mySociety Response to "Data: A new direction"

mySociety Response to "Data: A new direction"

mySociety

Response summary

About mySociety

mySociety is a not-for-profit charity based in the UK and working internationally. We provide technology, research and data that give people the power to hold their institutions to account.

A key pillar of our work is in improving transparency, and we develop open source Alaveteli software which is currently supporting citizens in over 25 jurisdictions worldwide to make FOI requests. In the UK, we run WhatDoTheyKnow.com, which enables citizens to easily access their right to information and which makes the responses to requests public, for the wider benefit. Having run for over a decade, the site is the largest publicly accessible repository of FOI requests and responses in the UK.

In April 2021, we published "Reforming Freedom of Information: Improvements to strengthen Access to Information in the UK", a report explaining how different FOI jurisdictions in the UK can learn from the best practices of their counterparts. It can be read at: https://research.mysociety.org/publications/reforming-foi

Responses

Due regard to public safety

Q5.2.10. To what extent do you agree with the Government's proposal to introduce specific language recognising the need for the ICO to have due regard to public safety when discharging its functions?

Somewhat disagree

Q5.2.10a. Please explain your answer and provide supporting evidence where possible.

Given that the language in the consultation reflects that specific regimes are available for law enforcement and security services in DPA law, it is unclear why this is needed.

There are good protections for information related to crime and security in existing FOI exemptions. We are opposed to language guiding the ICO's general mission that implies a duty to go beyond that in evaluation of FOI or EIR.

Approval of codes of practice

Q5.5.3. To what extent do you agree with the proposal to give the Secretary of State a parallel provision to that afforded to Houses of Parliament in Section 125(3) of the Data Protection Act 2018 in the approval of codes of practice, and complex and novel guidance?

Strongly disagree

Q5.5.3a. Please explain your answer, and provide supporting evidence where possible.

The ICO has established expertise in producing codes of practice. Parliament has appropriate powers to reject a code of practice. The ICO submission highlights that comparable regulators (OFCOM, FCA) do not currently require this.1 Currently the FOI code of practice is authored by DCMS; given the ICO's general competency in this area, we would support this provision becoming a responsibility of the ICO.

Strategic priorities

Q5.2.11. To what extent do you agree with the proposal for the Secretary of State for DCMS to periodically prepare a statement of strategic priorities which the ICO must have regard to when discharging its functions?

Strongly disagree

Q5.2.11a. Please explain your answer, and provide supporting evidence where possible.

We agree with the ICO response that it would be more appropriate for any statement of strategic priorities (SSP) to be approved by Parliament.2 The special role of the ICO as both a rights-based regulator and a regulator of government means that its independence from government should be greater, not less than, comparable regulators. This is recognised in the consultation document's proposal of a non-binding SSP (par. 346), but it is important to emphasise.

More generally, we would be cautious about an approach that might by absence lead to less strategic focus on the FOI side. ICO's ability to set its own strategy allows appropriate focus on all statutory duties.

Governance model

Q5.3.1. To what extent do you agree that the ICO would benefit from a new governance and leadership model, as set out above?

Strongly agree

Q5.3.1a. Please explain your answer, and provide supporting evidence where possible.

We support a move to a governance board model. This model helps bring additional expertise into organisational strategy.

This is especially important around our concern that the ‘Information Commissioner' job market is primarily international and privacy rights focused.3 As such, Information Commissioners (the chair of the board in the new model) are unlikely to have specific knowledge of the Access to Information regimes in the UK, or even experience regulating this area in general.

A board could be used to bring relevant expertise on Access to Information in the UK into the strategic planning of the organisation. We recommend a board seat be reserved for a member with experience of FOI/Access to information, and that this board seat should be appointed by Parliament.

Public Appointment process

Chair

Q5.3.2. To what extent do you agree with the use of the Public Appointment process for the new chair of the ICO?

Strongly disagree

Q5.3.2a. Please explain your answer, and provide supporting evidence where possible.

