Examination of Witness (Questions 23-38)
CHRISTOPHER GRAHAM
27 JANUARY 2009
Q23 Chairman: Mr Graham, welcome. This
is the second appointment hearing that this Committee has held.
We are glad that in good time an appointment has been made for
a very important post of Information Commissioner. The present
holder of the post has appeared regularly before the Committee.
I wonder if you could just tell us in a few words what features
in your own background and experience you think will actually
help equip you to do this job.
Christopher Graham: Good afternoon,
Chairman. I come from a regulatory background. Since April 2000
I have been running the Advertising Standards Authority, which
deals with 26,000 complaints about advertising each year. It is
an industry self-regulatory body, but since November 2004 we have
contracted out responsibility from Ofcom to deal with TV and radio
advertising as well as the non-broadcast advertising which traditionally
we have been dealing with since the organisation was established
in 1962. In that role I have to deal with codes, with the possibility
of being judicially reviewed, with the need to provide a proper
customer service and the need to get compliance. I think it has
given me, particularly with my two years as Chairman of the European
Advertising Standards Alliance, a familiarity with the regulatory
landscape. It has also given me the experience of running a large
organisation, the experience of managing change, developing a
customer service culture and so on. Chairman, before that I was
a BBC lifer. I joined as a journalist and I ended up as the Corporation's
Secretary. For three years I was making sure that the Director-General
and the Governors of the BBC were carrying out the terms of the
Royal Charter and so on and so on. That was not an easy row to
hoe either. I think I am broadly familiar with the challenges
of this job. It is very exciting. Only today we have seen stories
of a significant leak of personal information from one of the
job recruitment websites, possibly the biggest leak of personal
information since the loss of all those child benefit records
recently. We have had a decision from the Information Tribunal
this afternoon supporting the Information Commissioner's ruling
on the release of the 2003 Cabinet records. I followed with great
interest the debate in the House of Commons yesterday on the Second
Reading of the Coroners and Justice Bill. There is a lot going
on. I am very humbled but excited to be asked to take on this
responsibility subject to the approval of your Committee and some
other procedures. I think I am equipped through my skills and
experience to bring something to this role.
Q24 Alun Michael: Could you say something
about your philosophy and your approach to the role? This role
started off in data protection and has moved to a much more sophisticated
and therefore more challenging brief over recent years. Having
seen the way that has been developed, particularly in the accumbency
of the current Information Commissioner, how do you see yourself
taking that forward? What is your attitude to the issue of information,
data management, sharing and retention?
Christopher Graham: My first reaction
is that a challenging job is getting even more challenging. There
are new powers and duties, some already have been granted and
some that are in the Bill that you are considering. In the course
of 2009-10 the Information Commissioner is going to have significant
new powers, particularly on the data protection side and one hopes
the resources to use those powers effectively. You ask what my
overall approach is. First of all, that the organisation should
be well led and well managed, that it should be effective and
efficient. I think that is the sine qua non, it is the
licence to practice. The Information Commissioner has got to demonstrate
that he is delivering a service across the responsibilities of
data protection and freedom of information and so on, that we
can tackle the backlog of delays on the freedom of information
side, for example, and win the respect of all stakeholders, which
I think then gives the Information Commissioner the platform on
which to contribute to public policy debates around data protection
and freedom of information and so on. I would emphasise very much
the importance of the education and information side with the
enforcement and the sanctions as the big stick in the cupboard.
It is important that everyone knows it is there and will be got
out if necessary. There is the huge task of education and helping
people to comply, which has always been my approach with the Advertising
Standards Authority. I am not particularly interested in waiting
around the corner saying, "Aha, we've got you," but
that is necessary from time to time. It is much more important
to put the resources in to making sure that public authorities
and commercial organisations decide what their responsibilities
are and that they get on with it, but they have got to believe
that if they get things wrong the Information Commissioner will
be effective and will be prompt and, in addition to the reputational
damage which necessarily arises from getting things wrong, there
will be sanctions visited upon miscreants. And finally, my approach
would very much be the need to convince the authorities and stakeholders
in general of the absolute independence and integrity of the Information
Commissioner. I think we achieve that by being absolutely evidence
based, cool, calm, determined to defend decisions that are being
properly arrived at, brave when necessary, but the first thing
to do is to win the respect of all those who are interested in
this area by manifestly running an effective operation at a time
of great challenge and great change.
Q25 Alun Michael: There is sometimes
a tendency when there is regulation and when there is quite tough
regulation to look for ways of playing safe. There have sometimes
been swings in public mood, on the one hand, to say that everything
needs to be shared, an example was of the Soham murders, which
was actually a technical problem but led to that sort of public
reaction, and, on the other hand, saying nothing should be shared
or you should keep everything to the minimum. Where do you stand
on that spectrum?
Christopher Graham: It is a bit
like health and safety in that it can often be given as an excuse
for not doing something and perhaps the excuse is given by those
who do not quite understand what the rules are. Again, there is
a challenge to the Information Commissioner's office to make it
very clear how we do data protection and how we do freedom of
information. A point that was made by Richard Thomas' study with
Sir Mark Walport about data sharing was that the current rules
were rather imperfectly understood. I am not going to go further
down this road because it is a matter that is absolutely for debate
with the Coroners and Justice Bill. I saw there was a difference
of view in the Second Reading debate last night. It will be very
interesting to see how it pans out. At the moment within the Bill
there is a very considerable responsibility laid on the Information
Commissioner to take a view about individual departmental applications
for data sharing. I would take that very seriously. Let us see
how the legislation ends up. All I would say specifically on that
is that I note it all has to be turned round in 21 days. I hope
very much that departments that are contemplating this sort of
thing are going to be in early dialogue with the Information Commissioner's
office because if everyone is trying to do it 21 days ain't long
to turn it round.
