A coalition of organisations and experts sent an open letter calling for a Parliamentary inquiry into the performance of the UK ICO. What's the problem, and will this work?

Full disclosure: I was asked to sign this letter, but I decided against it. Many people I know and respect are on the list of signatories, and while there's some stuff in here I'm not 100% behind, I think it makes some decent points. But I generally just don't sign open letters.

This document makes some pretty scathing allegations about the ICO's current enforcement strategy, specifically regarding the ”Public Sector Approach”, and suggests that a change in direction is needed.

The letter appears to have been triggered by the ICO’s recent decision regarding the Ministry of Defence.

As many of you will know, the MoD was involved in a serious data breach where a spreadsheet containing the details of over 19,000 Afghan nationals eligible for relocation was leaked. 

The ICO decided not to formally investigate the MoD for this incident. a decision the signatories describe as ”extraordinary.” 

The central policy point here is the ICO’s ”public sector approach”, where the ICO generally prioritises engagement and reprimands over fines for public bodies, the logic being that fining public bodies simply moves taxpayer money around.

The open letter challenges the effectiveness of this policy. 

The signatories cite figures from the ICO’s own post-implementation review, which they say indicate that the average number of reported breaches in the public sector increased by 11% following the adoption of the PSA.

They also point to an 8% increase in complaints against public sector organisations. 

The signatories are asking the Science, Innovation and Technology Committee to open an inquiry to examine whether the current enforcement priorities are delivering the best results for the UK.

I'm interested to see how the Committee responds…