mySociety Response to "Data: A new direction"

Protecting FOI within a new direction for data

Other formats: Plain text, PDF, EPUB.

Response summary

  • This response explores issues around FOI governance and oversight raised by the DCMS consultation ‘Data: A New Direction'.
  • We are supportive of a board structure for the ICO as a way of bringing in additional expertise. We recommend a specific seat for FOI/Access to Information expertise. This seat should be appointed by Parliament.
  • We believe that the appointment process for the chair of the board (The new ‘Information Commissioner') needs to have a substantive role for Parliament and the ability to reject the government candidate.
  • We oppose measures to extend government control over strategy and CEO appointments beyond the situation for comparable regulators.
  • More generally, reform of ICO governance is an opportunity to set regulation of Access to Information on a more sustainable and independent path.
    • A strong sign that the independence of the FOI functions is considered important would be to transfer funding from DCMS to a parliamentary process similar to the Parliamentary and Health Services Ombudsman and the Office of the Scottish Information Commissioner.
    • It should also be considered whether the different longterm directions of the ‘privacy' and ‘Access to Information' functions of the organisation mean it would be appropriate to divide the Commissioner's Office, and create funding and oversight structures appropriate to each branch.

About mySociety

mySociety is a not-for-profit charity based in the UK and working internationally. We provide technology, research and data that give people the power to hold their institutions to account.

A key pillar of our work is in improving transparency, and we develop open source Alaveteli software which is currently supporting citizens in over 25 jurisdictions worldwide to make FOI requests. In the UK, we run WhatDoTheyKnow.com, which enables citizens to easily access their right to information and which makes the responses to requests public, for the wider benefit. Having run for over a decade, the site is the largest publicly accessible repository of FOI requests and responses in the UK.

In April 2021, we published "Reforming Freedom of Information: Improvements to strengthen Access to Information in the UK", a report explaining how different FOI jurisdictions in the UK can learn from the best practices of their counterparts. It can be read at: https://research.mysociety.org/publications/reforming-foi

Responses

Due regard to public safety

Q5.2.10. To what extent do you agree with the Government's proposal to introduce specific language recognising the need for the ICO to have due regard to public safety when discharging its functions?

Somewhat disagree

Q5.2.10a. Please explain your answer and provide supporting evidence where possible.

Given that the language in the consultation reflects that specific regimes are available for law enforcement and security services in DPA law, it is unclear why this is needed.

There are good protections for information related to crime and security in existing FOI exemptions. We are opposed to language guiding the ICO's general mission that implies a duty to go beyond that in evaluation of FOI or EIR.

Approval of codes of practice

Q5.5.3. To what extent do you agree with the proposal to give the Secretary of State a parallel provision to that afforded to Houses of Parliament in Section 125(3) of the Data Protection Act 2018 in the approval of codes of practice, and complex and novel guidance?

Strongly disagree

Q5.5.3a. Please explain your answer, and provide supporting evidence where possible.

The ICO has established expertise in producing codes of practice. Parliament has appropriate powers to reject a code of practice. The ICO submission highlights that comparable regulators (OFCOM, FCA) do not currently require this.1 Currently the FOI code of practice is authored by DCMS; given the ICO's general competency in this area, we would support this provision becoming a responsibility of the ICO.

Notes (hide):

1: ICO (2021), ICO response to DCMS consultation "Data: a new direction", par 219

Strategic priorities

Q5.2.11. To what extent do you agree with the proposal for the Secretary of State for DCMS to periodically prepare a statement of strategic priorities which the ICO must have regard to when discharging its functions?

Strongly disagree

Q5.2.11a. Please explain your answer, and provide supporting evidence where possible.

We agree with the ICO response that it would be more appropriate for any statement of strategic priorities (SSP) to be approved by Parliament.2 The special role of the ICO as both a rights-based regulator and a regulator of government means that its independence from government should be greater, not less than, comparable regulators. This is recognised in the consultation document's proposal of a non-binding SSP (par. 346), but it is important to emphasise.

Notes (hide):

2: ICO (2021), ICO response to DCMS consultation "Data: a new direction", Par 205

More generally, we would be cautious about an approach that might by absence lead to less strategic focus on the FOI side. ICO's ability to set its own strategy allows appropriate focus on all statutory duties.

Governance model

Q5.3.1. To what extent do you agree that the ICO would benefit from a new governance and leadership model, as set out above?

Strongly agree

Q5.3.1a. Please explain your answer, and provide supporting evidence where possible.

We support a move to a governance board model. This model helps bring additional expertise into organisational strategy.

This is especially important around our concern that the ‘Information Commissioner' job market is primarily international and privacy rights focused.3 As such, Information Commissioners (the chair of the board in the new model) are unlikely to have specific knowledge of the Access to Information regimes in the UK, or even experience regulating this area in general.

Notes (hide):

3: Parsons, Alex (2021), To defend FOI rights, we need a separate FOI Commissioner, mySociety blog, https://www.mysociety.org/2021/09/10/to-defend-foi-rights-we-need-a-separate-foi-commissioner/

A board could be used to bring relevant expertise on Access to Information in the UK into the strategic planning of the organisation. We recommend a board seat be reserved for a member with experience of FOI/Access to information, and that this board seat should be appointed by Parliament.

