguing and provoking whoever / whatever was running the Yo-Da account, on June 4th, I made a subject access request to the company via the Data Protection Officer’s email address on the Yo-Da website (i.e. the specific address they direct you to make SARs to). I explicitly ruled out any personal data processed on the public Twitter account – that is available to me already and besides, I’ve already seen it. I wanted to see any direct messages, emails or other correspondence generated by my spat with Falk and his bot. Of course, there may not be any data at all. It’s quite possible that Falk didn’t talk to anyone about me or what I was saying, but he could have done. Several times, I questioned the fundamentals of Falk’s interpretation and I also asked whether Trilateral Research, the consultancy he has engaged to be Yo-Da’s DPO, agreed with his views. I wouldn’t be surprised if Falk contacted them about what I was saying, or just complained to his colleagues about what a jerk I was.

However you slice it, the deadline for compliance has passed, and Yo-Da has not responded to my request. I have received no data, no confirmation that data is not held, no request for ID, not even an acknowledgement. Nothing, nada, zip. Benjamin Falk proclaims that he seeks to land a knock-out blow for data subjects through the use of the GDPR rights, but the vehicle for this glorious revolution can’t even be arsed to answer a simple SAR. I wondered before why Trilateral wanted to be associated with Falk’s hyperbolic nonsense, but now he has coupled it with contempt for the law he claims to defend, I wonder if they’ll think again? In any case, everyone who receives one of Yo-Da’s SARs when the service launches knows what they can do.

Ignore it, you can.

The first time I read the GDPR properly, something leapt out at me. For years, the received wisdom about the subject access and other rights provided by the legislation was that they were ‘applicant blind’. You could ask the person for assistance in locating their data, but you could not ask them why they were asking. Even if you knew that the person wanted to wind you up, you had to ignore that. When I got to the GDPR articles about subject rights, it struck me that this was no longer the case.

The relevant text in the final version (Article 12.5) is as follows:

For years, the failed FOI campaigner Alan Dransfield has been sending angry emails and complaints to various people at the Information Commissioner’s Office, usually late at night. I know this because as well as copying in various journalists, news organisations, and politicians, he also includes me. It’s hard to know what Dransfield hopes to achieve with these screeds, which blend an aggressive misreading of how the law works, defamatory accusations against ICO staff and RANDOM words in CAPITALS. Usually these emails come out of nowhere, but his most recent missive was in response to an email from the Information Commissioner, refusing to answer a subject access request he had made to them.

If you ever wanted an extreme case to test the limits of what is acceptable, it’s Dransfield. The ICO’s refusal says that since April 2016, Dransfield has sent them over 120 requests for information under the Data Protection Act 2018 (DPA 2018), the Freedom of Information Act 2000 (FOIA) and Environmental Information Regulations 2004 (EIR). In addition, the email contains this remarkable statement:

since May 2018 we have received in excess of 290 items of correspondence from you. Many of these communications have included unsubstantiated accusations of the ICO’s complicity in various crimes and have targeted members of ICO staff with the intention of causing distress

The ICO refusal points out that having previously refused his FOI and EIR requests as vexatious, they are now no longer even acknowledging them because they are about matters which have been dealt with (something which FOI plainly allows). They then go on to say this:

Your requests for information under Article 15 of the GDPR appear to be similarly motivated. We consider that these requests are not made to legitimately establish what information we hold and how we are handling your personal data, but part of a campaign to challenge the decisions that have already been concluded within due process

As well as copying me into his legally illiterate complaints, Dransfield sometimes emails me direct to call me a dickhead or spew out misogynistic and homophobic abuse, but it’s clear that ICO staff have it much worse than me. He’s a toxic character who thrives on causing discomfort and outrage. You might say that if ‘unfounded’ works on him, it’s only because he’s such an extreme case. But Dransfield is not alone. There are other vexatious, unpleasant people whose SARs will be made in the same vein of perpetuating a complaint or a campaign. Most importantly, look at the basis of the ICO’s refusal: we’re saying no because we don’t think you’re making this request for the right reasons. The ICO believes that an unfounded request is one made for the ‘wrong’ reasons.

