ORG issues firm rebuke of ICO as Lords prepare for DPDI Bill return

The Open Rights Group posted a briefing document highlighting the Information Commissioner’s Office (ICO) track record on enforcement. 

In 2021-22. the ICO failed to serve a single UK General Data Protection Regulation (GDPR) enforcement notice, despite receiving over 40,000 data subject complaints. The ICO also secured no criminal convictions and issued only four GDPR fines totalling just £633k. The report suggests that increased political pressure is casting doubts about the ICO's ability to operate independently from the government, and significant shortcomings have arisen in practice in how the ICO handles complaints. The report also highlights that provisions in the Data Protection and Digital Information (DPDI) Bill could worsen these issues if Parliament does not take action. 

To avoid such an outcome, the ORG calls on the House of Lords to support amendments that clarify the statutory objective of the new Information Commission, increase its arms-length body from the Government, protect the Information Commission from cronyism and undue corporate influence, allow effective judicial scrutiny of the new Information Commission regulatory function, allow not-for-profit organisations to lodge representative complaints, and retain the Office of the Biometrics and Surveillance Camera Commissioner.

In a separate post, ORG highlights that the subpostmasters’ long campaign for justice in the Post Office scandal could have resulted in further setbacks if the DPDI Bill had been law. 

In its current form, the DPDI Bill lowers the threshold for refusing SARs, allowing organisations to refuse requests that they consider to be “vexatious”. The government claims the move will bring it in line with the Freedom of Information Act (FOIA). However, ORG argues that FOIA is broader in scope than data protection rights, which only empower individuals to make requests about their personal data.