ICO report on protecting personal data in online services

Increasingly, DPOs need to collaborate with others to implement appropriate privacy controls. So, I’m impressed with the ICO’s latest attempt to explain to data protection professionals (and other compliance officers) what it is that information security geeks need to do to ensure that the most common security vulnerabilities are being addressed.  It’s a really welcome attempt to use less technical jargon to highlight issues that are capable of causing substantial embarrassment and harm to individuals, should the controls fail and data breaches subsequently occur.

The language that is often used by data protection and information security professionals can be impenetrable to most mortals. So three cheers to the ICO for translating some of the technical terms into plain English. If a data protection or compliance officer ever wanted a conversation opener with their security team, this report contains a list of some 39 questions that could easily be asked by ICO auditors in the event they decide to carry out a formal information security audit on the organisation. 

The report helps the less technically gifted professionals appreciate what sorts of questions they need to ask of their security teams, even if they won’t necessarily understand the answers. The key issue is that the officer can (hopefully) rest assured that someone within the organisation understands this stuff, and that they are dealing with it. Which is a lot better than realising that no-one is dealing with it.  


Source:
http://ico.org.uk/for_organisations/data_protection/topic_guides/~/media/documents/library/Data_Protection/Research_and_reports/protecting-personal-data-in-online-services-learning-from-the-mistakes-of-others.pdf


.

Top tips for chairing great conferences – 20 golden rules

I’m still buzzing from a recent data protection conference I was recently associated with. It was held in Central London and involved over 200 delegates and a decent crop of speakers, some with global reputations as privacy gurus.

However, I was faced with a bit of a problem.

The chairman for the first half was responsible for introducing just three speakers and for holding two Q&A sessions.  Under his chairmanship (and despite a couple of good speakers), the session overran by 20 minutes, the mid-morning coffee break was severely delayed and the audience was wilting.  

It was my job, as the incoming chairman for the final part of the event, to introduce no less than 10 speakers and run 2 Q&A sessions. And, crucially, to finish on time. By lunch time.

How did I get on?

These are some of the very kind messages that were sent to me after the event:

“Just had to thank you for not only rescuing a moribund conference, but turning it round and making that second half into one of the best sessions I’ve been to in a long time (including my own conference sessions). Sorry I had to leave before the end of the Q&A.”

“What a barnstorming performance! Your enthusiasm and energetic timekeeping lifted the second half, whilst also demonstrating a  keen understanding of the issues.”

“You were the best moderator ever today!! It was great seeing you. Hope to see you soon!”

“I just wanted to thank you for coordinating the conference this morning, it was not only interesting but also very lively (and on time!). And I can say that, yes, this time I did learn some things as opposed to other conferences, so thanks for your input on that.” 

“I was at the conference today and very much enjoyed your rather different approach to chairing.” 

And, perhaps most kindly, the professional conference organiser praised me: “Martin, you come from the more militant wing of the Fierce Chair Party and it was very, very much appreciated”.

So, what do you need to do to get it right?

Follow these golden rules, and you won’t go far wrong:

