Sorting out an acceptable system for funding the UK’s privacy watchdog needs to be tackled now, according to UK information commissioner Christopher Graham.
These include the committee endorsing a number of the Information Commissioner's Office's (ICO) key policy objectives, said Graham, notably compulsory audits for NHS bodies and local authorities.
The committee is particularly strong on the need for more effective sentencing of people who unlawfully obtain personal data, known as ‘section 55’ offences, he said.
Graham said he was particularly pleased by the committee’s recognition of what the ICO has achieved in bringing the Freedom of Information caseload under control, despite falling grant-in-aid funding and growing numbers of complaints.
“The picture that emerges is of a regulator that is delivering, is relevant and is efficient,” he said.
Graham was responding to the committee’s finding that the ICO is heading for a £42.8m shortfall, which comprises an estimated £26.3m increase in costs if the ICO is asked to take on the extra responsibilities outlined in the proposed EU data protection reforms, and a £15m reduction in revenues if the reforms abolish notification fees, as they currently propose.
The committee report notes that the government needs to find a way of retaining a fee-based self-financing system for the data protection work of the information commissioner, if necessary, by negotiating an option for the UK to retain the notification fee or introduce an alternative fee.
“If the government fails to achieve this, the unappealing consequence will be that funding of the ICO's data protection work will have to come from the taxpayer,” the report said.
The committee added that the proposed EU regulation cannot be allowed to compromise the work of the ICO on data protection, and the government should not support proposals which could have that effect.
“It must continue to negotiate with the European Commission to secure a more flexible and reasonable regulation in line with the recommendations in our previous report on the issue,” the report said.
More on ICO funding
The committee also said that the government should be mindful, in its response to the Leveson Inquiry, of the finite capacity of the Information Commissioner's Office to fulfil its current role.
“If the government requires that his office expand its role in monitoring the standards of data protection in the press, it should ensure he has the resources to do so properly,” the report said.
The committee said that it rejected the argument that it is inappropriate to make the ICO a parliamentary body, because his work does not relate primarily to that of Parliament.
“We continue to believe that the information commissioner will face significant difficulties in functioning effectively unless he becomes more closely accountable to Parliament instead of government.
“With the potential removal of the notification fee through the EU regulation, we reiterate our recommendation that the information commissioner should become directly responsible to, and funded by, Parliament,” the report said.
In reference to the estimated £42.8m shortfall, Graham wrote: “It is important to take on board the full context, and not simply the headline comments.”
He also pointed out that the £42m figure is “very much a worst case scenario” based on a proposed legislative framework that is ever-changing.
Graham concluded by saying: “There are challenges ahead, but we’re in good shape, and that is reason to feel positive about the future.”