5 ms·

They've been failing to even issue fines, let alone enforce them. Both for competence reasons (see also: the collapse of the AIQ enforcement, and the climb-dow

by M2Ys4U 6y ago

They've been failing to even issue fines, let alone enforce them. Both for competence reasons (see also: the collapse of the AIQ enforcement, and the climb-downs in Mariot and BA cases) and for... I don't know why in the adtech case. The ICO has evidence of wide-scale criminal behaviour in the adtech industry. And yet they flat-out refuse to take enforcement action. They're even proud of the fact they're refusing to do their job - they put it in their annual report! And even in their non-data protection duties, they've all but given up enforcing the Freedom of Information Act. Statutory timelines are apparently now utterly meaningless. The ICO has even stopped publishing data on compliance levels. It looks like Denham wants to spend her time as Information Commissioner issuing tough-sounding press releases and threatening (but ultimately flawed) pre-enforcement notices and then using the publicity from those to become a Thought Leader in AI ethics.

iamacyborg 6y ago
They did, however, appear to do a good job with the recent Experian and Equifax enforcement.
- Nextgrid 6y ago
  Are you talking about this case: https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2020/10/ico-takes-enforcement-action-against-experian-after-data-broking-investigation/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl... ? If so, we seem to have a major disagreement about the definition of a "good job". The ICO, by its own admission, found that: > The investigation found how the three CRAs were trading, enriching and enhancing people’s personal data without their knowledge. This processing resulted in products which were used by commercial organisations, political parties or charities to find new customers, identify the people most likely to be able to afford goods and services, and build profiles about people. > The ICO found that significant ‘invisible’ processing took place, likely affecting millions of adults in the UK. It is ‘invisible’ because the individual is not aware that the organisation is collecting and using their personal data. This is against data protection law. The ICO was clearly aware that a large-scale GDPR breach was being committed for profit for several years by a large company who should know better (and has the resources to comply should they want to), and the best they could muster is an "enforcement notice" as opposed to a fine?

by M2Ys4U 6y ago

iamacyborg 6y ago

They did, however, appear to do a good job with the recent Experian and Equifax enforcement.

Nextgrid 6y ago
Are you talking about this case: https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2020/10/ico-takes-enforcement-action-against-experian-after-data-broking-investigation/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl... ? If so, we seem to have a major disagreement about the definition of a "good job". The ICO, by its own admission, found that: > The investigation found how the three CRAs were trading, enriching and enhancing people’s personal data without their knowledge. This processing resulted in products which were used by commercial organisations, political parties or charities to find new customers, identify the people most likely to be able to afford goods and services, and build profiles about people. > The ICO found that significant ‘invisible’ processing took place, likely affecting millions of adults in the UK. It is ‘invisible’ because the individual is not aware that the organisation is collecting and using their personal data. This is against data protection law. The ICO was clearly aware that a large-scale GDPR breach was being committed for profit for several years by a large company who should know better (and has the resources to comply should they want to), and the best they could muster is an "enforcement notice" as opposed to a fine?