The Times published an interesting story on Saturday about businesses being approached by the Information Commissioner’s Office. According to the story, thousands of small business owners and landlords have received “heavy-handed” letters about the annual fee which many organisations are liable to pay under the Data Protection Act 2018. The GDPR abolished the requirement for controllers to register with their supervisory authority, but the bureaucracy has been maintained to provide funding for the ICO’s Data Protection activities. Ostensibly, the ICO chasing up people who by law owe them money should be uncontroversial, but like most things that Wilmslow gets involved in, it isn’t that simple. For one thing, I don’t know how the ICO is selecting their targets, but as the Times reports, a lot of recipients are actually exempt. Half of the clients of a tax advisor quoted are exempt, and I’ve been approached by a number of people being chased over dormant or dead companies. It would be interesting to know what criteria is being used.
A bigger concern is what the ICO is going to spend the money on. Small businesses have to pay the ICO at least £35 per year, but their spokesperson said in the article that “The fees are used to provide services to help organisations process and manage the personal data they are responsible for in line with their legal obligations and in ways that may inspire public confidence“. I’d question whether the ICO will itself inspire much public confidence, and whether businesses will be as keen to pay up, when they find out what the ICO has been spending their money on. A series of fascinating FOI requests on What Do They Know, as well as requests I have made, demonstrate that services to help organisations aren’t the only essentials on which the ICO budget is spent.
In the 12 months leading up to the end of November 2019, the ICO spent £49,043.16 on first and business class flights, luxury enjoyed by eight senior ICO officials on just 20 occasions. Elizabeth Denham CBE turned left most often, with 7 of the flights at a cost of £15,793.88, closely followed by her deputy James Dipple-Johnstone, who was lucky enough to escape the indignity of economy class on five occasions, for the bargain price of £10,612.70. Fans of Mr Dipple-Johnstone’s idiosyncratic stewardship of the ICO budget will remember his expenses claim while caught out while on a jolly to conferences in Asia and New Zealand. When his flight from Doha was diverted to chilly Vienna, he was prevailed upon to buy a jumper and some warm trousers, but thankfully the ICO was able to pick up the tab. Other Wilmslow luminaries taking advantage of the ICO’s seemingly generous travel policies included the Director of Freedom of Information Gill Bull, the Director of Investigations Stephen Eckersley, one of Denham’s other deputies Steve Wood and Simon McDougall, friend of the advertising industry (he does have a job of some kind, but I have no idea what it is). The most expensive single booking was for the Director of Strategic Policy Amanda Williams, whose airmiles came at a cost of £4419.32. Williams took only one luxury trip, so it’s nice to know that it counts.
To put this already profligate spending into perspective, Denham’s flights accounted for the fees of 450 small businesses, while Dipple-Johnstone’s swallowed 303. Williams’ chart-topping trip gobbled up 126 small business fees by itself. In total, the cost of first and business class flights for the pampered elite at the ICO’s top table ate up 1400 small business fees. So much for services to help them, all of these companies paid for Mrs Denham and her courtiers to get extra legroom and hopefully some bubbles as they wait to take off. I’m sure that whichever three small businesses stepped in to fund Dipple-Johnstone’s cold weather ensemble are glad he didn’t get a chill.
But that is not all. The only place I ever seen Denham in the real world is the First Class Lounge at Euston Station, but this is unlikely to have been a one-off visit for the Commissioner. Of the 43 first class rail journeys made in the same period by ICO staff, 32 were claimed by Denham, with the other eleven split between the usual suspects (JDJ managed only three, with Steve Wood nabbing 5). The costs of the first class trips were obviously lower than the flights (£5777.75, with £3806.65 accounted for by Denham) but nevertheless, I’m sure the 108 small businesses who kept the Commissioner and her colleagues away from the indignity of standard class will feel that their contribution to the work of the ICO was not wasted. We cannot expect the leaders of the UK’s Data Protection hub to go without free tea and coffee and those lumpy chocolate biscuits that people pretend they are taking for their children.
