The ICO has recognised that the way in which data is processed is rapidly changing. In early 2022, the ICO conducted a six-month-long consultation process with businesses, organisations, and people listening to their experiences of working with the ICO.
Following the consultation, the ICO put together a strategic plan titled “ICO25” documenting its objectives. On 14 July 2022, ICO25 was made available to the public and published on the ICO’s website. ICO25 is a three-year plan setting out the ICO’s regulatory approach and priorities.
Speaking at the launch of ICO25, UK Information Commissioner John Edwards said:
“My most important objective is to safeguard and empower people, by upholding their information rights. Empowering people to confidently share their information to use the products and services that drive our economy and society.
My office will focus our resources where we see data protection issues are disproportionately affecting already vulnerable or disadvantaged groups. The impact that we can have on people’s lives is the measure of our success. This is what modern data protection looks like, and it is what modern regulation looks like.”
ICO25 sets out four distinct objectives that the ICO is going to focus on for the next couple of years. These are to:
- Safeguard and empower people;
- Empower responsible innovation and sustainable economic growth;
- Promote openness, transparency, and accountability; and
- Develop the ICO’s culture, capability, and capacity.
The plan itself goes into details of what the ICO is intending to focus on over the next three years to help them achieve the above objectives.
For example, in relation to the first objective, the ICO will help people to understand their information rights so that they can decide how best to use and trust products and services that require you to input your personal data. In this respect, the ICO also wants to focus on tackling predatory calls. They have previously issued a large number of fines to organisations that have been found to be making predatory calls. With their recently increased powers (under the Data Reform Bill), the ICO is proposing to use their new powers to have a greater impact on predatory marketing.
The plan also focuses on certainty and flexibility for businesses. This stems from the Data Reform Bill which proposes to reduce the burdens on businesses by moving away from the one-size-fits-all approach and instead assessing the risk of the business’s actual data processing activities. ICO25 sets out how the ICO will tackle this particular element of the Data Reform Bill. An example being, the ICO will publish internal data protection and freedom of information training materials. They will also create a database of ICO advice provided to organisations and the public.
Speaking in relation to more flexibility for businesses, John Edwards has commented:
“Certainty and flexibility remain the two pillars of what I offer to business today, and in how we will support the successful implementation of a new data protection law. Certainty in what the law requires, coupled with a predictable approach to enforcement action, that allows businesses to invest and innovate with confidence. And the flexibility to reduce the cost of compliance.
That support for business and public sector is important in itself, but it is ultimately a means to an end. We help business to help people.”
The plan also sets out how the ICO are intending to support the public sector going forward including a revised approach to public sector fines (see my previous blog on this) and the development of the freedom of information framework including prioritising freedom of information complaints.
Comment
Over a number of weeks, the ICO has been hinting at a number of changes they would be implementing. The ICO25 pulls all of the ICO’s upcoming objectives together and puts them into one document. Whilst ICO25 seems to have come about following a 6-month consultation period it also seems to be heavily influenced by the Data Reform Bill and summarises what steps the ICO will be taking to bring into effect the key themes from within the Data Reform Bill.
How can we help
Ruby Ashby is an Associate in our expert Dispute Resolution team.
If you need any advice concerning the subjects discussed in this article, please do not hesitate to contact Ruby or another member of the team in Derby, Leicester, or Nottingham on 0800 024 1976 or via our online enquiry form.
Contact us