As surely nobody has forgotten, in April, the Duke of Edinburgh died. Even a committed republican such as myself would have to acknowledge that this is a significant event in UK public life. Government and government-adjacent organisations such as the Information Commissioner’s Office plainly had to weigh up how best to react to his passing. The ICO was in a particularly awkward spot because their annual Data Protection Practitioner Conference fell in the week between the Duke’s death and his funeral. It’s silly not to acknowledge that they were in a bind. Even if you disagree with the decision, postponing the event was plainly a reasonable thing for an organisation run by a crown appointee to do.
Someone made an FOI request on What Do They Know asking about the decision and the ICO responded this week. Of course, you’ll assume that this was me, but the reason I don’t make FOI requests on What Do They Know (apart from the fact that I think it’s run by a cabal of zealots whose approach I do not wish to endorse) is that when the results are published, any Tom, Dick or Harry can come along and write a blog about it, exactly like I am doing now.
The ICO can be very cagey about investigations and relationships with external organisations, but if there’s one thing they’ve always understood about FOI, it’s that it is reasonable for people to dig into how and why decisions are made. It is not unusual for an FOI request to the ICO to result in a dump of internal emails involving senior people, as this one did. If you are, or know, a senior person working in the public sector, you should read the ICO’s response, not particularly because of what it says, but because of what it represents. All of the most senior people in the ICO contribute to the discussion (Denham, her *four* deputies, two ‘Executive Directors’, and the ‘Acting General Counsel’), none of it appears to have been redacted, and it’s very recent, covering conversations happening just a month before the request was made. Few public sector organisations regularly give out information like this, and many more should. Government departments would run a mile from this level of transparency, and the reason is that the people running them are cowards with something to hide.
I think the content is a window into why the ICO has floundered under Denham’s supervision – indeed, one single sentence sums it up. The consensus from the Executive Team is that the conference should not be cancelled. All participants are rightly concerned to see whether advice from the Cabinet Office or the Department for Culture, Media and Sport prevents it, but otherwise, they think it should go ahead. Paul Arnold, the “Deputy CEO and Chief Operating Officer”, is most on the fence, but plainly leans towards keeping it on. Steve Wood, billed as “Deputy Commissioner (Executive Director – Regulatory Strategy Service)”, James Dipple-Johnstone (“Deputy Commissioner and Chief Regulatory Officer”) and Simon McDougall (Deputy Commissioner and Chief Hospitality Officer) are all cautiously in favour of running it, as are James Moss, the Acting General Counsel and Jen Green, “Executive Director (Strategic Change and Transformation)”. We really should get a pack of cards made, like the ones the US Army issued during the invasion of Iraq.
Stephen Bonner, Executive Director of Regulatory Futures and Innovation, pipping Green for the prize for most aggressively meaningless job title, is gung-ho. “I am in no doubt that we should run the event and promote it on social media.” he says, listing a series of reasons why the conference should go ahead. You would have to have a heart of stone not to laugh at the second one, where he says that moving the conference would “Promote the idea that our work is not essential“. Steve, you’re the ‘Executive Director of Regulatory Futures and Innovation’ for a glorified think-tank which doesn’t do anything. Nobody thinks that what you do is essential.
So here we are: Wilmslow / London’s finest, the most senior people in the ICO whose collective salaries are around a million pounds, all coming to the same view. They think the conference should go ahead. Obviously, Denham is the final decision maker, but Arnold plainly thinks he has his finger on the pulse: “I think she will be persuaded by the consensus of the ET (Executive Team)”.
He’s wrong.
Denham has already indicated a number of reasons that give her pause – the first is that she is a Crown appointee (fair enough), though the second is illuminating about what motivates her: “we will not be able to do any media or social“. Denham doesn’t really care about the thousands of people who are due to attend, and the dozens of ICO staffers who have worked to put the event on – the fact that her speech won’t be touted on Twitter is plainly a significant motivating factor. In the end, presented with the universal view that the conference should go ahead, she goes the other way:
“Dear all – thanks for your thoughts and advice on the go/ no go decision for the DPPC. After consideration, I have decided to postpone the conference in respect of the period of national mourning for the passing of Prince Phillip. As a Crown appointee and non-British citizen, I need to take account for the traditions of British public life. This decision feels right to me in all the circumstances.”
Whether the conference went ahead or not doesn’t really matter. There is no particularly wrong or right outcome. But I think it’s fascinating that Denham ignores the collective view of her highly paid (I’d say overpaid) and lavishly stocked Executive team to make a decision based on her feelings. There’s no real indication that she has listened to their advice, or even cares what it is. The reason she gives – taking account of “traditions of British public life” – is gibberish, and I suspect it’s a cover for the lack of PR. Socrates is credited with saying that the unexamined life is not worth living, but for Denham, it’s possibly more like the unobserved life.
I think this small, ultimately unimportant decision is nevertheless the blueprint of how things get done in Denham’s ICO. We’ll raid Cambridge Analytica and I’ll announce it on TV before I’ve got the warrant. We’ll fine Facebook on the basis of a conspiracy theory (and when that evaporates, we’ll do it anyway to save face). We’ll rush out the first GDPR enforcement notice to promote a report, even though it’s completely unenforceable. We’ll fine British Airways a stupid amount of money based on an unfinished, unpublished formula. All of these disastrous decisions were made to get headlines, without thinking through the consequences, and it seems to me, without any appreciation of the facts or the reality of the situation. The Cambridge Analytica / SCL raid led to nothing but a grudging acknowledgement that neither was involved in the Brexit referendum. The Facebook fine led to a secret deal to spare Denham’s blushes over allegations of bias. The AIQ enforcement notice was quietly withdrawn and replaced. The BA fine was reduced by roughly 90%, and don’t let anyone tell you this was because of COVID, because the final notice says that it wasn’t.
I think Denham makes all of her decisions like she made the conference one – based on instinct, not facts or analysis. The ICO didn’t have such a wayward record of flawed decisions before she took over – their hallmark was inaction, not the chaotic, ill-judged succession of attention-seeking wheezes that Denham is responsible for. I do not believe it is unfair to say that her legacy is embarrassing, and given the apparent lack of influence her Executive Team have on her, it’s reasonable to lay the blame for all these daft decisions at her door. I think it’s unlikely that the next Commissioner will have such terrible judgement, but I don’t think we should take that chance.
Denham’s successor has either been recruited or is about to be: they should be the last Commissioner. Putting all of this power in the hands of one ultimately unaccountable person is a disaster waiting to happen. You might get a Chris Graham, happy to make speeches and let everyone else get on with things, but we’ve just had a Liz Denham and it has been one hopeless decision after another. The next Commissioner should be tasked with doing three things. First, undo the obsession with tech and peripheral issues like online harms. Second, abandon luxury items like the sandbox, and concentrate on enforcement and complaint handling. Finally, prepare the ground for the abolition of the role of Commissioner in favour of a Commission, where the power of the office is diluted and one person cannot derail the work of an important regulator to suit their whims and personal interests.