The Information Commissioner has significant oversight of the government's Access to Information obligations and it is in principle inappropriate for the government to appoint this function.

Similar existing offices are not appointed by the Public Appointment process. For instance, The Parliamentary and Health Service Ombudsman is appointed by Parliament and the Scottish Information Commissioner is appointed by the Scottish Parliament.

As substantial parts of the ICO responsibilities are not encompassed by an Ombudsman-like role, there is a practical balance to be found. If the appointment process is Government led, Parliament should have substantive input into the appointment process.

The consultation document claims that "The current appointments process for the Information Commissioner is transparent and well-respected, balancing the importance of the ICO's independence with appropriate oversight by the government and Parliament." (par. 357). However the DCMS committee has raised issues both with delays to hearings and the process more generally:

"The preferred candidates were known to the Government well in advance of the summer recess of Parliament and we consider it a failure of Government that this pre-appointment was not held in July. We have broad concerns about our experience of how the pre-appointment process is working and we will question Ministers more closely on these matters in the future."4

The Committee also raised that there has been a retreat from meaningful engagement with Parliament on the appointment. The government in 2011 had agreed to abide by the decision of the DCMS committee in approving or rejecting the candidate for Information Commissioner. This was not the case in 2021.

"We are disappointed that the Government did not extend its offer of abiding by the decision of the Committee on the appointment of candidate for Information Commissioner. We recommend that the Government give this same undertaking for all future appointments to the position of Information Commissioner."5

As such, we cannot agree that the current process is working well and should be uncritically adopted by the new framework.

We echo the committee's recommendation that the decision of the DCMS committee should have real weight and they should have the ability to reject candidates.

Non-executive board members

Q5.3.3. To what extent do you agree with the use of the Public Appointment process for the non-executive members of the ICO's board?

Strongly disagree

Q5.3.3a. Please explain your answer, and provide supporting evidence where possible.

Non-executive board members represent an opportunity to bring in additional knowledge and experience when shaping the strategic direction of the organisation. This could be especially useful in bringing in skills relevant to Access to Information and the more Ombudsman like features of the ICO.

Given the Information Commission's role as a government watchdog, it would be appropriate that board seats reserved for this aspect of the role be appointed by a Parliamentary process, rather than the government-led Public Appointment process.

CEO

Q5.3.4. To what extent do you agree with the use of the Public Appointment process for the new CEO of the ICO?

Strongly disagree

Q5.3.4a. Please explain your answer, and provide supporting evidence where possible.

We support the ICO position that the proposed board should have power to appoint the CEO (in line with similar regulators).6 This avoids a reduction in the ICO's operational independence from the government.

Biometrics Commissioner

Q5.8.2. To what extent do you agree that the functions of the Biometrics Commissioner and the Surveillance Camera Commissioner should be absorbed under a single oversight function exercised by the ICO?

Strongly disagree

Q5.8.2a. Please explain your answer, and provide supporting evidence where possible.

In general, we have a concern that the ICO's quasi-judicial functions around Freedom of Information are already crowded out by their much larger data protection function. We have concerns that oversight and appointments processes that may be well suited for a privacy/data protection role are poorly suited to Freedom of Information roles (see response to Q5.9.2).

The submission of the Biometrics Commissioner and Surveillance Camera Commissionersimilarly highlights the quasi-judicial nature of that office.7 Given this, adding another set of responsibilities to the ICO's long existing list deserves more thought and focus than this consultation provides.

Any other reforms

Q5.9.2. In addition to any of the reforms already proposed in 'Reform of the Information Commissioner's Office' (or elsewhere in the consultation), what other reforms do you think would be helpful to improve the effectiveness of the ICO?

Reform A: The independence and capacity of Access to Information functions should be improved

If pursuing overall ICO reforms that have an indirect impact on the independence of Access to Information responsibilities, this could be balanced by making a new commitment to the ICO's independence in other respects. Specifically, funding and oversight lines of the Access to Information portfolio should move from government to Parliament (and in general, funding should be increased).

