John Edwards' keynote speech at the NADPO conference

In his keynote speech at the National Association of Data Protection Officers (NADPO) annual conference in London this week, Information Commissioner John Edwards outlined his philosophy on enforcement. He defended the ICO's new approach to public sector enforcement, referencing the recent reprimand issued to the Department for Education, which could have resulted in a £10m monetary penalty under the old approach. Mr Edwards clarified enforcement is more than just issuing fines and goes on to list the corrective powers under Article 58(2) of the UK General Data Protection Regulation (GDPR). Relating these to the DfE case, Mr Edwards outlined his justification for settling on a reprimand. Speaking on monetary penalties and enforcement in general, he said: "Fines are only one of a number of enforcement tools available to us. We need to be regulating for outcomes, not outputs. The number or quantum of fines is not the measure of our success or failure, nor of our impact. Getting better outcomes, and sharing those stories with the wider economy, can have a much greater effect on the lives and rights of the people of the UK than a fine might. That's my regulatory philosophy, and I'm sticking to it." For public sector organisations, Mr Edwards reiterated the point issuing fines only serves to move government money from one account to another.