1. Start the session confidently, setting the tone for the day. Briefly refer to a couple of the themes that will emerge. The audience and the speakers want to be assured that they are in capable hands, and that you know what you are doing. So make a point of standing up for this part of the show.
2. If you’re sufficiently confident to make an opening joke, make sure it’s funny and not derogatory.
3. To inject the right note of respect into the proceedings, introduce each speaker by their surname.
4. Avoid making a fool of yourself by making sure you can pronounce the speaker’s names.
5. Agree in advance with each speaker just what is expected of them, including whether they will use slides, a prepared text, a lectern and how long they may speak for.
6. Briefly introduce each speaker (without repeating the biographical information that has already been sent to delegates) and explain to the audience how long each contribution will last. This sets expectations about how long they will need to concentrate for.
7. Make the speaker introductions from a personal perspective, briefly explaining why you admire them for whatever it is that they do / did. But make it short. The audience has paid to hear them, not you.
8. Explain to delegates when they should applaud, ie after the speaker has concluded their remarks, or after the Q&A session.
9. When the speaker has overrun their allotted time, announce to the audience they have one more minute.
10. When the speaker overruns that minute, announce they have 30 seconds.
11. Only ignore steps 9 & 10 if the speaker is saying something really interesting that spellbinds absolutely everyone.
12. Briefly thank each speaker, perhaps referring to just one point they made, before introducing the next speaker. Respect each speaker’s contribution, without criticising it (unless the urge is strong and you are confident that the audience will appreciate your intervention).
13. Speakers ought to have informed, educated and entertained the audience. If they did not, use this occasion to reenergise the audience. You should only “show off” if the speaker has failed to deliver. But you do have an obligation to the next speaker to ensure that the delegates are as fresh and as receptive as possible to the next presentation.  
14. Before the Q&A session, announce to the delegates how the questions will be taken. For larger events, I usually explain that the questions will be grouped in 3s and that delegates should direct short questions to a particular speaker. Invite each delegate to identify themselves, even if (they think that) they are well known. Cut them off, mid flow, if appropriate, if the question drifts or gets boring.
15. Take a note of each question, and after the final question in a group of questions has been asked, announce to the audience which speaker will be selected to respond to what (part of a) question. As Chairman, you have the discretion to ignore particularly detailed queries, and to rephrase questions. Make sure every speaker has an opportunity to comment about something, and, make sure that every speaker's contribution is  short. Cut them off, mid flow, if appropriate.
16. Use the period provisionally allocated for the Q&A session to get right back on time.
17. Wrap up the session you are chairing by rephrasing some of the key themes and refering to one or two quotes uttered by contributors. You are there to tell a story, and to assure delegates that what was promised has been delivered. Thank again the speakers – and thank especially the audience for their rapt attention. Remind everyone what a great event it’s been. Again, make a point of standing up for this part of the show.
18. If you’re sufficiently confident to close the event with a joke, make sure it’s funny (and still not derogatory).
19. Thank the event organisers but avoid referring to the hard work, effort and concentration you have personally expended to ensure the success of the event. If you’ve been any good, someone will let you know.
20. Finish on time. Delegates have paid to attend a timed event. They should not feel that they are being held against their will, and they'll be happy to attend another event you will be asked to chair.

Image credit:
http://www.isdef.org/en/conference/isdef2009/hotel.php

.

I'm still quite keen on care.data

I suspect that most people are unlikely to change their minds about the care data initiative.  

I suspect that most people, unprompted, really couldn't be that bothered about the initiative – after all, there was precious little consternation in Parliament when the relevant enabling legislation was considered - but those that are bothered are likely to remain very bothered about it.

As the ICO has helpfully explained when commenting on the enabling legislation (the Health & Social Care Act 2012): "This law gives NHS England the right to direct the Information Centre to collect certain sorts of data from the medical records. The law is a statutory enactment which requires the disclosure of the data, which means the data becomes exempt from the main parts of the DPA.

Because the main parts of the DP are exempt it means that neither GPs (as data controller) or patients (as data subjects) have the right to stop that information being taken into the Information Centre - there is no legal 'opt out' under the DPA.

But while the DPA doesn't give patients a right to object, the Secretary of State for Health has offered patients an option not to have their information used in this way. But as this option isn't covered by the DPA, we can't regulate it, and we don't set the rules on how it works."

So that's it. Slam dunk. There is an avenue for people who are sufficiently motivated to object. There ought be no further argument about the matter.

But of course there is and will continue to be because some people are extremely concerned at the impact of the adverse consequences should anything go wrong and data sharing go awry. And the "No, Never" brigade are of course determined that it should be made much easier for patients to be able to object to having their details shared.

And let's be clear about this. Of course things will go wrong, and of course some data sharing initiatives may go awry. But this does not mean that the initiative is a bad initiative, or indeed that it should not be allowed to proceed. What is likely to be of general concern are the practical steps that should be taken to provide the necessary degree of public assurance that data is being shared appropriately, but that is not an issue I am setting out to address today. (If it wee, I would be arguing for the ICO to play a more meaningful role in the assurance process.

But is it really wrong, in a democratic society, that as a condition of receiving a vital (and free at the point of delivery) service, citizens should be encouraged to reveal to third parties information about their health that might improve health outcomes among the general population?

As far as I am concerned, no. The care data initiative is a necessary and proportionate response to a growing problem, which is that the costs of health care are significantly outstripping the ability of commissioning bodies to be able to purchase enough of it. I am a grateful recipient of the health care that the NHS is able to provide to me and my family, and I certainly wouldn’t want to erect any barriers that made it inappropriately harder for care professionals to devise the most appropriate treatments, or to benchmark health outcomes to ensure that dodgy doctors couldn’t practice with impunity.

