Open Rights Group

Home Data: a new direction Consultation Guidance UNDERMINING INDEPENDENT OVERSIGHT

UNDERMINING INDEPENDENT OVERSIGHT

5.2 Strategy, Objectives and Duties & 5.3 Governance Model and Leadership

The Government is proposing to introduce a new duty for the ICO to balance enforcement against economic interests. The Government is also asking to introduce a new power for the Secretary of State for DCMS to dictate strategic priorities to the ICO. Finally, the Government want to have the power to amend the salary of the Commissioner without Parliamentary approval.

These proposals are fundamentally incompatible with the idea of effective, independent oversight. It would give the Government control of a watchdog that is supposed to monitor the Government, and it would prevent enforcement against harmful but profitable business practices.

In our answer to Q5.2.4, we explain how:

  • Tasking the ICO with a new duty to have regard of growth and innovation would encroach market failures and legitimise harms.
  • Innovation needs boundaries and scrutiny, not a licence to harm.

In our answer to Q5.2.11, we explain how:

  • The Secretary of State for digital must not be allowed to dictate the strategic priorities of the watchdog is supposed to hold the Secretary and the Government to account.

In our answer to Q5.3.5, we explain how:

  • The Government must not be allowed to amend the salary of the ICO without Parliamentary approval, as this would expose Commissioners to retaliation.

The government proposes to strengthen the ICO’s existing obligations by placing a new duty on it to have regard for economic growth and innovation when discharging its functions.

Q5.2.4. To what extent do you agree with the proposal to introduce a new duty for the ICO to have regard to economic growth and innovation when discharging its functions?

We strongly disagree with “the proposal to introduce a new duty for the ICO to have regard to economic growth and innovation when discharging its functions” (Q5.2.4). Regulators must enforce the law, and they must put data rights over profits. Furthermore, this policy would promote impunity for harmful but profitable business practices. In turn, this would expose millions of UK residents to protracted harm by business models that need to go.

Q5.2.4a. Please explain your answer, and provide supporting evidence where possible.

A Regulators’ job is to uphold data rights of individuals, enforce the law against offenders, and bring organisations into line with regulatory and safety standards. Introducing a duty to measure these objectives against the economic impact of enforcement is wrong and nonsensical for several reasons.

A new duty to have regard of growth would encroach market failures and legitimise harms. Business models are usually part of the issue the Regulator is called to resolve. Evidence shows that there is a clear dependency between data-extractive business models and irresponsible or malicious market players.1 An egregious example of this relationship is given by the adtech industry, where illegality and abuses are at the heart of their business model.2 Claiming that law enforcement or regulation will hamper economic growth is also the single, most abused scarecrow by businesses that do not wish to abide by the law. For instance,

  • Google3 and the adtech industry4 reiterated over the years that toxic online advertising surveillance is necessary for “financial sustainability”.
  • After losing in Court, Facebook argue that enforcing the Schrems II judgement would have “devastating” and “irreversible” consequences on its business.5

Therefore, it is indisputable that asking the ICO to balance their enforcement against these considerations will only make their job more difficult. Furthermore, the fact that businesses are allowed to profit with impunity from their own illegality is a frequent concern with nowadays’ tech companies. Therefore, this proposal is wrong, and an incitement to commit such abuses.

While irresponsible and malicious businesses would greatly benefit from the introduction of these statutory duties, responsible businesses would be greatly damaged. Responsible businesses would find themselves in an environment where “crime does pay”, and face unfair competition from irresponsible or malicious (but highly profitable) businesses. Ultimately, this policy would create a race to the bottom by incentivising an organisation to maximise profits regardless of the impact of their practices against individuals: the more they grow, the less they can be held to account.

This also means that we strongly oppose any proposal “to oblige the ICO to undertake and publish impact assessments, as well as conduct enhanced consultation, when developing codes of practice, and complex or novel guidance” (Q5.5.1. to Q5.5.5). Regulatory guidance should clarify how the law applies in practice, not legitimise illegal behaviours because of their profitability or economic relevance. Regulation is meant to drive change and address harmful business practices.

Innovation needs boundaries and scrutiny, not licence to harm. Imposing a duty to innovate on the ICO would be detrimental. Innovation without any other connotation means merely new things, lacking any indication on whether these are desirable, able to solve existing problems, and benefit society as a whole.

By failing to take this distinction into due account, imposing a duty to “support innovation” on the ICO risks:

  • Enabling the UK Government to define what they consider “innovation”, thus undermining the independence of the ICO by being able to dictate what the ICO should enforce against.
  • Exposing millions of UK Residents to harm from new things that are harmful.

