DPO conflicts

Response to this request is long overdue. By law, under all circumstances, Information Commissioner's Office should have responded by now (details). You can complain by requesting an internal review.

Dear Information Commissioner's Office,

In the context of Data Protection officers please can you tell me if you have investigated any public authority because of suspected conflict of interest with the role of the DPO, please provide the number of authorities investigated and similarly in respect of private sector DPOs.

Yours faithfully,

Rosie Hought

icoaccessinformation, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit:

[1]https://ico.org.uk/about-the-ico/our-inf...

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

If you have requested advice - we aim to respond within 14 days. 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

Copied correspondence - we do not respond to correspondence that has been
copied to us.

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

For information about what we do with personal data see our [2]privacy
notice.

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

Yours sincerely

The Information Commissioner’s Office

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found
[3]here.

Twitter

Find us on Twitter [4]here.

 

References

Visible links
1. https://ico.org.uk/about-the-ico/our-inf...
2. https://ico.org.uk/global/privacy-notice/
3. https://ico.org.uk/about-the-ico/news-an...
4. http://www.twitter.com/ICOnews

J Roberts left an annotation ()

You might be interested in this story from the Independent newspaper:

'UK government running ‘Orwellian’ unit to circumvent transparency laws and block freedom of information requests'

https://www.independent.co.uk/news/uk/po...

'The British government is operating a secretive internal unit to block requests for information by the public under transparency laws, it has been revealed.'

ICO Casework, Information Commissioner's Office

1 Attachment

17 December 2020

Case Reference: IC-74161-L3P8

Dear Rosie

Please see the attached response to your recent information request. I
apologise for the delay in providing this to you.

Yours sincerely,

Jessica Lalor 
Senior Information Access Officer
Information Commissioner's Office

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 414 6497 [1]ico.org.uk [2]twitter.com/iconews
Please consider the environment before printing this email.
For information about what we do with personal data see our privacy notice
at [3]www.ico.org.uk/privacy-notice.

References

Visible links
1. https://ico.org.uk/
2. https://twitter.com/iconews
3. https://www.ico.org.uk/privacy-notice

Dear Information Commissioner's Office,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Information Commissioner's Office's handling of my FOI request 'DPO conflicts'.

I do not agree that s31 applies to the information requested, or that confirming or denying if it is held would cause prejudice.

you have not set out what prejudice would be caused. Given the hundreds and hundreds of both public authorities and private companies that have DPOs, knowing that the ICO is investigating a particular number will not identify them. Confirming whether it is investigating any would not lead to any particular company or authority being identified as the resposne claims because there are so many overall. Even a motivated intruder as in the MIller case would not be able to ascertain which were being investigated, or not.

there is public interest in the public knowing what investigations the ICO is doing. If they are responsible for ensuring DPOs do not have conflicts under data protection law, there is public interest in knowing that they are acting effectively. Otherwise the public will have no knowledge about the usefulness of the regulator in this area, and whether DPO conflicts are investigated. Knowing that they are would encourage authorities and companies to act responsibly. The ICO is keen to let people know about other investigations it does, there should be no difference here.

Your guidance note says that these 3 things have to be met:

1 The prejudice claimed must be real, actual or of substance. Therefore, if the harm was only trivial, the
exemption would not be engaged. I do not believe you have set out that harm is more than trivial or even that any harm is likely.

2 The public authority must be able to demonstrate a causal link between the disclosure and the harm claimed. I do not think you have done this. My point above about the huge number of DPOs applies, and you have not explained how confirming how many investigation the ICO has will lead to any damage.

3 The public authority must then decide what the likelihood of the harm actually occurring is, ie would it occur, or is it only likely to occur? You haven't done this or set out any meaningful justifications.

Also you have not explained how the law enforcement applies to DPO conflicts. There is no personal liability under DP law for DPOs. Therefore if they have a conflict in their position they have no liability. No law is broken. So I do not agree that s31 can apply.

I also think the balance of public interests lies on saying whether you hold the information. You are being asked if you hold information about a regulatory function of yours. This is asking - are you investigation complaints made to you about conflicts of interests. to refuse to say if you are is not in the public interests. telling the public what you hold furthers the public interest of holding you to account for your publicly funded statutory role, and assures the public that there is a point in reporting matters to you. It furthers the public interest in knowing that DPOs who are conflicted will be dealt with and this will discourage rule breaking.

I am not asking for the names of any organisations being investigated- just the basic numbers.

As a second issue, I also think the FOI response was late.

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/d...

Yours faithfully,

Rosie Hought

icoaccessinformation, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit:

[1]https://ico.org.uk/about-the-ico/our-inf...

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

If you have requested advice - we aim to respond within 14 days. 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

Copied correspondence - we do not respond to correspondence that has been
copied to us.

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

For information about what we do with personal data see our [2]privacy
notice.

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

Yours sincerely

The Information Commissioner’s Office

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found
[3]here.

Twitter

Find us on Twitter [4]here.

 

References

Visible links
1. https://ico.org.uk/about-the-ico/our-inf...
2. https://ico.org.uk/global/privacy-notice/
3. https://ico.org.uk/about-the-ico/news-an...
4. http://www.twitter.com/ICOnews