In a nutshell, the right to privacy is a qualified right, and accordingly public authorities are able to interfere with this right so long as the interference is:

·         In accordance with the law;

·         In pursuit of one of the legitimate aims set out in Article 8(2) of the European Convention of Human Rights; and

·         Necessary in a democratic society.

As far as the law is concerned, this test is met by the Health & Social Care Act 2012.

As far as meeting any legitimate aims of the European Convention on Human Rights are concerned, this test is met by the reference to initiatives “for the protection of health”.

As far as the meaning of “necessary in a democratic society” is concerned, there have now been a number of cases before the European Court of Human Rights that have all referred to one or more of the following tests:

·         Pressing social need - Does the interference correspond to a pressing social need?

·         Proportionality – Is the interference caused by the measure proportionate to the legitimate aim being pursued?

·         Relevant & Sufficient Reasons – Were the reasons given to justify the interference relevant and sufficient?

·       We can all argue until the cows come home as to how “necessary” the initiative is, but I’m not sure what would be required to change my personal view that the initiative meets these tests.

I do pay tribute to the remarkable work going on behind the scenes to ensure that whatever does happen is done in a way that is as safe and as secure as possible. I’m also somewhat concerned at the potential threat to my privacy by the inappropriate disclosure of information that consequently caused me a great deal of embarrassment. But, I would be much more concerned if I were to be living with a particularly debilitating medical condition and it subsequently transpired that my own treatment plan could have been significantly improved if only a core of conscientious objectors had not been successful in withholding from researchers vitally important details about their own health issues. 

Finally I do hope, although I am by no means confident, that the care data initiative actually does proceed. It only takes a small, but vocal, group of detractors to derail it. And they do seem to have a remarkable ability to grab the headlines.

As in so many things data protection, this initiative is less about the law and more about the politics of the process.

.

Privacy seals: What does the market really want?

Almost exactly a year ago, the ICO’s Information Rights Committee considered “a proposal to implement a framework for ICO accreditation of a third party to operate a privacy seal or trust mark scheme.” It was agreed that the proposal should be taken forward in principle. Subsequently, various discussions have taken place with various data protection bods, but I’m not entirely sure how much concrete progress has been made.

I was among those consulted on earlier attempts to implement a similar initiative. The last one was a couple of years back, and was sponsored by the consumer rights organisation, Which? I also remember being consulted on similar initiatives before that – all of which suffered a similar fate.

I was dubious about the proposal then, and remain ambivalent about it now. I just can’t see the business case for persuading responsible data controllers that they should pay to have their internal processes examined by a third party in order that they might be awarded a privacy seal that so few of their customers might actually take any notice of or care about anyway.

Webmasters and marketing teams are usually very determined to control all the images that appear on their landing pages, and surely hardly any of them would welcome a proposal that their precious pixels should be devoted to displaying a logo about non-statutory, non-corporate stuff.

The Which? proposal fell at an early hurdle because Which? and its chosen audit partner couldn’t develop a business plan that made much financial sense. How many data controllers were sufficiently confident about their internal processes that they were happy for a third party to inspect them? How much was this audit exercise going to cost, and how frequently might it need to be repeated for the privacy seal to be of any value? And, most crucially, how high was the privacy bar to be set? No one knew.

The main point about privacy seals is, presumably, that some people will not be able to attain them. So, anyone who is at all worried that they might not pass probably won’t apply for an audit in the first place. Organisations don’t like to set themselves up to fail. And, as one size does not fit all, it’s extraordinarily hard to develop an audit methodology that gives equivalent assurance about large and not-so-large organisations. I can’t ask precisely the same audit questions to different sized organisations, particularly when their business models relate to very different privacy risks.  

The next point about privacy seals is that, presumably, independent auditors will need to be assured that there is sufficient demand for that service before they seek to become an accredited audit partner. And if the proposed standards deter potential applicants, auditors will face natural demands to lower the standards, to increase the pool of certificate holders (and hence increase the pool of organisations that will need to be re-audited in a few years time).

I see this pattern in the current race to “accredit” data protection officers.   An increasing range of organisations are vying to offer data protection training and accreditation services to privacy (and other) professionals, and the result is that said professionals can now choose how much (or how little) effort they commit to getting their privacy qualification.

Certifications of competence can be obtained by learning by rote, writing short essays, filling in multiple choice questionnaires or by completing longer pieces of written research. On-line, in your own time, or in a classroom.  Just take your choice.

The costs vary from a few hundred to several thousand pounds – particularly when a certification provider requires that certificate holders commit to purchasing continuing professional development courses every year from a restricted range of suppliers.