Indeed, there is decisive and growing evidence that technology has either been weaponised against vulnerable individuals or resulted in negligent, unintended, adverse consequences for an increasing number of people. Without the pretence to draw an exhaustive picture, personal data is constantly being exploited to discriminate individuals’ upon their weaknesses, anxieties,6 opinions, or protected characteristics such as identity, race and gender.7 Digital platforms overwhelmingly rely on business models whose financial sustainability depends on polarisation and misinformation,8 thus harming social cohesion and the democratic discourse. Further, technology is leading to pervasive surveillance at work,9 in schools,10 at home11 and in public places,12 as well as against journalists and activists.13

It follows that Government plans to focus on “innovation” are ill-focused. Instead, the context we face requires boundaries and regulatory intervention to shift incentives, and ensure that investments support innovation that is ethical and bring benefits for society and the individuals concerned.

The government proposes to introduce a new power for the Secretary of State for DCMS to periodically prepare a statement of strategic priorities to which the ICO must have regard when discharging its functions.

Q5.2.11. To what extent do you agree with the proposal for the Secretary of State for DCMS to periodically prepare a statement of strategic priorities which the ICO must have regard to when discharging its functions?

We strongly disagree with the proposal “to introduce a new power for the Secretary of State for DCMS to periodically prepare a statement of strategic priorities to which the ICO must have regard” (Q5.2.11).

Q5.2.11a. Please explain your answer, and provide supporting evidence where possible.

The ICO is a watchdog whose function is to monitor and enforce the law against public and private bodies, including the Government. Giving such power to the Secretary of State for DCMS would create an outstanding conflict of interest and undermine the independence of the Information Commissioner.

Q5.3.5. To what extent do you agree that the salary for the Information Commissioner (i.e. the proposed chair of the ICO in the future governance model) should not require Parliamentary approval?

We strongly disagree “that the salary for the Information Commissioner should not require Parliamentary approval” (Q5.3.5).

Q5.3.5a. Please explain your answer, and provide supporting evidence where possible.

The ICO is a watchdog whose function is to monitor and enforce the law against public and private bodies, including the Government. Providing such power would create a situation where the Government can retaliate against Commissioners’ who do not ensure impunity to the Government or otherwise condone their action.

1Privacy International, The UN Report on Disinformation: a role for privacy. Available at: https://www.privacyinternational.org/fr/node/4515

2Norwegian Consumer Council, Time to Ban Surveillance-Based Advertising. Available at: https://www.forbrukerradet.no/wp-content/uploads/2021/06/20210622-final-report-time-to-ban-surveillance-based-advertising.pdf

3Euractiv, Digital Brief, powered by Facebook: Microtargeting debate, Protecting gig workers, Apple antitrust. Available at: https://www.euractiv.com/section/digital/news/digital-brief-powered-by-facebook-microtargeting-debate-protecting-gig-workers-apple-antitrust/

4IAB Europe, Open Letter on the Digital Services Act (DSA) and Digital Advertising. Available at: https://iabeurope.eu/wp-content/uploads/2021/07/16th-July-2021-DSA-Digital-Advertising-Open-Letter-From-Industry-Players-Associations.pdf

5Reuters, Facebook faces prospect of ‘devastating’ data transfer ban after Irish ruling. Available at: https://www.reuters.com/business/legal/facebook-data-transfer-ruling-irish-court-due-friday-2021-05-14/

6Panoptykon Foundation, Algorithms of trauma: new case study shows that Facebook doesn’t give users real control over disturbing surveillance ads. Available at: https://en.panoptykon.org/algorithms-of-trauma

7DataEthics, The Inherent Discrimination of Microtargeting,. Available at: https://dataethics.eu/the-inherent-discrimination-of-microtargeting/

8Privacy International, The UN Report on Disinformation: a role for privacy. Availableat: https://www.privacyinternational.org/fr/node/4515

9Americal Civil Liberties Union, Amazon Drivers Placed Under Robot Surveillance Microscope. Available at: https://www.aclu.org/news/privacy-technology/amazon-drivers-placed-under-robot-surveillance-microscope/

10Open Knowledge Foundation, Open Knowledge Justice Programme challenges the use of algorithmic proctoring apps. Available at: https://blog.okfn.org/2021/02/26/open-knowledge-justice-programme-challenges-the-use-of-algorithmic-proctoring-apps/

11DataEthics, Being Watched While Working From Home. Available at: https://dataethics.eu/being-watched-while-working-from-home/

12Liberty, Five Reasons Why Facial Recognition Must Be Banned. Available at: https://www.libertyhumanrights.org.uk/issue/five-reasons-why-facial-recognition-must-be-banned/

13The Guardian, Huge data leak shatters the lie that the innocent need not fear surveillance. Available at: https://www.theguardian.com/news/2021/jul/18/huge-data-leak-shatters-lie-innocent-need-not-fear-surveillance