UK's data protection regulator is ineffective, says research

The regulator charged with overseeing data protection in the UK has been and will continue to be ineffective unless the government takes action, according to research by an academic at the University of East Anglia.

In a paper to be presented today, Dr Karen Mc Cullagh traces the development of the watchdog, currently the Information Commissioner's Office (ICO), since its inception almost 30 years ago, when a Conservative government enacted legislation establishing an independent regulator tasked with administering data protection law in the UK.

There has been little research evaluating the effectiveness of the regulator since its inception. Dr Mc Cullagh's study aims to address this by examining its development through four distinct phases, in order to assess the adequacy and effectiveness of the regulator to date, and predict its future potential.

Dr Mc Cullagh, from UEA's Law School, looked at: the period 1984-1998, when the Data Protection Registrar was first created and derived its powers from the Data Protection Act 1984; 1998-2010 when the Data Protection Registrar transformed into the (ICO) and gained enhanced powers under the Data Protection Act 1998; 2010 to the present, since the level of financial penalty the regulator could impose for serious breaches of the legislation was increased through the enactment of the Criminal Justice and Immigration Act 2008; and finally, the changes in proposed EU data protection regulation, which are tentatively scheduled to come into force in 2014.

"My analysis of the regulator's investigative and enforcement powers demonstrates that they have been, and continue to be, lamentably weak and ineffective," said Dr Mc Cullagh. "Despite the much-lauded enhanced powers for regulators in the proposed EU data protection regulation, there is a real risk that the ICO will remain an ineffective regulator in the future if the UK government does not take measures to create an adequately funded and properly staffed regulatory office, with appropriate investigative and enforcement powers."

Dr Mc Cullagh's analysis reveals that socio-economic, technical and political factors influenced the legislative process in each of the four eras of data protection. She shows that these factors influenced the independence of the regulator and the powers conferred on it, resulting in structural and operational weaknesses that impede its effectiveness.

"If the proposed EU regulation is implemented in its current form, the ICO will face a budgetary shortfall of £42.8m – an issue the UK government has yet to address, even though it will seriously impede the effectiveness of the regulator," added Dr Mc Cullagh.

Dr Mc Cullagh will present her research, entitled "Data Protection: regulatory (in)adequacy?", at the 28th annual British and Irish Law, Education and Technology Association (BILETA) conference, taking place at the Liverpool Law School, University of Liverpool, this week.