Assuming this is correct (and obviously this is a rare case where I think the ICO has got it right), the next question is how far this goes. For years, the UK courts argued that using SARs to pursue litigation was an abuse of process – is that use of a SAR unfounded? I think that weaponised political SARs are unfounded, and even if you disagree, I don’t think you can tell me that it’s impossible. The net result of Dransfield’s adventures in FOI was establishing a principle that has been used to refuse many requests as vexatious – exactly the opposite of what he wanted. His campaign against the Commissioner may, ironically, have the same effect in GDPR.

The ICO rejects SARs they believe have been made for the wrong reasons. If they do this for themselves, there have to be circumstances where they will agree when other controllers do this. Pandora’s Box has been opened. Controllers who are dealing with vexatious applicants or orchestrated campaigns should think very seriously about whether denying a person their subject access right is an acceptable thing to do, but they should do so in the knowledge that the UK’s Data Protection regulator has already done it.

The General Secretary of the Labour Party, Jennie Formby, sent a letter to its Deputy Leader, Tom Watson, this week, expressing concern about Watson’s request that complaints about anti-semitism be copied or forwarded to him so that he could ensure that they were being dealt with properly. Formby outlined concerns about the effect on the complaints process that I am not qualified to answer, but she also raised the spectre of GDPR and Data Protection, and here, I am somewhat sceptical of her arguments.

Formby is right to say that political opinions are classed by the GDPR as special categories data and so require extra protection as compared to ordinary data like a name and address. I’m surprised that she didn’t also mention that many of the complaints would also include the religious or philosophical beliefs of complainants or the complained- about, as well as possibly their racial or ethnic origin. Why Formby didn’t want to highlight the religious and racial dimensions of complaints about anti-semitism is a bit of a poser.

To claim that Watson isn’t taking a risk by soliciting this data when he wasn’t already is clearly false. The best way to avoid Data Protection problems is not to process data in the first place, and as the third GDPR principle requires data minimisation, the safest choice for Watson is to trust the process and not receive any data. The problem arises if he doesn’t, or if he feels responsible for ensuring that it is working. If you think he’s operating purely politically, that’s your choice but I’m going to give him the benefit of the doubt. I’ve already had several heated disagreements on Twitter about this, mainly with people who are certain that he’s going to breach GDPR but uncertain about which particular element is in play.

So here’s my opinion. Tom Watson, in his capacity as Deputy Leader of the Labour Party, can process special categories data concerning complaints about anti-semitism, and Jennie Formby is wrong to argue that he cannot. It’s entirely possible that Mr Watson will follow the GDPR principles to the letter, and it’s entirely possible he will make an almighty cock-up of it. If he does, he should face the consequences. The Labour Party is no stranger to dodgy data dealings – it bought data that had been unlawfully obtained on its behalf by Emma’s Diary for the 2017 General Election, and while Emma’s Diary got fined, Labour didn’t. Sometimes, DP gets breached and nothing happens.

Formby said the following:

“The suggestion that you as an individual data controller should receive and store data relating to complaints unrelated to your personal role as an MP, on a private email address, or indeed any other system, is completely unacceptable and exposes you, and the Party, to significant compliance risks.”

Like all MPs, Watson is an individual data controller, but only when acting as MP for West Bromwich East and the constituency issues associated with that role. If Watson was acting as an MP and party members chose to forward their own complaints to him, or provide complaints made to them by others, it would be odd, but the Labour Party would not be responsible as Formby claims. Watson would be the controller. However, Watson is the party’s Deputy Leader and it is plain that he was acting in that capacity when he sought to receive the complaints – this is plainly a Labour Party matter, not an issue concerning the fine folk of West Brom.

If something in Labour’s constitution explicitly forbids the Leader or Deputy Leader from having direct involvement in, or oversight of, complaints, Watson has a problem. Formby’s letter clearly sets out her opposition to political involvement in the complaints process, and if she can back that up with a clear reference to the party’s formal rules, any argument that I might make in Watson’s favour is severely weakened. Labour’s formal internal rules have great significance for whether his processing is lawful. But if there isn’t, as Deputy Leader, I can’t see how Watson’s claim to determine the purposes for which the party uses data isn’t valid. In all big organisations, senior people can decide how and why data is used. The controller isn’t one person, it’s the organisation itself, and so logically, more than one person is involved in determining the purposes. If the Deputy Leader isn’t an appropriate person to make these decision, who is? Is it just Mr Corbyn?