Of course, you might accuse me of hypocrisy as I unashamedly go first class on a regular basis. I write this on a Sunday afternoon, knowing that I will be in First Class tomorrow morning. The point is whose money I am spending. When I charge expenses to clients, I only ever invoice for standard class prices, and 2040 Training Ltd is a private company of which I am the sole shareholder. I’m not spending your money, or that of millions of businesses that I am cajoling to pay up. Moreover, doing less than half of my work journeys in First Class is about the only corporate expense that has any direct benefit to me personally. The same cannot be said for the ICO and Elizabeth Denham. As I wrote about last year, the ICO spent just shy of £18,000 on executive coaching for Denham. As revealed in another WDTK FOI request that the ICO answered 4 months late, the former Canadian Minister for Trees Philip Halkett was hired without any external advert or tender process. I followed up this request with one of my own for recorded information about some of the contracts. I asked what qualified Halkett for such special treatment, and ICO explained that as her former executive coach, he was “uniquely placed to deliver the service“. The only recorded information they could give me about what he provided was a single line in the contract (the rest of which was withheld). 514 small businesses paid their fees so that Halkett, a retired Canadian with no experience in Data Protection, could provide “coaching and strategic advice as required by the Commissioner from time to time“.
Needless to say, none of the UK fee paying businesses were permitted to put themselves forward for the coaching work, or for the £20,000 ‘service excellence’ consultancy (571 small business fees) awarded without a tender process to an academic in Canada. The ICO’s own lawyers questioned whether that contract had been awarded lawfully, only to be told by Director of Resources Andrew Hubert that “The ICO appointed Mark Colgate as he is the author of the methodology we wanted to use so uniquely placed to present that methodology to our staff. Basically he is sole author and sole supplier. We are happy to accept the procurement risk on that basis.” The emails show that neither Procurement or the ICO’s Commercial Legal team were involved in the process of hiring Colgate. Whether ICO staff actually needed his TOFU-based customer service guff is debatable, but the idea that none of the hundreds, if not thousands of UK-based customer service experts who have to fund the ICO were even worth considering, but this bloke from Denham’s home town was the only possible candidate is fanciful. That no proper processes were followed and the ICO hired Colgate on the basis of a one-page emailed proposal that boils down to ‘I’ll do some training and give your team managers my book’ ought to concern everyone.
Taken together, these FOI requests paint an odd picture. Senior officers travel the world in first class to attend conferences that build their profiles, but offer scant benefits to UK-based businesses. Friends of the Commissioner are paid thousands of pounds without any due process. The most charitable way I can describe this is self-indulgent and lacking in oversight, but the problem is that Denham’s tenure is characterised by poor judgment. The Information Commissioner’s Office has spent millions of pounds investigating the Cambridge Analytica / Facebook ‘scandal’ only to find that it didn’t involve UK Facebook users. That investigation culminated in a bizarre humiliation, with Facebook invited to repudiate the whole thing on the ICO’s own website, and commended by the Commissioner for their sterling privacy work. The massive BA and Marriott fines, wildly out of proportion when compared to the rest of Europe, appear to be in disarray, delayed for three months without any explanation. Confirmation that this had happened had to be dragged out of Wilmslow by lawyers and journalists who realised that the time limit to complete them was running out. There is still no formal statement on the ICO’s website about this massive development. Journalists attending appeals against enforcement action against Leave.EU and Eldon Insurance tell of the ICO’s own barrister admitting that the ICO’s decision-making process fell short of what should be expected, with no internal records of the decision to act available. The outcome of that case is coming in February.
A regular reader of this blog complains that every other entry is just me moaning about Liz Denham, and it’s true that I am a long-standing driver of negative sentiment (as I was once delightfully labelled by the ICO’s PR people). But this isn’t just the random potshots of a disaffected show-off. The ICO’s staff (i.e. the people who actually do the work rather than chase the headlines) are famously paid well below the market rate, and yet the ‘Leadership Team’ are circling the world in First Class, hiring their mates and botching high profile investigations that probably never should have started. 2040 Training has paid its fee for 2019/20, but I wonder what I’m getting for my money. According to the ICO Annual Report, Elizabeth Denham is paid £160,000 per annum, plus a “non-consolidated, non-pensionable annual allowance of £20,000“. If she wants coaching, she can afford to pay for it herself. If she needs coaching (and the meltdown I describe above suggests that she might), she is in the wrong job. At the very least, she should pay back the £18000 paid to Halkett and stop expecting the fee-paying organisations of the UK to fund her taste for luxury travel. The rumours circulating government suggest that the ICO’s sponsor department, the DCMS, is for the chop. If that is true, before their time runs out, they must dig into Denham’s chaotic, self-indulgent regime and ensure that the thousands of businesses who keep the ICO afloat are not being taken for a ride.