But which privacy qualifications are actually worth having, from the perspective of the privacy practitioner, and which qualifications simply meet the commercial needs of the relevant training provider?

It would be indelicate to venture too far into this debate today, but it is a debate that needs to be had. Particularly when people are spending their own time and money seeking a decent qualification, it would be helpful for an independent assessment to be available about the relative merits of the offerings of the current range of training providers. 

So, my plea to the ICO's Information Rights Committee is that it should devote less time developing a framework of privacy seals that enabled third parties to accredit the practices of data controllers, and more time developing an assurance framework about privacy training providers.

To the extent that there is a demand for seals or trust marks, I sense that the demand is currently far stronger from the privacy professionals themselves, who seek credible privacy qualifications from competent accredited training providers, than it is from organisations whose customers really couldn't care less if an independent privacy audit had been carried out.

Source:

http://ico.org.uk/~/media/documents/library/Corporate/Notices/20120423-irc-meeting-minutes.ashx

Image credit:

http://www.free-picture.net/animals/seals/leopard-seals_1374217638.jpg.html

Botched EU communications data retention rules quashed

How many people really care about how long their communications data is retained for national security and law enforcement purposes?

Beyond the readership of this blog, probably not very many.

I remember first becoming involved in this issue some 15 years ago, when working for what was then known as the mobile company One2One. It was my job, amongst others, to understand just what the company needed to use these records for, and for how long they needed to be retained. I remember conferring with colleagues in the mobile (and fixed) telecoms field, exchanging ideas as to what retention standards ought to be appropriate.

I won’t list the (then) retention standards in this blog, as I would only be opening a can of worms - suffice to say that today’s retention standards differ greatly from that practiced by certain providers then.

I also remember working with the Home Office on the issue of mandating certain retention standards – really to ensure that data that was actually required for an investigation could readily be made available when it was proportionate and necessary to do so.

And finally, under the stewardship of the then Home Secretary Charles Clarke, I remember the UK Government being primarily responsible for the Communications Data Retention Directive (2006/24/EC), which broadly tried to set common retention standards throughout Europe. Why? Just in case communication records generated by, say, British customers in the UK, were to be held not in the UK but in a central European records database. Given that, back then, the parent companies of Orange, One2One, O2 & 3 were based respectively in France, Germany, Spain & China, there was a real possibility that Britain’s law enforcers might have lost out if British mobile phone records were to have been held outside the UK.

It can also be said that we all knew that the Communications Data Retention Directive, especially as it applied to IP records, really was not fully fit for purpose when the time came for the final note on approving the thing. But what was better – a botched job, or no agreement at all? The European parliamentary timetable was such that there was a real prospect that all work on the measure would have been wasted had a final vote not have been made by a particular date. 

The Governments of the Member States, and the members of the European Parliament, took the view that any agreement would be better than no agreement.

Now, some 8 years later, the European Court of Justice has taken the view that the original job was so botched that the Directive ought to be annulled.

In essence, the court has held that the retention limits (which allowed Member States to individually set periods of between 6 and 24 months for various types of data) were disproportionate. Why was this time period originally agreed? Principally because it was a timeframe that suited the requirements of a large majority of the European law enforcement bodies that were using significant volumes of communications records for investigative purposes back then. 

Readers with a keen sense of irony will know that one of the successful appellants in this case was Digital Rights Ireland. Yet, the Irish Government was originally opposed to the Directive because they wanted to keep communications records for 36 months, not the 24 months that was finally agreed. The Italian Government were even more opposed to the Directive, because they originally wanted to keep certain records for 48 months (and even longer in some of the cases that involved Mafia investigations).

The German Government was very opposed to the concept of keeping records even for as long as 6 months. Basically, this was because it knew it would come under considerable pressure to pay the providers in that country the costs that would be incurred in setting up the relevant records retention databases and, thanks to the recently disgraced former East German administration, it also had direct experience of state abuse of communications records.

Readers with a keen sense of irony will also know that the first four communications providers to announce that they have reduced their retention periods, in light of the judgment, hail from Sweden, which is one of the 4 Member States that originally sponsored the Directive.  And it was the same European Court of Justice that fined Sweden 3 million Euros in May 2013 for delaying implementation of the Directive in that country. Where’s the justice in that? (Presumably, though, the Swedish Government will now be able to appeal that fine.)

Anyway, what will happen in Blighty as a result of the judgement?

Probably, not a lot. Certainly not soon, anyway.

