Quis custodiet ipsos custodes

Award-winning journalist Carole Cadwalladr took to Twitter on Thursday to share her disappointment at a revelation that the Information Commissioner’s Office will not be providing a final report to Parliament on Operation Cederberg, the long-running, multi-million pound investigation into politics and analytics, which Elizabeth Denham decided to prioritise over preparing her office for the biggest change to Data Protection law in two decades:

The ICO’s investigation into Cambridge Analytica was genuinely ground-breaking. See below: ‘Data crimes are real crimes.’ We’ve been hanging on for the final report. But today, we learned it will not come. Why?? It’s deeply odd. Has the @ico been sat on?

Full marks to Cadwalladr for getting the ICO’s twitter handle wrong, leading many of her tinfoil hat wearing followers to believe that the Commissioner’s official Twitter account had been restricted (@ICO is a bitcoin account that hasn’t tweeted since 2019). She went on to identify a possible answer to who might be sitting on the ICO:

.@IanCLucas – an ex-member of the DCMS committee – points out that @michaelgove – who refused to answer questions from the committee & who is Dominic Cummings’s closest ally – is Elizabeth Denham’s boss.

Cadwalladr might try to hide behind Lucas as the source of this claim, but she’s not presenting it as Lucas’ opinion or interpretation; he “points out” that Gove is Denham’s boss. This is presented as fact, and while I don’t know how many of Cadwalladr’s 500,000+ followers saw the tweet, more than 300 of them retweeted it at the time of writing. The problem is, Michael Gove is not Elizabeth Denham’s boss, because Denham doesn’t have a boss. She is independent and for all practical purposes, answers to no-one. We’ll come back to that.

You’d think that Cadwalladr, who wrote the most fawning profile of Denham imaginable in 2018, and Lucas, who heard evidence from her on multiple occasions while a member of the DCMS committee, would have a rudimentary understanding of how the ICO works, but instead, they were happy to circulate this falsehood. Either they are really lazy people, unwilling to do even basic research, or they are lying to feed a conspiracy theory that Gove and his crony Dominic Cummings are pressuring Denham to cover up their ‘data crimes’.

The Information Commissioner is a Corporation Sole, appointed technically by the Queen but in fact recruited by the Commissioner’s sponsor department, the Department for Digital, Culture, Media and Sport. If Denham had a boss, it would be the Secretary of State, Oliver Dowden, but in terms of the legal status of her office, Dowden is not her boss. He cannot tell her what to do, and he cannot sack her. All of the powers held by the Commissioner are held by Denham personally – anything that the office does is under her authority. Even if she doesn’t personally sign decision or penalty notices, the people who do operate under delegated authority.

Gove is Chancellor of the Duchy of Lancaster, effectively a cabinet minister in the Cabinet Office. The Cabinet Office is responsible for Freedom of Information policy in England, Wales and Northern Ireland and publishes information on the handling of requests. There is a relationship between the ICO and the Cabinet Office (and therefore possibly Gove) on this basis, but this doesn’t translate to Gove being Denham’s boss. Lucas and Cadwalladr must know this, but because their agenda is currently focussed on the missing final report, it doesn’t matter what nonsense they invent in order to get some angry clicks. You won’t find anyone more sceptical of Denham’s abilities than me, but Lucas and Cadwalladr’s patronising depiction of her as being under Gove’s thumb is baseless. The problem with Denham is that she has terrible judgment and nobody can stop her from exercising it.

Denham did say that she would issue another, hopefully final report about Cambridge Analytica when she appeared before Parliament in July 2019 (a What Do They Know applicant helpfully pinpoints the exact moment here: https://www.whatdotheyknow.com/request/reports_into_cambridge_analytica#incoming-1520247). This did not happen, and a number of vocal critics of Cambridge Analytica (and erstwhile Denham cheerleaders) like Dr Emma Briant and Professor David Carroll have criticised the Commissioner for failing to follow through on this commitment. The problem is that if you think this is a serious matter, the solution isn’t to pretend that Denham is held back by the Cabinet Office.

Legally, the explanation given to Briant for the absent report (all the way back in June, it turns out) is correct – reports are issued at the discretion of the Commissioner, like everything else the Commissioner does. You can complain about the ICO’s activities to the Parliamentary and Health Service Ombudsman but their strongest power, exercised very rarely, is to tell Parliament how very cross they are. If you delve to the back of the Data Protection Act, you’ll find that the only way in which the Commissioner can be removed is an address from both Houses of Parliament, following a report from a minister of the Crown (any minister, mind), and only where the Commissioner is guilty of serious misconduct, or no longer fulfils the conditions required for the performance of their functions.

This is the real problem. Denham is almost bulletproof. She can promise reports that never materialise. She can give contracts to her friends without putting them out to tender. She can promote the commercial interests of PR guys cosplaying as Data Protection experts. She can, fundamentally, fail to regulate the laws she is paid to enforce, whilst pursuing a parade of self-indulgent nonsense that benefits no-one. Even though I would put Cederberg in that category, those who think that our very democracy is at stake should ask themselves why it’s so wrong for others to allegedly mislead and misinform for political purposes, but it’s fine when they do it themselves.