We explore further details of this approach in our 2021 report "Reforming Freedom of Information"8, but reforms along this line have also been suggested by the 2006 Select Committee on Constitutional Affairs9, a 2014 Public Affairs Committee10, openDemocacy's 2020 Art of Darkness report11, and Transparency International who recommended exploring this approach in their evidence to the 2021 Public Administration and Constitutional Affairs Committee.12

Reform B: Resolve tension between different functions of ICO by separating the offices

Many of the structural difficulties identified in this response are because two different portfolios (Privacy and Access to Information) have been combined in a single office. Because of the Access to Information role, many of the consultation's proposed changes are inappropriate as they reduce the independence of a regulator of government. The more the Information Commissioner is an economic regulator in alignment with the overall government direction, the more it is inappropriately designed for its government watchdog functions.

Taking this problem seriously requires significant changes from proposed strategy and appointment processes, as we have indicated in response to other questions. A potential resolution to this is to split off the ‘Access to Information' portfolio into a separate role (operating under the officer of Parliament model). The resulting ‘Privacy' and ‘Access to Information' Commissioners could then both engage in the strategy-forming, funding and oversight better suited to their respective positions.

We explore further details of this approach in our 2021 report "Reforming Freedom of Information".13 Multiple models are possible along these lines, with varying amounts of separation between the two organisations. As one example, the equivalent offices in Canada are separate, but are based in the same building and for many years shared a common set of services. 14

Notes


1:ICO (2021), ICO response to DCMS consultation "Data: a new direction", par 219

2:ICO (2021), ICO response to DCMS consultation "Data: a new direction", Par 205

3:Parsons, Alex (2021), To defend FOI rights, we need a separate FOI Commissioner, mySociety blog, https://www.mysociety.org/2021/09/10/to-defend-foi-rights-we-need-a-separate-foi-commissioner/

4:DCMS Committee (July 2021), Chair comments on delay to appointment of Information Commissioner, https://committees.parliament.uk/committee/378/digital-culture-media-and-sport-committee/news/156691/chair-comments-on-delay-to-appointment-of-information-commissioner/

5:UK Parliament (September 2021), Pre-appointment hearing for Information Commissioner, https://publications.parliament.uk/pa/cm5802/cmselect/cmcumeds/260/26003.htm

6:ICO (2021), ICO response to DCMS consultation "Data: a new direction", Par 210-2011

7:Surveillance Camera Commissioner's Office (2021), What we talk about when we talk about biometrics, https://videosurveillance.blog.gov.uk/2021/10/12/what-we-talk-about-when-we-talk-about-biometrics/

8:Rumbul, R. and Parsons, A. (2021). Reforming FOI. [online] mySociety Research. Available at: https://research.mysociety.org/publications/reforming-foi

9:Select Committee on Constitutional Affairs (2006), Seventh Report, Par 106, https://publications.parliament.uk/pa/cm200506/cmselect/cmconst/991/99109.htm

10:Public Administration Committee (2014), Who's accountable? Relationships between Government and arm's-length bodies, par 64, https://publications.parliament.uk/pa/cm201415/cmselect/cmpubadm/110/11009.htm

11:Amin, Lucas (2020), Art of Darkness: How the government is undermining Freedom of Information, openDemocracy, p. 31

12:Transparency International UK (2021), Written evidence https://committees.parliament.uk/writtenevidence/39625/pdf/

13:Rumbul, R. and Parsons, A. (2021). Reforming FOI. [online] mySociety Research. Available at: https://research.mysociety.org/publications/reforming-foi

14:La Forest (2005), [Canada] The offices of the Information and Privacy Commissioners: The merger and related issues. Report of the Special Advisor to the Minister of Justice, https://www.justice.gc.ca/eng/rp-pr/csj-sjc/atip-aiprp/ip/rep-rap.pdf, p. 19