8th March 2012

Case Reference Number IRQ0439340

Dear Mr Hanff

Thank you for your email of 7 March 2012 in which you have made a request
for information to the Information Commissioner's Office.
 
Your request is being dealt with in accordance with the Freedom of
Information Act 2000.  We will respond promptly, and no later than 5 April
2012 which is 20 working days from the day after we received your request.
 
Should you wish to reply to this email, please be careful not to amend the
information in the ‘subject’ field. This will ensure that the information
is added directly to your case. However, please be aware that this is an
automated process; the information will not be read by a member of our
staff until your case is allocated to a request handler.

Yours sincerely

Joanne Crowley
Lead Internal Compliance Officer

show quoted sections

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 0303 123 1113 Fax: 01625 524 510 Web: www.ico.gov.uk

Thank you for emailing the Information Commissioner’s Office (ICO).  This
is an automatic acknowledgement to tell you we have received your email
safely.  Please do not reply to this email.

If your email was about a new complaint or request for advice it will be
considered by our Customer Contact Department.  One of our case officers
will be in touch as soon as possible. 

If your email was about an ongoing case we are dealing with it will be
allocated to the person handling your case.

If your email was about a case you have already submitted, but is yet to
be allocated to one of our case officers your email will be added to your
original correspondence and will be considered when your case is
allocated.

If you require any further assistance please contact our Helpline on 0303
123 1133 or 01625 545745 if you prefer to use a national rate number.

Thank you for contacting the Information Commissioner’s Office

Yours sincerely

ICO Customer Contact Department

show quoted sections

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 0303 123 1113 Fax: 01625 524 510 Web: www.ico.gov.uk

5 April 2012

Case Reference Number IRQ0439340

Dear Mr Hanff

Further to our acknowledgment of 7 March 2012 we are now in a position to
provide a response to your request.
 
Your request read:
 
“Please provide information and relevant references as to the
Judicial Authority the Information Commissioner feels his Office
has with regards to delaying enforcement of a national law for a
period of 12 months.

More specifically, what Judicial Authority does the Information
Commissioner feel he has with regards to the delays on enforcing
PECR in relation to the changes applied for the purpose of
transposing Article 5(3) of the ePrivacy Directive.

Please also provide any internal documents/communications
(including but not limited to: emails, memos and minutes) which
relate to the decision to delay enforcement of PECR as above.”
 
As previously stated we have considered your request under the Freedom of
Information Act 2000.
 
In order to respond to your points we would like to point you to the
following policy - [1]Enforcing the revised Privacy and Electronic
Communications Regulations (PECR) – version 1 25/05/2011 – the information
on page 3 is particularly relevant.
 
This policy provides a detailed explanation of why we took the approach we
did at that time.  By way of some explanation; you will see our approach
was based on being “reasonable” rather than on any judicial authority
although we were careful not to completely fetter the Commissioner’s
discretion and did not rule out regulatory action for PECR breaches
entirely.
 
With regard to internal communications – although it has been recollected
that there was an exchange over this issue at the time; it has also been
confirmed that this information is no longer held.  
 
Therefore we do not hold any information in the scope of your request.
 
Whilst we have been unable to provide much information in response to your
request I hope this response is of some use. However, if you are
dissatisfied with the response you have received and wish to request a
review of our decision or make a complaint about how your request has been
handled you should write to the Internal Compliance Department at the
address below or e-mail [2][email address]
 
Your request for internal review should be submitted to us within 40
working days of receipt by you of this response.  Any such request
received after this time will only be considered at the discretion of the
Commissioner.
 
If having exhausted the review process you are not content that your
request or review has been dealt with correctly, you have a further right
of appeal to this office in our capacity as the statutory complaint
handler under the legislation.  To make such an application, please write
to the First Contact Team, at the address below or visit the ‘Complaints’
section of our website to make a Freedom of Information Act or
Environmental Information Regulations complaint online.
 
A copy of our review procedure is attached.
 
Yours sincerely
 
Helen Ward
Lead Internal Compliance Officer 
 

show quoted sections

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 0303 123 1113 Fax: 01625 524 510 Web: www.ico.gov.uk

References

Visible links
1. http://www.ico.gov.uk/what_we_cover/taki...
2. mailto:[email address]

Thank you for emailing the Information Commissioner’s Office (ICO).  This
is an automatic acknowledgement to tell you we have received your email
safely.  Please do not reply to this email.

If your email was about a new complaint or request for advice it will be
considered by our Customer Contact Department.  One of our case officers
will be in touch as soon as possible. 

If your email was about an ongoing case we are dealing with it will be
allocated to the person handling your case.

If your email was about a case you have already submitted, but is yet to
be allocated to one of our case officers your email will be added to your
original correspondence and will be considered when your case is
allocated.