Public Appointment process

Chair

Q5.3.2. To what extent do you agree with the use of the Public Appointment process for the new chair of the ICO?

Strongly disagree

Q5.3.2a. Please explain your answer, and provide supporting evidence where possible.

The Information Commissioner has significant oversight of the government's Access to Information obligations and it is in principle inappropriate for the government to appoint this function.

Similar existing offices are not appointed by the Public Appointment process. For instance, The Parliamentary and Health Service Ombudsman is appointed by Parliament and the Scottish Information Commissioner is appointed by the Scottish Parliament.

As substantial parts of the ICO responsibilities are not encompassed by an Ombudsman-like role, there is a practical balance to be found. If the appointment process is Government led, Parliament should have substantive input into the appointment process.

The consultation document claims that "The current appointments process for the Information Commissioner is transparent and well-respected, balancing the importance of the ICO's independence with appropriate oversight by the government and Parliament." (par. 357). However the DCMS committee has raised issues both with delays to hearings and the process more generally:

"The preferred candidates were known to the Government well in advance of the summer recess of Parliament and we consider it a failure of Government that this pre-appointment was not held in July. We have broad concerns about our experience of how the pre-appointment process is working and we will question Ministers more closely on these matters in the future."4

Notes (hide):

4: DCMS Committee (July 2021), Chair comments on delay to appointment of Information Commissioner, https://committees.parliament.uk/committee/378/digital-culture-media-and-sport-committee/news/156691/chair-comments-on-delay-to-appointment-of-information-commissioner/

The Committee also raised that there has been a retreat from meaningful engagement with Parliament on the appointment. The government in 2011 had agreed to abide by the decision of the DCMS committee in approving or rejecting the candidate for Information Commissioner. This was not the case in 2021.

"We are disappointed that the Government did not extend its offer of abiding by the decision of the Committee on the appointment of candidate for Information Commissioner. We recommend that the Government give this same undertaking for all future appointments to the position of Information Commissioner."5

Notes (hide):

5: UK Parliament (September 2021), Pre-appointment hearing for Information Commissioner, https://publications.parliament.uk/pa/cm5802/cmselect/cmcumeds/260/26003.htm

As such, we cannot agree that the current process is working well and should be uncritically adopted by the new framework.

We echo the committee's recommendation that the decision of the DCMS committee should have real weight and they should have the ability to reject candidates.

Non-executive board members

Q5.3.3. To what extent do you agree with the use of the Public Appointment process for the non-executive members of the ICO's board?

Strongly disagree

Q5.3.3a. Please explain your answer, and provide supporting evidence where possible.

Non-executive board members represent an opportunity to bring in additional knowledge and experience when shaping the strategic direction of the organisation. This could be especially useful in bringing in skills relevant to Access to Information and the more Ombudsman like features of the ICO.

Given the Information Commission's role as a government watchdog, it would be appropriate that board seats reserved for this aspect of the role be appointed by a Parliamentary process, rather than the government-led Public Appointment process.

CEO

Q5.3.4. To what extent do you agree with the use of the Public Appointment process for the new CEO of the ICO?

Strongly disagree

Q5.3.4a. Please explain your answer, and provide supporting evidence where possible.

We support the ICO position that the proposed board should have power to appoint the CEO (in line with similar regulators).6 This avoids a reduction in the ICO's operational independence from the government.

Notes (hide):

6: ICO (2021), ICO response to DCMS consultation "Data: a new direction", Par 210-2011

Biometrics Commissioner

Q5.8.2. To what extent do you agree that the functions of the Biometrics Commissioner and the Surveillance Camera Commissioner should be absorbed under a single oversight function exercised by the ICO?

Strongly disagree

Q5.8.2a. Please explain your answer, and provide supporting evidence where possible.

In general, we have a concern that the ICO's quasi-judicial functions around Freedom of Information are already crowded out by their much larger data protection function. We have concerns that oversight and appointments processes that may be well suited for a privacy/data protection role are poorly suited to Freedom of Information roles (see response to Q5.9.2).

The submission of the Biometrics Commissioner and Surveillance Camera Commissionersimilarly highlights the quasi-judicial nature of that office.7 Given this, adding another set of responsibilities to the ICO's long existing list deserves more thought and focus than this consultation provides.

Notes (hide):

7: Surveillance Camera Commissioner's Office (2021), What we talk about when we talk about biometrics, https://videosurveillance.blog.gov.uk/2021/10/12/what-we-talk-about-when-we-talk-about-biometrics/

Any other reforms

Q5.9.2. In addition to any of the reforms already proposed in 'Reform of the Information Commissioner's Office' (or elsewhere in the consultation), what other reforms do you think would be helpful to improve the effectiveness of the ICO?

Reform A: The independence and capacity of Access to Information functions should be improved

If pursuing overall ICO reforms that have an indirect impact on the independence of Access to Information responsibilities, this could be balanced by making a new commitment to the ICO's independence in other respects. Specifically, funding and oversight lines of the Access to Information portfolio should move from government to Parliament (and in general, funding should be increased).

