Information Commissioner Elizabeth Denham has reinforced her message that her office will show greater leniency to firms during the Covid-19 pandemic although those breaching data protection laws to exploit the crisis have been warned to expect strong action.
In a classic case of “good cop, bad cop”, the ICO says that during its investigations, it will take into account the impact of the crisis on organisations. This may mean less use of formal powers that require organisations to provide it with evidence, and allowing longer periods to respond. The ICO also expects to conduct fewer investigations, focusing its attention on those incidents which suggest serious non-compliance.
However, it added: “We will take a strong regulatory approach against any organisation breaching data protection laws to take advantage of the current crisis.”
City watchdog the Financial Conduct Authority is already planning a major ad campaign to warn consumers over a new explosion of scams and dodgy marketing tactics, as rogue businesses look to exploit the coronavirus pandemic to make a financial killing.
Meanwhile, when it comes to deciding whether to take formal regulatory action, including issuing fines, the regulator says it will take into account whether the organisation’s difficulties result from the crisis, and if it has plans to rectify the situation when the outbreak is all over.
The ICO added: “We may give organisations longer than usual to rectify any breaches that predate the crisis, where the crisis impacts the organisation’s ability to take steps to put things right.”
If it decides to go ahead with fines, the ICO said it will now take into account the economic impact and affordability, confirming: “In current circumstances, this is likely to mean the level of fines reduces.”
All audit work has been halted due to travel and contact restrictions, while all formal regulatory action over outstanding information request backlogs has also been suspended.
In addition, the ICO has said it may not enforce against organisations who fail to pay or renew their data protection fee, if they can provide evidence this is due to economic reasons linked to the crisis.
Denham said: “We must reflect these exceptional times. We will continue to recognise the continuing importance of privacy protections, and the value of transparency provided by freedom of information. These rights are a part of modern life we must not lose. But my office will continue to safeguard information rights in an empathetic and pragmatic way that reflects the impact of coronavirus.
“It is important that we regulate for the time we are in now, but it is important too that we look to the future. Data protection can play a central role in promoting economic growth when we come out of this pandemic: encouraging public trust in innovation and supporting the UK as it steps forward in the global economy.”
Related stories
FCA plots campaign to combat the return of the rogues
Senior judge suspends all appeals against ICO rulings
ICO warns supermarkets over Covid-19 data retention
Regulator gives the green light for mobile data tracking
ICO pledges ‘light touch’ over coronavirus privacy fears
Mail blames the ICO for blocking coronavirus warnings
Millions of firms in firing line in data protection fee blitz
Data protection fee dodgers face fresh ICO clampdown
ICO funding pays off but fears grow over huge legal bills
