Out-Law News | 11 Dec 2017 | 2:17 pm | 1 min. read
Under a government-backed amendment to the proposed new Data Protection Bill, the government would be able to issue guidance on data processing by government departments and other public bodies.
The Information Commissioner's Office (ICO) said (9-page / 165KB PDF) its independence is threatened by associated provisions the government has drafted that would force it to consider that guidance when carrying out its regulatory duties.
"Whilst [the information commissioner] understands the relevance of considering any guidance about the legal basis of government functions the provision runs a real risk of creating the impression that the commissioner will not enjoy the full independence of action and freedom from external influence when deciding how to exercise her full range of functions as required by Article 52 of the GDPR (General Data Protection Regulation)," the ICO said in a new briefing paper on the Data Protection Bill.
"Introducing a statutory requirement on the commissioner to take the secretary of state’s framework guidance into account is not required as the commissioner already takes into account relevant statutory and sectoral guidance when exercising her functions. Should she fail to do so she would be open to judicial review and this failure could also be scrutinised on appeal arising from her enforcement action," the ICO said.
The watchdog said that the ICO could provide "greater assurance" that it would take the government's guidance into account in the wording of its own guidance that it would be obliged to produce under the Bill, as currently drafted.
The ICO also said it was concerned that the government could issue new guidance on data processing that overlaps with guidance it has already produced on the issue of data sharing on the public sector.
"It will be important to ensure that any guidance produced by the secretary of state is consistent with this existing body of statutory guidance," the watchdog said.
"The framework guidance deals with data processing. The definition of this is very wide and could cover any aspect of data handling within government or other bodies to whom the measure is applied. A draft of the likely framework guidance should be published during the passage of the Bill to allow parliamentarians and others to judge the extent and likely value of that guidance and how it fits with existing statutory guidance," it added.