The Information Commissioner’s Office (‘ICO’) is an independent
public body and is responsible for enforcing and overseeing
compliance with the Data Protection Act 1998 (the Act). When ICO
uncovers non-compliance with the Act, it can issue information and
enforcement notices, carry out audits and prosecute offenders.
However, the Commissioner currently exercises a more reactive
rather than proactive role, as ICO does not have the right to carry
out spot checks on organisations to ensure compliance.
This lack of power makes uncovering non-compliance difficult, as
ICO must have either a warrant or the consent of the data
controller to inspect any data being held. In a situation where the
data controller knows that they are in breach of the Act, they are
very unlikely to consent to such an inspection. The argument of the
Commissioner is that the ability to perform surprise inspections,
checking whether data held by controllers is relevant, accurate and
stored safely in accordance with the Act would help both to uncover
non-compliance, and deter organisations from such behaviour in the
first place. This should also help prevent repeats of the situation
ICO found itself in recently when it was only able to administer a
warning following findings that eleven banks had dumped customers’
personal data in outside bins. If the powers were to be granted,
organisations in both the public and private sectors would have to
ensure they handle data in compliance with the Act.
The Commissioner has also called for the introduction of a system
of privacy impact assessments, such as that already widely used in
Australia and the US. These would ensure that organisations set out
how they will minimise the threat to privacy and address the risks
of new surveillance arrangements before they are implemented.
The European Commission has backed these demands for further
powers, highlighting concerns about the increase of the ‘big
brother’ surveillance society in the UK. Despite this, and support
from several other sectors, the Government has, as yet, stopped
short of announcing a firm commitment to deliver these powers.