31. In addition to the issue of responsibility for
the Information Commissioner's resources, we have also been concerned
about the level of available funding. Freedom of information and
data protection are funded differently and there can be no cross-subsidy,
or virement, between the two functions.
32. The implementation of the Information Commissioner's
data protection responsibilities is funded by notification fees
paid by data controllers. At present, the fee is £35 whether
the organisation is a small business or a huge Government department.
We drew attention to the anomaly of a flat-rate fee for all sizes
of organisation in January 2008 and recommended that a graduated
scheme be introduced; this was echoed in the report of the Data
Sharing Review in July 2008. The MoJ told us that work is still
underway on the details of the scheme but said that the overall
intention was to fund the estimated costs of the Information Commissioner's
revised data protection responsibilities£16 million
per year (assuming passage of the Coroners and Justice Bill)through
the new fee structure.
33. We welcomed Mr Graham's recognition of the Information
Commissioner's "considerable responsibility" for assessments
of applications for authority to share personal data and the potential
constraints of the 21-day period allowed on the face of the Coroners
and Justice Bill for each such assessment to take place. We agree
with his indication that departments contemplating such an application
should be in "early dialogue" with the ICO.
Freedom of information (FOI)
34. Mr Thomas told us that "freedom of information
is done on quite a shoestring" and drew a compelling comparison
between his 53 caseworkers, who had responsibility for often unfamiliar
territory across the whole public sector, and the 28 staff employed
by the Ministry of Justice just to deal with incoming FOI requests
for that department and its associated public bodies.
Mr Graham was also of the opinion that this side of the business
was "pretty tightly resourced" and made clear that tackling
the "backlog" of outstanding cases would be his priority.
He pointed to his track record at the ASA, in equivalent circumstances,
and we concur with his view that "unless you can demonstrate
that you are an efficient organisation handling the business promptly,
people will not take you seriously on anything else." He
described the efficiency and effectiveness of the ICO as its "licence
35. Mr Thomas wrote that "the ICO currently
receives £5.5 million as grant-in-aid for FoI. We do not
yet know our grant for 2009-10. Despite a 15% increase in complaints
received, we have been told that an increase cannot be contemplated
and that a cut is possible. This would be very serious."
In light of this, we asked Mr Graham whether he had opened negotiations
with the MoJ on the availability of adequate resources to the
Information Commissioner's Office in advance of a final commitment
to taking on the role. Mr Graham was again cautious. Not having
learned "the ways of the civil service" he said he was
reluctant to "make it up" on the hoof in front of a
select committee. However, when pressed he said: "If I form
the conclusion that I have not got the resources to do the job,
then there would not be any point in proceeding, but I have not
had the discussion".
36. We recommend that the Ministry of Justice
take the appropriate steps to ensure that there are sufficient
resources available to the Information Commissioner to enable
the backlog of freedom of information cases to be resolved within
a reasonable timescale.
37. We were interested in Mr Graham's overall view
of the priorities and challenges of the Information Commissioner's
role. He identified the following:
- Good leadership and management
of an effective and efficient operation to engender the respect
of stakeholders and create the platform from which to contribute
to the relevant public policy debates.
- Emphasis on education and the provision of guidance
and information to reduce non-complianceand associated
reputational damagewhile ensuring awareness that there
are effective sanctions which would be deployed if necessary.
- The demonstration to all sides and stakeholders
of the absolute independence and integrity of the office and its
capacity to take rational decisions after due process, based on
the evidence, and then to defend them.
38. We endorse Mr Christopher Graham's suitability
for appointment as Information Commissioner and his preliminary
view of the priorities of the role and its supporting organisation.
We look forward to a continuing dialogue on progress both in protecting
people's personal information effectively and sensitively, and
in securing implementation of the letter, and the spirit, of the
Freedom of Information Act. The Information Commissioner needs
to be an independent and fearless champion of both data protection
and freedom of information, backed by a well-led and well-managed
organisation. We wish Mr Graham success in this role.
14 Liaison Committee, First Report of Session 2007-08,
Pre-appointment hearings by select committees HC 384 Back
Constitutional Affairs Committee, Seventh Report of Session 2005-06,
Freedom of Information-one year on, HC 991 (Government
reply, Cm 6937) and Fourth Report of Session 2006-07, Freedom
of Information: Government's proposals for reform, HC 415
(Government reply, Cm 7187); and Justice Committee, First Report
of Session 2007-08, Protection of Private Data, HC 154
(Government reply, HC 406 of Session 2007-08) and Second Report
of Session 2008-09, Coroners and Justice Bill, HC 185 Back
Qq 1-22 and Ev 8-15 Back
Q 3 Back
Op. cit., paragraph 8.74 Back
Q 35 Back
Q 35 Back
Q 35 Back
Justice Committee, Second Report of Session 2008-09, Coroners
and Justice Bill, HC 185, para 27 Back
Cm 6937, October 2006 Back
Q 9 and see www.scottish.parliament.uk/s3/committees/rssb for
details of a review of the support for the Scottish Information
Commissioner by the Scottish Parliament. Back
Q 9 Back
Q 30 Back
Q 7 and Q 9 Back
Q 27 Back
Q 24 Back
Ev 10 Back
Q 34 Back
Q 24 Back