If you require any further assistance please contact our Helpline on 0303
123 1133 or 01625 545745 if you prefer to use a national rate number.

Thank you for contacting the Information Commissioner’s Office

Yours sincerely

ICO Customer Contact Department

show quoted sections

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 0303 123 1113 Fax: 01625 524 510 Web: www.ico.gov.uk

PROTECT
17 April 2012

Case Reference Number IRQ0439340

Dear Mr Hanff

Thank you for your further email.

As explained previously we do not hold recorded information around this
point.

However, we can respond to your further query as follows.

“Can you please clarify whether your reply means you don't have
specific Judicial Authority or you do but you don't feel you needed
to exercise it for this particular issue?

Your answer seems to imply that you don't have Judicial Authority
but the wording is not explicit.”
 
I contacted our Enforcement solicitor in order to respond to your query.
 
We did not rely on any specific judicial authority when we issued our
policy on PECR enforcement. 
 
The Commissioner has discretion to take enforcement action under section
40 DPA which must not be fettered.  Therefore we cannot say that the
Commissioner will never take enforcement action in any given situation. 
As explained previously our policy was careful not to fetter the
discretion of the Commissioner.
 
However within the term discretion there is a margin of appreciation which
is governed by the public law principle of reasonableness.  As a creature
of statute the Commissioner has to act within the powers given to him by
parliament but there is some leeway as long as he is acting reasonably.
 
We consider that whilst the PECR enforcement policy – specifically the
section relating to the intention to allow a lead in period for 12 months
including the intention to delay enforcement action for 12 months – but
not ruling it out completely – wasn’t based on any judicial authority it
was a reasonable approach to take based on public law principles without
fettering the Commissioner’s discretion entirely.
 
I would also point you to the explanation at page 5 of the policy which
sets out the Commissioner’s considerations in allowing a lead in period.
 
I hope this is of some assistance,
 
Thank you
 
Helen Ward
Lead Internal Compliance Officer
 

show quoted sections

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 0303 123 1113 Fax: 01625 524 510 Web: www.ico.gov.uk

Thank you for emailing the Information Commissioner’s Office (ICO).  This
is an automatic acknowledgement to tell you we have received your email
safely.  Please do not reply to this email.

If your email was about a new complaint or request for advice it will be
considered by our Customer Contact Department.  One of our case officers
will be in touch as soon as possible. 

If your email was about an ongoing case we are dealing with it will be
allocated to the person handling your case.

If your email was about a case you have already submitted, but is yet to
be allocated to one of our case officers your email will be added to your
original correspondence and will be considered when your case is
allocated.

If you require any further assistance please contact our Helpline on 0303
123 1133 or 01625 545745 if you prefer to use a national rate number.

Thank you for contacting the Information Commissioner’s Office

Yours sincerely

ICO Customer Contact Department

show quoted sections

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 0303 123 1113 Fax: 01625 524 510 Web: www.ico.gov.uk

PROTECT
25 April 2012

Case Reference Number IRQ0439340

Dear Mr Hanff

Thank you for your further email. 

Firstly, you state: ‘I do not understand why you are referencing s40 of
the Data Protection Act as that refers specifically to enforcement of the
Data Protection Act not Privacy and Electronic Communications (EC
Directive) Regulations (PECR)’ and later ‘…instead have referred to the
DPA which I don’t feel is relevant with regards to enforcement of PECR.’
In response to your comments I would like to draw your attention to
Schedule 1 PECR 2003 (Modifications for the purposes of these Regulations
to Part V of the Data Protection Act 1998 and Schedules 6 and 9 to that
Act as extended by Regulation 31). Part 1 of Schedule 1 PECR 2003 sets out
the following:
 

 1. In Section 40 –
 2. in subsection (1), for the words “data controller” there shall be
substituted the word “person”, for the words “data protection
principles” there shall be substituted the words “requirements of the
Privacy and Electronic Communications (EC Directive) Regulations 2003
(in this Part referred to as “the relevant requirements”)” and for the
words “principle or principles” there shall be substituted the words
“requirement or requirements”;
 3. in subsection (2), the words “or distress” shall be omitted;
 4. subsections (3), (4), (5), (9) and (10) shall be omitted; and
 5. in subsection (6)(a), for the words “data protection principle or
principles” there shall be substituted the words “relevant requirement
or requirements”.

 
This means that section 40 (which is in Part V) Data Protection Act 1998
was amended by PECR 2003 to extend enforcement of PECR; this is why we
referred to section 40 DPA in relation to enforcement of PECR and why it
is relevant.
 
You may be interested to note an amendment to Schedule 1 PECR 2003 at
Regulation 14 of Statutory Instrument 2011 No. 1208 The Privacy and
Electronic Communications (EC Directive) (Amendment) Regulations 2011.
This amendment does not alter the above but extends it further to include
sections 55 and 55A DPA 1998.
 