There are at least two people’s personal data involved in any complaint Watson wants to see – the complainant and the subject of the complaint. Watson has to justify the processing of the data generally, and if the data is special categories, he has to find an exemption that allows him to process the special data.

If any person chooses to forward or copy their own complaint to Watson or his staff, they plainly consent to him processing their data. He can process any data about their political, religious or philosophical beliefs or ethnicity on the basis of their explicit consent. Watson might struggle to demonstrate he has explicit consent unless the email says ‘I explicitly consent for you to process data about my religion, politics or ethnicity’, but in the real world, it’s impossible to believe that the Information Commissioner or the courts would uphold a complaint from the very same person who forwarded their own complaint. It’s nonsense.

If the complaint is submitted to Watson by a third party, this is more tricky, unless of course the person forwarding or copying the complaint (presumably an MP or other party member) gets consent from the complainant. If that consent exists, Watson is in the clear. If not, he must establish a lawful basis to process the data. In my opinion, he has a legitimate interest in receiving and monitoring complaints about anti-semitism in a party of which he is Deputy Leader, especially when a Jewish Labour MP has just left that party because of anti-semitism. Watson would need to evidence the legitimate interests assessment, but I believe he could make it out. It is surely the role of a Deputy Leader to want to make sure that complaints are being dealt with properly, especially when the issue is as important or potentially damaging as this?

If he doesn’t have consent from a complainant and the complaint contains special categories data, Watson has another hurdle to clear in terms of a special categories exemption. However, the GDPR allows the processing of special categories data in the following circumstances:

“processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects”

As long as a complaint was made by a current or former member, Watson can argue that his monitoring of the process is carried out in the course of the party’s legitimate activities. Alternatively, he could argue that it is necessary in the substantial public interest. I believe that ensuring that Labour is taking anti-semitism seriously meets that definition, although Watson also needs legal authorisation from the Data Protection Act 2018 to rely on that exemption. The authorisations include ensuring that equality of treatment is maintained (including the treatment of people with specific religious beliefs). I don’t think Watson needs this, but it’s there.

As far as the data of the complained-about goes, Watson plainly doesn’t have their consent and has no hope of obtaining it. However, I believe again that he has a legitimate interest in gathering the data, and if the data includes special categories like political opinions or religious beliefs, he can rely on the legitimate activities exemption quoted above. Once again, if you disagree, it’s worth noting that another exemption from the prohibition on processing special categories is the fact that the person clearly made the data public themselves. Many of the complaints about anti-Semitism come from comments made online or in public meetings and speeches – the meat of the complaint is very likely to concern public statements or utterances from the complained-about. You cannot object to Tom Watson reading a complaint about your tweets because you tweeted them into the public domain.

If Watson goes ahead with this, he has plenty of work to do. I do not believe that any of the above removes the obligations to comply with GDPR’s transparency requirements – everyone whose data he receives needs to be informed about the fact that their data will form part of the complaints process and Watson’s review. The data must be secure, not used for anything other than the complaints process, and of course, anyone whose data is being processed has rights over their data. Given the less than congenial state of intra-Labour relations, it’s not hard to imagine that the Deputy Leader might be left to his own devices should a nasty subject access request come knocking.

Of course, all of this is bollocks. The Labour General Secretary doesn’t really care about Data Protection (neither did her predecessor). This is politics. Anyone who describes their processing arrangements as ‘elaborate’ is making it up as they go along. No political party has a good record on Data Protection, which is why it’s a shame that the Information Commissioner is so shy about taking them on. Even though I believe that Watson wants to root out anti-semitism in Labour’s ranks, I wouldn’t be surprised if part of his aim is to send a message to Formby about the process.

There is, however, a solution to the whole mess, should anyone wish to take it up. If Watson withdraws his request to see all the complaints, Formby could offer to supply him with pseudonymised versions of them. That way, Watson could carry out an appropriate supervisory role, ensuring that this most vital of tasks is carried out efficaciously, but at the same time, no directly identifiable personal data would be made available to him, and he could assure Formby that he would not attempt to identify the parties. The risk would be low, the data would be protected, and surely nobody could object to an elected Deputy Leader keeping a watchful eye on an issue that is so very important?

