A new report from the House of Commons Justice Committee, the Committee responsible for examining the expenditure, administration and policy of the Ministry of Justice and associated public bodies, has looked at the ICO and expressed a series of concerns. The headline concern in the Report, The functions, powers and resources of the Information Commissioner, is that the ICO is facing a funding shortfall of £42.8 million that may have to be paid for by the taxpayer as a result of the data protection reform package.
Expanded responsibilities and funding shortfall
The Committee see the ICO’s responsibilities expanding dramatically as a result of EU data protection reform and the possible implementation of recommendations in the Leveson Report. The removal of the notification fee payable to him by data controllers and other funding cuts could compromise this work unless the government finds a solution.
The Committee commends the ICO for handling more casework and significantly cutting the backlog of freedom of information appeals at the same time as reducing his budget. The funding for freedom of information work has been cut by 23% from £5.5 million in 2011–12 to £4.25 million in 2012–13.
In line with public spending targets, the ICO has also planned for a further cut of 6% in 2013–14 and the Ministry of Justice has asked the Commissioner to prepare a business case showing how the ICO would be affected by a further 5% cut in that year.
Penalties
The Report reiterates the Committee’s recommendation that the penalties for data protection offences must be increased to provide a more effective deterrent. It states that the case of construction companies using an illegal blacklist – which prevented individuals from obtaining work because of their trade union links – illustrates the need for greater sanctions. The £5,000 fine that was imposed on the company which compiled the blacklist shows that the scale of data protection offences is not matched by the penalties available to courts.
Sir Alan added:
‘We do not understand why the Government has not adopted the recommendation made by us and other parliamentary committees that custodial sentences should be made available for breaches of section 55 of the Data Protection Act. This issue should not be lost in wider data protection enforcement questions arising from the Leveson Report.’
Audits
The Report also raises concerns that a significant number of public sector bodies that handle sensitive private data have refused free audits from the ICO that could identify security problems in the way they are handling data. The MPs call for compulsory audits to be extended to NHS Trusts and local councils, and say that it is shocking that so many public sector organisations that handle sensitive data should refuse a free audit.
The Committee also reiterates its view that the Information Commissioner should be granted greater independence from the executive by being made directly responsible to, and funded by, Parliament.
