Thursday 29 November 2012

Leveson Inquiry: data protection soundbites

Still no jokes today.

There’s lots for us to take out of the 2,000 report, so here are my suggestions as to the more significant comments about the ICO and the press. I make no apologies for reproducing this stuff – it needs our very careful consideration – because I don’t agree with it all.

My first impression is that had Lord Leveson managed to transport himself back in time by a decade, and had “smelt” both the environment within the ICO and the public expectations of the ICO at that time, I feel that some of his comments about the ICO might not have been made:

As an independent statutory regulator, the ICO has a prerogative to set its own priorities within the overall scheme of the powers and duties entrusted to it by Parliament. For the behaviour of the press to have no part in those priorities is not, on the face of it however, easy to understand. The ICO was created to have custody of the issue of the law and practice of information privacy as articulated in the data protection regime. This Inquiry was established to address arguably the greatest crisis in public confidence in information privacy since the creation of the data protection regime. A great deal of the evidence received by the Inquiry about press misconduct related to personal information privacy (including inaccuracy). The persistence of the ICO, even in the face of the commissioning of the Inquiry and the evidence received by it, in seeking to recuse itself from any proactive engagement in addressing the crisis in public confidence was troubling. Even allowing for the inevitably particular perspective that the Inquiry has, I do not find it easy to accept the proposition that the lack of priority which the ICO accorded to the press issue is obviously reconcilable with its overall public responsibilities.

The additional procedural thicket which the DPA erects in the way of anyone attempting to find out whether the press is complying with the law, that is to say whether their activities are genuinely covered by exemptions and if not whether they are complying with what is legally required of them, is for practical purposes near-insuperable. The press, so this analysis goes, is effectively beyond the reach of law enforcement. In that regard, the legal regime can be and is disregarded for any practical purposes. Whether what the press are doing with people’s information is or is not specifically exempted from the regime hardly matters in practice since the question is effectively prevented from arising.

More specifically, in relation to the ‘special enforcement regime’ provided in the 1998 Act in relation to the press, there are good grounds to conclude that it has had an unintended and damaging effect on the ability of the ICO to perform its functions. Exceptionally complex and largely unworkable in practice, it appears to have had a chilling effect on reasonable law enforcement and, equally, to have a high risk of impacting unfairly on individuals. In my judgment ... its removal would promote the overall public interest and a balanced improvement in the culture, practices and ethics of the press in its approach to personal information.

I accept that the current state of the legal framework in relation to the ICO’s civil law enforcement powers goes some way to explain the indications of reluctance by the ICO to take an active, or any significant, interest in the formal exercise of their regulatory functions in relation to the press. I do not, however, accept that as a complete explanation. In reality, there is a lack of evidence that the ICO has, over the years:(a) regarded the symptoms of deficiencies in the culture, practices and ethics of the press in relation to personal information as a serious operational priority;(b) shown a will to test in practice the powers and procedures conferred by law specifically for the purposes of ensuring compliance with the legal obligations of the regime by the press – however attenuated those obligations and however difficult those procedures; or(c) drawn attention politically to any perceived shortcomings in the legal framework in this respect. This raises questions about a possibly deeper reluctance to accept an active role in relation to the press. Neither do I accept that other operational priorities must be accepted without more as an explanation for ICO inactivity in an area which the very existence of this Inquiry demonstrates to be a matter of acute public concern.

A final issue to be considered within the framework of formal criminal law enforcement is the matter of sentencing. When dealing with the criminal law generally,I recommend that the Sentencing Council of England and Wales be asked to prepare guidelines in relation to information privacy and misuse offences (including computer misuse): for the sake of completeness, it is sufficient simply to repeat the recommendation and refer to the reasons for it.

The evidence before the Inquiry suggested that the constitution of the ICO as a corporation sole may, in at least some of these dimensions, have risked its ability to discharge effectively its functions in relation to the press. Unresolved questions must remain, for example, as to whether:(a) the informal approach adopted by the ICO to its regulatory functions (partly a matter, perhaps, of presiding over a regime struggling for a profile, also possibly a matter of personal leadership style) has contributed to a reluctance to bring issues to a head through the use of regulatory powers, and has allowed inaction to be an unremarked default within its own structure;(b) the tendencies of Information Commissioners to see themselves as having a major, even dominant, outward-facing role with a political or campaigning dimension has been at the expense of their ability to provide clear, engaged, understood and accountable leadership in the decisions made within their office, to the detriment of the quality of those decisions, and has posed some risk to the regulatory reputation of the ICO, including in relation to its quasi-judicial functions; and(c) its current constitution leaves the ICO with insufficient strength to match major business sectors with power and influence, such as the press.

The only questions I want to ask today are:

What regime does the Government honestly think it’s going to get if it allocates such a small amount of resource to a regulating such an important activity?

How much better resourced has been the Financial Services Authority?

And just how much more effective a regulator has that body turned out to be?

In the words of our Prime Minister: “Get Real.”