I had planned to write a detailed condemnation of Liz Denham’s time in office to coincide with her leaving, examining every twist and turn. For many (especially outside the UK), Denham is the poster girl of data protection, an inspirational figure with the guts to take on Big Tech. For me (and some within UK), she is a gigantic disappointment, a publicity-seeker with poor judgment. I could list any number of her failings – the credulous pursuit of the Cambridge Analytica conspiracy theory, the failure to enforce GDPR, the hollowing out of FOI, and the incompetent and self-serving way she’s run the organisation. She spent millions on pointless tech policy jobs and gave thousands to her friends without putting work out to tender, but allowed huge backlogs to build up in DP and FOI complaints. The compliance stats of her own FOI team would make a council blush.
I could go on, but as it happens, this week Denham gave a more eloquent demonstration of what went wrong in her tenure than any summary of the five-year slow-motion car crash could offer. It’s a tale of two enforcement cases, one fake, one real, and Denham’s decision about which one she wanted to be associated with.
On Monday night, the penultimate day of Denham’s time in office, the ICO took the relatively unusual step of announcing a £17 million Notice of Intent on Clearview AI, ironically the penultimate stage of the process that ICO follows when issuing a fine. The NOI says ‘we intend to fine you’, and then the controller has the opportunity to make representations. Sometimes, these representations make no difference, but they often have significant effects. The NOI to British Airways was for nearly £200 million, but after BA’s representations, it was reduced to £30 million (and subsequently dropped further due to COVID and other factors). The allegations ICO made in the Facebook NOI were effectively abandoned, moving from ‘this happened’ to ‘this didn’t happen but it could have’.
I’m going to go out on a limb and say that the £17 million penalty will never happen. For one thing, the Commissioner who will actually make the decision on whether to fine Clearview AI (John Edwards) hasn’t even started in the job yet. We have no idea what his approach will be. Clearview AI is a US company registered in that most notoriously business-friendly state, Delaware, so even if he decides to issue a penalty and Clearview AI don’t win on appeal, the process to recover any money will be long and tortuous. In the meantime, the unpaid penalty will count in the ICO’s accounts as a debt even though they have to pay it to the Treasury if they recover it. Given that he has already blocked me on both Twitter and LinkedIn, I clearly don’t have a good window into Edwards’ head, but if I was him, I’m not sure I’d want to devote my first year in office to such an enormous albatross.
On 15th November 2021, Denham signed a penalty notice – a real one this time, not an NOI. It was for a £500,000 penalty on the Cabinet Office following the publication of a spreadsheet containing the details of everyone who received a nod in the 2019 New Years Honours List. This was a wide-ranging group from politicians and celebrities to people working in the security services and foster carers. The notice sets out in detail the absence of procedures and complacency within the Cabinet Office, and rightly seeks to punish the organisation for these failures.
There’s an obvious flaw in this action – the fine will be extracted from the Cabinet Office and then returned to the Treasury, so government money just circulates. But no government department wants such an emblematic punishment, their mismanagement laid bare in public. The Cabinet Office has already put measures in place to prevent a repeat, so an enforcement notice would be pointless and possibly invalid, and yet the fine will still have an effect, pour encourager les autres if nothing else.
Denham gave a smug, self-aggrandising speech to the British Computer Society last week, claiming the credit for a transformation in UK data protection culture. No longer was DP about lost files and laptops left on trains – it was about people, she said (as if somehow, nobody in the UK thought protecting personal data had any connection with the people it related to until St Liz showed them the light). She cited online harms, the safety of elections and other things which aren’t the ICO’s responsibility and which Denham has had no positive effect on. The former Commissioner spent millions of pounds pursuing a fantasy about interference in the Brexit referendum, proving no more than it didn’t happen, and she left office with the Government proposing to remove politics from the definition of direct marketing, allowing much more targeting and unsolicited political messaging. Her legacy is a bad joke.
The Cabinet Office fine was real. It was action. It happened. It is a perfect example of the kind of thing that the ICO can actually do, and if led by someone who wasn’t obsessed with headlines, who actually cared about the impact of data handling on real people in the UK, it’s something the ICO could do a lot more of. It could have an impact. Any action taken against Clearview – even if it happens – will be a waste of time and money that will have no benefit for UK citizens. It’s obvious that Denham didn’t want the Cabinet Office penalty to be associated with her – the announcement was delayed for weeks until she had gone. Meanwhile, the Clearview NOI which has all the force and effect of homeopathy was her final flourish, the act she wanted to end her tenure on. Remember me for this and not that, she plainly wanted to say.
So I will do as Elizabeth Denham OBE wishes. If I remember her at all, it will be for this pointless attention-seeking act, focussed on an American company, that will have no positive impact on the country she has disdained and let down for five and a half unproductive and disappointing years. I sincerely hope that she is, as she has so often been, on a plane, flying far away.