General observations

On the whole we believe the Draft Guidance is clear, well-written and comprehensive. It will be very helpful to practitioners, advisors (external and internal) and academics when identifying how the ICO undertakes enforcement, particularly settlement.

We have set out several issues below where we have identified areas for improvement in the Draft Guidance. In addition we make the following overriding observations that apply throughout much of the Draft Guidance.

Digitalisation

The Draft Guidance at times reads as though it is designed for the paper-era. Much of the information that organisations hold is stored only in a digital form and often stored with a third party using offsite cloud storage. Much of the information may never exist in paper form. This leads us to suggest some sections require modification. For example, take this section regarding disputes about legal privilege at paragraph 186 of the Draft Guidance:

“If such a dispute arises during an inspection of premises by us, either under an assessment notice or warrant, the authorised ICO staff member present may request that the communications are placed in a sealed envelope or package. We will then discuss the arrangements for the safe keeping of these items by us pending resolution of the dispute. This includes ensuring that the disputed communications are isolated and stored securely.”

We believe that in almost all cases the information is likely to remain in digital form in shared drives or files. It is very unlikely to be printed and placed in an envelope. Similar issues persist throughout the Draft Guidance and as a general observation we believe it could be modernised to ensure it is better suited to twenty-first century business practices.

Well-being

The Draft Guidance does not make any reference to the well-being of individuals employed or engaged by controllers or processors who are being investigated. Some of activities involved in an investigation are likely to give rise to anxiety, distress and harm. A good example could be where an interview notice is served with little to no advanced warning for the individual. We appreciate that the ICO would not take this step unless it was strictly necessary. However, the Draft Guidance does not explain that the ICO would take into account any impact on the well-being of the individual concerned. We suggest that the ICO addresses this in the Draft Guidance.