SPECIAL RULES FOR COMMENTING ON THIS POST

1. Any comment containing the word ‘Israel’ goes in the bin.
2. Any comment that is about who funds who goes in the bin.

Thank you, and good night.

A couple of days ago, the training company IT Governance reported that the Information Commissioner’s Office had banned Keith Hancock, director of a Manchester lead generation company, from being a company director for four years. The ICO had previously fined the company (Lad Media), and this was the follow-up. All good stuff, you might say, perhaps even a riposte to those awful people who say that the ICO never does anything. Except it isn’t true. The ICO didn’t ban anyone because they don’t have the power to do so. The action was taken by the Insolvency Service with the ICO’s assistance. Weirdly, the IT Governance’s scribe used quotes from the Insolvency Service’s press release without either reading or understanding what it said.

UPDATE: demonstrating the lack of class that is ITG’s hallmark, the story has now been updated without any reference to the fact that it had been wrong, or that they needed me to correct them. This is what it used to look like:

I don’t expect IT Governance to get things right (their sales director once claimed that there had been GDPR fines of 6.2 billion against Facebook and Google), but you’d hope for higher standards from, say, the chairs of four Parliamentary Committees, right? Right? A week or so ago, a distinguished group of Parliamentarians (and Damian Collins) wrote to Jeremy Wright, Secretary of State for Culture, Media and Sport as part of a campaign to change the way the ICO is funded. The idea is that the ICO would get to recover the costs of its investigations from those found to be in breach of Data Protection law, and has been promoted by the Durham-based marketer Russell James. I think it’s a bad idea – it would require the ICO to record and cost the time they spend on every investigation, it could dissuade organisations from appealing ICO decisions (which is bad for everyone as ICO decisions need to be tested), and even where it was applied, it would see the ICO bogged down in arguments about how much they actually spent.

Leaving that aside, the letter itself is amateurish and inept. Several times, it refers to organisations being “found guilty“, something which only happens in criminal cases, thus ignoring the fact that much of the ICO’s work carried out under civil not criminal law. In similar vein, it refers to “data crimes“, a phrase presumably culled from Liz Denham’s misleading soundbite “data crimes are real crimes” (they’re not). This means that the scope of the letter isn’t clear – are they referring to civil breaches (which aren’t crimes), or are they referring to criminal offences, which in the ICO’s world are usually committed by individuals rather than organisations? I find it hard to believe that Dominic Grieve and Yvette Cooper would sign a letter than hadn’t been properly thought out, but as it turns out, they signed a letter that hadn’t even been proof-read. The penultimate paragraph includes a sentence that plainly has words missing “To strengthen the enforcement mechanism, and thus provide maximum credibility to the ICO should be able to recoup the costs of investigations…“, and most damning of all, it opens by describing the ICO as the ‘Independent Commissioner of Information’, which as Neil Bhatia pointed out would be make them the ICI, not the ICO.

UPDATE: a commenter below argues that I should not describe them as ‘civil’ breaches; rather, they should be described as breaches of administrative law. Technically, I think this is correct, although the point I was making is that they are definitely not crimes. I have made the entirely avoidable mistake of listening to the Information Commissioner, who describes them as ‘civil monetary penalties’, e.g. here. I will endeavour not to make the mistake of listening to the ICO again.

Here we have senior Parliamentarians putting their name to a letter that is badly written and incoherent, asking for changes to the funding of a regulator they can’t even accurately name. Russell James told me that the letter was drafted by Tom Tugendhat’s office, but it’s plain that nobody involved in its creation knows anything about Data Protection.