As you say, the changes to PECR were brought about via statutory
instrument (No. 1208 as referenced above) and there is no mention of a
‘delay or suspension of enforcement within that SI or the notes
accompanying that SI’. As I tried to explain in my last response – the ICO
was careful not to fetter the Commissioner’s discretion which means that
enforcement action could not be ruled out entirely within the initial 12
month period but the intention (and expectation of government and data
controllers) was not to enforce within the initial 12 month period.
 
This intention was born of an acknowledgment that generally speaking it
would have been unfair to seek to enforce a law for which little time had
been given to prepare for or consult on. Further the ICO as regulator of
that law was required to produce guidance and to promote it.
 
You go on to say ‘had the intention of the Government been to delay
enforcement, it would have been documented in the notes for the SI’ – I
would draw your attention to the press releases made by DCMS (available on
their website) of 15 April 2011 and 25 May 2011 which include a quote from
Ed Vaizey MP stating “We recognise that work on the technical solutions
for cookie use will not be complete by the implementation deadline. It
will take time for meaningful solutions to be developed, evaluated and
rolled out. Therefore we do not expect the ICO to take enforcement action
in the short term against businesses and organisations as they work out
how to address their use of cookies.”
 
You say that ‘ICO have no known authority to suspend enforcement of UK
Law’ – it is hopefully clear by now that there was in fact, not ‘a
suspension’. There was an intention not to enforce in the initial 12
months but had circumstances arisen in which it was considered appropriate
to enforce, then the ICO could have enforced.
 
As explained in my last response the Commissioner has discretion to
enforce under section 40 DPA (which, as explained above, is relevant to
this point) and within the realm of discretion is able to take account of
the public law principle of reasonableness. It was felt, that the most
appropriate and reasonable course of action for the ICO to take, given all
of the circumstances and the discretion available was to take the stance
that the initial 12 months would most usefully be used to guide, promote
and discuss the changes with affected parties. It was also made clear that
data controllers should, in that time frame, seek to work to become
compliant, and at the least, seek to work out how to become compliant. 
 
As in my last response I would like to draw on the guidance issued by ICO
in May 2011 called Enforcing the Revised Privacy and Electronic
Communications Regulations and instead of paraphrasing it seems most
useful to use the actual text:
 
“In allowing this lead in period the Commissioner has born in mind the
position stated by the Government in its response to its consultation on
Implementing the revised EU Electronic Communications Framework that:
 
it does not expect work on technical solutions to be completed before the
implementation deadline;
 
it recognises that it will take time for these solutions to be developed,
evaluated and rolled out; and
 
during this time it does not expect that ICO will take enforcement action
against organisations that are working to address their use of cookies or
are engaged in development work on browsers and/or other solutions.
 
The Commissioner has also born in mind that when the 2003 Regulations were
made there was a three month delay before they came into effect. In
addition “good regulation” requires that guidance on implementation needs
to be available to organisations at least 12 weeks before new regulations
come into effect. In the absence of other guidance from the Government it
is the Commission’s advice note, Changes to the rules on using cookies and
similar technologies for storing information that fulfills this
requirement. This advice note could not be issued before early May 2011
when the 2011 Regulations were published. Furthermore the Commissioner is
aware that the UK is ahead of most other EU member states in implementing
the EU Directive that sits behind the 2011 Regulations.”
 
You state that the ‘purpose of my original FOIA request and the followup
which you have replied to today, was to establish whether or not ICO felt
they had any specific judicial authority to suspend a law or SI passed by
the Parliament/Government’. If, by this you want reference to a specific
section of a specific Act which states ‘the ICO can suspend enforcement of
the amendment to PECR’ - then there isn’t one. The intention to delay
enforcement action was a result of the use of available discretion coupled
with consideration of the particular circumstances.
 
Finally, you state ‘this FOIA request is now running significantly over
time and I shouldn’t have to remind you that you have a legal requirement
to answer it in the relevant time frame’. We are aware of the statutory
obligations placed on us by FOIA. We responded to your request within the
statutory timescales explaining that we held no recorded information.
Since then we have responded to your further queries which we are not
obliged to do by FOIA.
 
I hope this further explanation has shed some light on your understanding
of the issues. Although we are content to provide explanation around the
work that we do we feel that on this occasion we have provided a complete
picture in response to your queries and there doesn’t seem to be anything
else we can helpfully add.
 
Thank you
 
Yours sincerely

Helen Ward
Lead Internal Compliance Officer 
 
 
 
 
 
 
 

show quoted sections

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Tel: 0303 123 1113 Fax: 01625 524 510 Web: www.ico.gov.uk