How effective is the ICO?
I’ve been thinking recently about the Information Commissioner’s Office (ICO), whether it is providing good value for money and whether it is properly led.
The ICO was founded in 1984 and has grown from being a small organisation of 10 people to now having more than 1,000 employees and an annual income of £111 million. See ICO Financial report March 2026.
It is supposed to be a regulator and enforcer of data protection legislation. But is it working?
A Question of Leadership
The former Commissioner, John Edwards, received a salary in excess of £200,000 which is more than the Prime Minister. Edwards voluntarily stepped back from his duties at the end of February 2026 to enable an independent workplace investigation and on 19th June 2026 he resigned from his position.
He is preparing to sue a woman who raised harassment concerns. I find it absolutely disgusting that he continues to try to defend his wholly unacceptable behaviour. Given the former head’s appalling attitude towards women and failure to understand what he has done wrong, even with MP intervention, one can guess at how toxic the whole environment must be.
Liz Kendall, the science and technology secretary, has fortunately announced an independent review into the culture, accountability and governance of the ICO. We can only hope that the review uncovers the inefficiencies and why the culture allowed the leader to continue his abuse with impunity.
ICO fines
The ICO can impose monetary penalties for serious breaches of the DPA of up to £17.5m, or up to 4% of global turnover of an enterprise, whichever is greater. Does it get anywhere near that? No. In the Information Commissioner’s Annual Report and Financial Statements 2024/25 monetary penalties “written off” or “impaired” were £25.1m. In short this means that the organisation is very poor at recovering fines owed to it by individuals and companies.
ICO Complaints Handling
The June 2026 change to complaints from the public is a move that I can only see as frustrating consumers and make them less likely to report breaches. The ICO has decided that instead of just making a complaint, it now insists that one first make a complaint to the organisation. Only then, if not happy, can one proceed to ICO.
It has successfully added another layer of bureaucracy for consumers, and indeed businesses, before the ICO will even contemplate looking at a complaint.
Complaints Failures
In its Data protection complaint handling approach – Impact Assessment published in 2026 the ICO acknowledges failures in complaint handling and the need to introduce a number of interventions in responding to cases in a timely manner.
From my own experience, I have sent a number of FoI refusals to the ICO which have taken months to assign and then deal with. Isn’t it ironic that an organisation which should be penalising organisations for exceeding FoI deadlines is so inefficient? The Impact Assessment outlines proposed changes to the framework.
Deterrents
Deterrents have to be seen to be effective both in their gravity and in successful outcomes from which others can learn. If the ICO is not properly persuing DPA/GDPR breaches and not chasing fines due to it, then how can it continue to exist in its current form?
The Future
The ICO must now be totally overhauled. The organisation should now begin to lead by example in its functions as a regulator, educator and enforcer.
I believe it is time to cut out the “dead wood”, starting from the top, recognise those who are prepared to challenge the status quo and don’t settle for anything less.
Only with new leadership, clear objectives, targets and oversight can the organisation rediscover its direction and look towards the future.
?){kind=link}