Given the speed with which the Home Office moves on such weighty issues, it could be some time before an official announcement will be made. Discrete calls have already been placed to the key UK providers, inquiring whether the judgement is likely to change their current retention plans. Such is the relationship between Home Office and said providers that it didn’t take long before the relevant reassurances were received. Home Office attention will now focus on the overseas providers (yes, the usual suspects) to better understand what steps they intend to take.

Sources:

http://curia.europa.eu/jcms/upload/docs/application/pdf/2014-04/cp140054en.pdf

http://curia.europa.eu/juris/document/document.jsf;jsessionid=9ea7d0f130d6f2604883cf044eed9d22fc7e89d17103.e34KaxiLc3eQc40LaxqMbN4OaNiLe0?text=&docid=150642&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=147478

http://www.zdnet.com/four-of-swedens-telcos-stop-storing-customer-data-after-eu-retention-directive-overthrown-7000028341/

http://curia.europa.eu/jcms/upload/docs/application/pdf/2013-05/cp130066en.pdf

.

Snowden allegations stuffed by official report

Supporters of Edward Snowden will probably doing their best to ensure that a report recently published by the Interception of Communications Commissioner is read by as few people as possible.

Why?

Because it sets out, in a pretty accessible way, just why it is that we Brits have so little to fear about the capabilities that the Government actually has in terms of abusing our communications records.

I appreciate that this is not a very popular thing to say amongst some circles, but it still needs to be said. And I also appreciate that, as this is a good news story, it’s unlikely to be picked up by the mainstream media channels. But I don’t write this blog to attract the attention of the mainstream media.  

What am I talking about?

I’m talking about Sir Anthony May’s first annual report as the Interception of Communications Commissioner.

It was published on 8 April and largely ignored by the media as it coincided with the news that the European Court of Justice had quashed the Communications Data Retention Directive (2006/24/EC), which had broadly required European Communications Service Providers to retain various types of data for certain periods for the purposes of tackling serious crime. (I’ll address this issue in another blog.)

In a courageous departure from previous practice, Sir Anthony has been more open in communicating with the public on the big issues of the day. Technically, this has been a challenge, as his statutory role is to report to the Prime Minister, rather than offer a running commentary on relevant issues to the media. But it is an incredibly welcome step, as he is someone who actually knows, from firsthand experience, what really goes on. Most people are hazy about the details of this complicated set of laws, and comment from a position of what they perceive to be going on, rather than what has really been going on. He really knows.

Let’s focus on what Sir Anthony has actually said:

“I have full and unrestricted access to all information from public authorities, however sensitive, sufficient for me to be able to undertake my statutory functions.

Public authorities do not misuse their powers under RIPA Part I to engage in random mass intrusion into the private affairs of law abiding UK citizens. It would be comprehensively unlawful if they did.

I am quite clear that any member of the public who does not associate with potential terrorists or serious criminals or individuals who are potentially involved in actions which could raise national security issues for the UK can be assured that none of the interception agencies which I inspect has the slightest interest in examining their emails, their phone or postal communications or their use of the internet, and they do not do so to any extent which could reasonably be regarded as significant.

British intelligence agencies do not circumvent domestic oversight regimes by receiving from US agencies intercept material about British citizens which could not lawfully be acquired by intercept in the UK.”

If I were on the Pulitzer Prize Committee, I might now be having second thoughts about awarding the Washington Post and the Guardian their recent bauble for printing so many of Edward Snowden’s revelations. Yes these stories have stoked up a huge array of global interest in the issue, but they have also indicated the extent to which the relevant authorities have tried so hard to seek assurance from suitably qualified lawyers that whatever was going on was in accordance with local laws.

The outcome (in America, at least) will probably be new laws, further restricting current capabilities of the US law enforcement community. I don’t see the outcome resulting in any officials facing criminal prosecutions for having approved various programmes that may well have involved the collection of communications records.

And the outcome in the UK?

Given Sir Anthony’s views, probably not a lot, as he is already satisfied with many of the controls that are already in place.

On receiving it, the Prime Minister commented:

“The report makes clear the Commissioner’s view that RIPA is fit for purpose, despite advances in technology. He also finds that interception agencies undertake their roles conscientiously and effectively, and that public authorities do not engage in indiscriminate random mass intrusion.

The report also publishes, for the first time, a detailed breakdown by public authority of the number of communications data authorisations and notices issued. I welcome the greater degree of transparency that this report brings, without harming national security, and look forward to the Commissioner’s further work on the volume of requests.