We explore further details of this approach in our 2021 report "Reforming Freedom of Information"8, but reforms along this line have also been suggested by the 2006 Select Committee on Constitutional Affairs9, a 2014 Public Affairs Committee10, openDemocacy's 2020 Art of Darkness report11, and Transparency International who recommended exploring this approach in their evidence to the 2021 Public Administration and Constitutional Affairs Committee.12

Notes (hide):

8: Rumbul, R. and Parsons, A. (2021). Reforming FOI. [online] mySociety Research. Available at: https://research.mysociety.org/publications/reforming-foi

9: Select Committee on Constitutional Affairs (2006), Seventh Report, Par 106, https://publications.parliament.uk/pa/cm200506/cmselect/cmconst/991/99109.htm

10: Public Administration Committee (2014), Who's accountable? Relationships between Government and arm's-length bodies, par 64, https://publications.parliament.uk/pa/cm201415/cmselect/cmpubadm/110/11009.htm

11: Amin, Lucas (2020), Art of Darkness: How the government is undermining Freedom of Information, openDemocracy, p. 31

12: Transparency International UK (2021), Written evidence https://committees.parliament.uk/writtenevidence/39625/pdf/

Reform B: Resolve tension between different functions of ICO by separating the offices

Many of the structural difficulties identified in this response are because two different portfolios (Privacy and Access to Information) have been combined in a single office. Because of the Access to Information role, many of the consultation's proposed changes are inappropriate as they reduce the independence of a regulator of government. The more the Information Commissioner is an economic regulator in alignment with the overall government direction, the more it is inappropriately designed for its government watchdog functions.

Taking this problem seriously requires significant changes from proposed strategy and appointment processes, as we have indicated in response to other questions. A potential resolution to this is to split off the ‘Access to Information' portfolio into a separate role (operating under the officer of Parliament model). The resulting ‘Privacy' and ‘Access to Information' Commissioners could then both engage in the strategy-forming, funding and oversight better suited to their respective positions.

We explore further details of this approach in our 2021 report "Reforming Freedom of Information".13 Multiple models are possible along these lines, with varying amounts of separation between the two organisations. As one example, the equivalent offices in Canada are separate, but are based in the same building and for many years shared a common set of services. 14

Notes (hide):

13: Rumbul, R. and Parsons, A. (2021). Reforming FOI. [online] mySociety Research. Available at: https://research.mysociety.org/publications/reforming-foi

14: La Forest (2005), [Canada] The offices of the Information and Privacy Commissioners: The merger and related issues. Report of the Special Advisor to the Minister of Justice, https://www.justice.gc.ca/eng/rp-pr/csj-sjc/atip-aiprp/ip/rep-rap.pdf, p. 19

Related research

Footnotes

1 ICO (2021), ICO response to DCMS consultation "Data: a new direction", par 219

2 ICO (2021), ICO response to DCMS consultation "Data: a new direction", Par 205

3 Parsons, Alex (2021), To defend FOI rights, we need a separate FOI Commissioner, mySociety blog, https://www.mysociety.org/2021/09/10/to-defend-foi-rights-we-need-a-separate-foi-commissioner/

4 DCMS Committee (July 2021), Chair comments on delay to appointment of Information Commissioner, https://committees.parliament.uk/committee/378/digital-culture-media-and-sport-committee/news/156691/chair-comments-on-delay-to-appointment-of-information-commissioner/

5 UK Parliament (September 2021), Pre-appointment hearing for Information Commissioner, https://publications.parliament.uk/pa/cm5802/cmselect/cmcumeds/260/26003.htm

6 ICO (2021), ICO response to DCMS consultation "Data: a new direction", Par 210-2011

7 Surveillance Camera Commissioner's Office (2021), What we talk about when we talk about biometrics, https://videosurveillance.blog.gov.uk/2021/10/12/what-we-talk-about-when-we-talk-about-biometrics/

8 Rumbul, R. and Parsons, A. (2021). Reforming FOI. [online] mySociety Research. Available at: https://research.mysociety.org/publications/reforming-foi

9 Select Committee on Constitutional Affairs (2006), Seventh Report, Par 106, https://publications.parliament.uk/pa/cm200506/cmselect/cmconst/991/99109.htm

10 Public Administration Committee (2014), Who's accountable? Relationships between Government and arm's-length bodies, par 64, https://publications.parliament.uk/pa/cm201415/cmselect/cmpubadm/110/11009.htm

11 Amin, Lucas (2020), Art of Darkness: How the government is undermining Freedom of Information, openDemocracy, p. 31

12 Transparency International UK (2021), Written evidence https://committees.parliament.uk/writtenevidence/39625/pdf/

13 Rumbul, R. and Parsons, A. (2021). Reforming FOI. [online] mySociety Research. Available at: https://research.mysociety.org/publications/reforming-foi

14 La Forest (2005), [Canada] The offices of the Information and Privacy Commissioners: The merger and related issues. Report of the Special Advisor to the Minister of Justice, https://www.justice.gc.ca/eng/rp-pr/csj-sjc/atip-aiprp/ip/rep-rap.pdf, p. 19