Bullshit is everywhere. In the same week as the ICI letter, Privacy International published a piece responding to Will.I.Am’s well-intentioned but counter-productive ideas about monetising personal data to benefit individuals. The piece included several completely false statements, including that fact that Cambridge Analytica had been fined by the ICO, and that Professor David Carroll had successfully sued the company to recover his data. I took this up with them and they attempted to correct the piece, but in doing so, they made it worse. The correction says “A previous version of the piece implied that Cambridge Analytica has been fined for their involvement in this scandal. The piece was updated on 7.02.2019 to make the text less ambiguous.” The problem with this is that the previous version didn’t imply anything: it said explicitly that Cambridge Analytica had been fined, and they haven’t. The correction goes on to say “The company has been fined for failing to respond to an access request by the Information Commissioner’s Office (ICO)”. It hasn’t. The ICO has prosecuted SCL Elections (not Cambridge Analytica) for failure to comply with an enforcement notice. Despite that famous raid, ICO hasn’t fined Cambridge Analytica or SCL, and the chances that they ever will be are roughly equivalent to me being invited to tea with the Commissioner.

You could be forgiven for asking ‘does it matter’? Does it matter that people get things wrong as long as their heart is the right place? Russell James told me repeatedly that it didn’t matter that the MPs’ letter was full of errors; what matters is that the letter was sent and the wheels are turning. It’s true that pedantry and point-scoring are an unhelpful feature of Data Protection discourse. However, there’s a difference between a conversation and a formal letter or article. More importantly, there’s a difference between pedantry and precision. If you’re talking about privacy impact assessments in the context of the GDPR and I correct you to say it’s a Data Protection Impact Assessment, I’m being a dick. We both know what you mean, and my correction adds nothing. If everyone thinks that the ICO fined Cambridge Analytica when they didn’t, it stops people asking questions about why Wilmslow has spent £2.5 million on an investigation that has resulted in a dodgy fine against Facebook and some mediocre PECR penalties on Arron Banks’ ramshackle empire. If MPs don’t understand the laws that they’re signing letters about, how do we know that they’ve scrutinised the campaign that they’re backing?

The problem is, the Commissioner’s Office are as bad as everyone else and sometimes they’re the source of the infection. Last week, the ICO tweeted that they’d fined Magnacrest Housing, when in fact, it was a court that issued the fine. When SCL Elections pleaded guilty to failing to respond to the ICO’s Enforcement Notice, the Commissioner proudly announced that they had taken action against Cambridge Analytica – although admittedly part of the same group, they’re two different companies, and nobody at the ICO wants to be precise about that because Headlines. The Commissioner herself has repeated the ‘data crimes are real crimes’ claim on many occasions, despite the fact that it’s both misleading and an unhelpful over-simplification. Denham endorsed a book she hadn’t read as “authoritative“, describing its author as someone who “flew the flag for data protection many years before it broke into the mainstream with the GDPR” when he was in fact a PR guy who jumped on the bandwagon.

Denham doesn’t even seem to be overly precise about what her job is – she was quoted by her corporate Twitter account yesterday as saying “What’s technically and legally possible is not necessarily morally sustainable in our society. That’s what the debate is about.” Denham is a regulator – it is her job to enforce the law. As several people have told me since I complained about the statement, Data Protection is principles-based and therefore not as fixed and binary as other areas of the law. I cannot deny this, but even taking it into account, the slippery and complex aspects of DP are still ultimately in the “legally possible” part of the Venn diagram. It’s none of the ICO’s business whether companies do things that are legally possible but morally questionable. If a company breaches DP or PECR, the ICO should take action. Either Cambridge Analytica broke DP law in the UK and the ICO can prove it, or they didn’t. It doesn’t matter that Alexander Nix is a smug gobshite because being a smug gobshite is not a breach of DP law.

We live in an era of fake news where the President of the United States routinely gaslights the world and AI can write prose like a human. The truth matters. Facts matter. Accuracy matters (it’s one of the GDPR principles after all). We all make mistakes. I do it all the time, and the best I can do is hold my hands up and do better next time. But when you’re a big organisation with a much bigger audience than some show-off trainer like me, when you’re an MP asking for a change in how a regulator is run, and especially when you’re charged with regulating something as important as the protection of personal data of 60 odd million people, it matters a lot more. You have to care about the facts because so many people are listening, and you have to take the time to get it right.

And now, in the time-honoured tradition of this blog, I will hit ‘Publish’ and spend the next hour spotting all the typos I’ve made and editing them out before anyone notices.