In light of concerns about the activities of the intelligence agencies, the quality of oversight, and a number of public concerns and myths that have developed in the light of media allegations linked to Edward Snowden, I believe his report provides an authoritative, expert and reassuring assessment of the lawfulness, necessity and proportionality of the intelligence agencies’ work. I thank Sir Anthony for the rigour of his scrutiny.”

So, a rigorous scrutiny from the most impartial expert we are likely to get has resulted in a pretty clean bill of health for the law enforcement community.

Not that all parts of the media will necessarily report it that way, though – if they bother to report it at all.

   

Sources:

http://www.iocco-uk.info/docs/2013%20Annual%20Report%20of%20the%20IOCC%20Accessible%20Version.pdf

http://www.iocco-uk.info/docs/WMS%20No%206.pdf

.

DP compliance checks: what to look for

What does “good data protection” look like?

I’ve been asked that question several times over the past few weeks as I’ve carried out data protection health checks for a range of organisations.

It’s caused me to pause and reflect on what controls I’m really looking for in an organisation, and the extent to which these controls deal with real or potential threats that exist with regard to the organisation’s processing of personal data.

It’s also caused me to review a number of the audit methodologies that appear to be in use right now, and to refine my own approach, which appears to have been well received. My own approach now focuses much less on compliance with specific elements of data protection legislation, and much more on helping the client develop an oversight structure to give them the assurance they require when assessing how good they are at data protection.

It’s so nice to visit a client and barely mention the data protection principles. Instead, I’m following the ICO’s current thinking, which is to break data protection compliance down into a number of bite size chunks, and get the client to agree which “chunks” are most significant, as far as their organisation is concerned.

A close read of the audit reports currently published on the ICO’s website gives a good indication of what really really matters. So, organisations that have addressed these issues are going to be in a pretty good shape.

Write to me if you want more information about my methodology.

What has struck me, as I’ve carried out the latest series of health checks, is how insignificant the proposed (well, deceased) Data Protection Directive actually is.  I use the term “insignificant” in the sense that I really can’t see how it might realistically improve data protection standards beyond what might reasonably be expected of anyone who was taking their current obligations seriously.

Putting this thought into a different set of words, current data protection compliance levels could so easily be improved if people just managed to understand and follow the existing rules. I have no confidence that the imposition of an even more complicated set of rules would motivate significant numbers of data controllers to “up their game”, as it were. If they lack the resources to deal with the basics, then all they are likely to do is to fall even further behind, in terms of legal” expectations, if the impossibly high standards commended by the European Parliament ever see the light of day .

Of course, the draft Regulation does have some uses. It gives some people the opportunity to enhance the importance of data protection (and in doing so enhance their own status), by becoming an international talking head on this stuff. It gives teams of professional advisers the opportunity to sell their services to the (relatively small band of) clients that can afford to pay for such data protection wisdom.  Proposals for legislative change also create more noise and opportunity for policymakers to earnestly consider what new rules ought to be put in place. But so many of these proposed changes simply tinker at the edges, rather than seek to fundamentally review what controls are really important for this and the next generation.

The controls that are really important are those that reward good behaviours.

We data protection folk have a lesson to learn from our financial services chums. Try as I can, I find it really hard to identify a link between, say, the volume and intensity of regulation in the financial services sector, and an increase in consumer confidence and trust in the integrity of financial services institutions. To generalise (and most unfairly, perhaps) it seems to me that certain awful standards in the financial services industry exist independent of the rules. I am appalled at the rate of return my (meager) investments are realising, but there is very little I can do about it.

The more I think about it, that Emperor of a Draft Regulation never really had any clothes. And, it had no more realistic chance of changing many data controllers’ behaviours than has the ICO chorus of winning “Britain’s Got Talent”.

So what should be done today?

Plenty.

For a start, organisations should look at their current controls and ask themselves if they are happy with what they see.

And, if they don’t know what they really ought to be looking out for, then all they have to do is drop me a line and ask me to outline my own approach towards pragmatic compliance with the ICO’s expectations.

Image credit:

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgeSm9fFTi-3V7irITXNEeJeCAyfeDOjeZrIgCGOtP3GL6JvXyWmNMm4rgV6ZRD20_ERmCuVIMp6Uk8I3G0rWpJYbxsAF5JsarOYAYYe0XCgV1fKyFxhKHcFbFABm1-JCeXtGf7SCuNB1C9/s1600/magnifying-glass.jpg

.