Privacy & Information Security Law Blog

The UK Information Commissioner’s Office’s (“ICO”) has revised its statutory Code of Practice on assessment notices (the “Code”). The ICO first issued the Code in 2010, when its audit powers came into force. The Code has now been updated to reflect changes in auditing standards and practices.

Background

Since 2010, the ICO has been empowered under the Data Protection Act 1998 (“DPA”) to undertake compulsory audits of central governments and other designated bodies, by serving a Section 41A assessment notice on an organization. The ICO has called for the extension of these powers to include local government, the national health service and the private sector. The ICO offers voluntary audits free of charge to organizations that the ICO cannot compel to submit to an audit.

The ICO also is empowered to conduct compulsory audits of electronic communications service providers that are subject to the statutory personal data breach notification requirements under the Privacy and Electronic Communications (EC) Directive Regulations 2003 (“PECR”). The Code does not apply to audits conducted under PECR.

Purpose of Audits

The purpose of an audit is to enable the ICO to determine whether an organization is in compliance with the requirements of the DPA. The ICO views audits as a “constructive” process with “real benefits” for data controllers. Because it intends the audit process to be participatory, the ICO usually invites organizations to consent to a voluntary audit first, rather than automatically issuing a Section 41A assessment notice. The ICO also prefers to conduct voluntary audits since they can be broader in scope and include good practice recommendations, whereas compulsory audits are limited in scope to determining compliance with DPA requirements.

Use of Compulsory Audits

The Code sets out how and when the ICO will exercise its powers of compulsory audits. Following the Regulators’ Compliance Code, the ICO adopts a risk-based, proportionate and targeted approach to conducting audits. Section 41A assessment notices will be served when deemed necessary by the ICO, as when:

• a risk assessment indicates that personal data are likely not being processed in accordance with DPA requirements and there is a likelihood of damage or distress to individuals; and
• the organization has failed to respond to written requests from the ICO and has refused to submit to a consensual audit; or
• there is a need to verify that an organization has taken appropriate steps to comply with a formal undertaking or enforcement notice.

Audit Process

Audits are conducted in two phases. An off-site ‘adequacy’ audit is conducted first, to review policies, procedures, guidance and training materials. Then a multi-day, on-site ‘compliance’ audit is conducted, involving interviewing staff and observing data handling processes.

Reporting

Following an audit, the ICO issues an audit report, which gives an audit opinion as to whether the organization has or is complying with the requirements of the DPA. The ICO presents a draft report to the audited organization to enable it to verify the report’s factual accuracy. The basic details of the audit and an executive summary of the report are made available for a year on the ICO’s public website and thereafter may still be available on request.

Success of Compulsory Audit Powers

The Code was first published in 2010, when the ICO’s new powers to conduct compulsory audits took effect. Information Commissioner Christopher Graham notes that since 2010, the ICO has not issued a single assessment notice, as the mere possibility of issuing a formal notice appears to be sufficient encouragement for data controllers to agree to submit to a voluntary audit. Commissioner Graham therefore concludes that “the success of the compulsory audit power has been clearly illustrated in practice.” He views the compulsory audit power as a ‘necessary backstop’, and sees the success experienced to date with central governments as a strong reason to extend the scope of the powers to local government, the health service and the private sector. The ICO recently submitted a business case to the UK Ministry of Justice seeking these extensions.