Q26 Chairman: You have got the problem,
which you mentioned, of a substantial backlog on the freedom of
information side. You said that it was a priority to deal with
that backlog. I am not quite sure whether you have had any promises
made to you of better resources or you have got an understanding
with the Ministry of Justice about this. When you take on board
new responsibilities on the data protection side, which data sharing
itself generates, it is going to be pretty challenging, is it
not, to deliver in this organisation?
Christopher Graham: It is very
challenging. To answer to your question, I have not had any discussions
with the Ministry of Justice about resources. I have not had many
discussions beyond the job application. I think the fun now starts.
On the data protection side, there is, as I understand it, given
the proposals in the Bill, the possibility of some, should one
say, elasticity in resourcing, and resourcing on the data protection
side is likely to be very considerably increased because of the
graduated fee structure.
Q27 Chairman: This committee recommended
that.
Christopher Graham: That is very
good news, and to an outsider that looks to be fine, but I also
know, from those who have explained to me the mysteries of the
Public Accounts Committee and managing public money, that there
cannot be virement between the two sides of the business and so
one cannot make a profit on the data protection side in order
to subsidise the freedom of information side. The freedom of information
side looks to me, but I have not been to Wilmslow, I have not
spoken to anyone, to be pretty tightly resourced. I think there
was an extra half million or so voted this year in order to assist
in clearing up the backlog, but it is a backlog that has been
there pretty much from day one, and I thought, reading Richard
Thomas' evidence in a session you had a fortnight ago, it was
very compelling when he said words to the effect that the level
of applications to the Information Commissioner on freedom of
information matters is up 15% this year. So it will be interesting
to see how we can deal with that increase and clear up the backlog
unless there are significant resources made available. But I would
also say that this is a problem that is not unfamiliar to me.
When I arrived at the Advertising Standards Authority in 2000,
I made a priority the turn round of complaints within a reasonable
period of time, because I said justice delayed is justice denied
and unless you can demonstrate that you are an efficient organisation
handling the business promptly, people will not take you seriously
on anything else. We did manage to make a considerable impact
through introducing a number of things that would actually not
be new at the Information Commissioner's Office. I am not pretending
I have got a magic bullet. Key performance indicators, regular
reporting, proper triage, and so on—I think all those are
in place. I would merely say that I regard it as a priority, it
is very important, to make progress on that backlog, and the reason
is this: a deterrent only works if people fear it. People have
to have a reasonable expectation that there is going to be a result
pretty quickly that will either be welcome or unwelcome, and so
that suggests that there is a considerable benefit in turning
round cases promptly which has a wider benefit than just doing
the job you are there to do but has a resonance about effectiveness
that runs right through the work.
Q28 Mr Heath: A lot of the work of
the Information Commissioner, as has already been suggested in
this session, is dealing with the applications, the complaints
side effectively. Part of the job, surely, must be, however, to
prevent those applications and complaints ever reaching the Office
of the Information Commissioner by instilling a proper culture
within the organisations over which you have an interest, and
I think one of the concerns that is often expressed is that those
officers who are dealing with data protection, dealing with freedom
of information are at too low a status within the organisation
and that it is not being sufficiently considered at chief executive
level, at board level. How would you set about changing that culture
and reminding organisations that actually it is a core responsibility
to make sure that the organisation understands FOI and understands
data protection?
Christopher Graham: It could be
that they will have to learn the hard way. There is tremendous
reputational fallout, both for departments of state, public authorities,
but also commercial organisations, when things go wrong, and it
may be that the delays in a decision being made have the unfortunate
effect of somehow making it seem it does not really matter. If
you remember, Dr Johnson said that the prospect being hanged tomorrow
concentrates the mind wonderfully; the prospect of being hanged
in about three or four years' time is probably less effective—that
is point one. But I very much respond to the suggestion, which
I know is shared by the current Information Commissioner, that
information needs to be regarded as a risk to be managed at main
board level. In the same way that you have financial risks, there
are also huge risks to reputation, to effectiveness, to the business,
by people being careless with people's personal information or
by people appearing to be shifty because they do not want to let
the public know what is going on. There is a virtuous circle where
efficiency in the office contributes to the organisation being
feared, in the sense of being properly respected. I absolutely
support Richard Thomas's suggestion that information is something
that should be a main board responsibility, and he spoke, I thought,
very compellingly at your last meeting about the threat of toxic
information. We have heard about toxic assets. Companies are sitting
on information which is sometimes badly managed, not properly
safeguarded, and the fallout for the company is absolutely huge.
I would not like to be in the position of the people at the Monster
recruitment agency who have just managed to lose absolutely everyone's
details apparently; that is not good for business.
Q29 Mr Heath: One of the problems
(and perhaps you have just touched on it) is the ever increasing
size of databases and also the ever increasing complexity of the
IT systems that underpin them, to the point where possibly the
people who operate them cannot aspire to really understand entirely
what they are doing, but certainly your office is going to have
more and more difficulty, are they not, in keeping pace with the
technology that you are policing?
Christopher Graham: In any modern
organisation you have got to keep pace with technology. We were
discussing it at our ASA directors' meeting this morning and one
of the pieces of information I picked up is that a small organisation
like the Advertising Standards Authority, with 100 staff and a
budget of about eight million pounds, dealing with 26,000 complaints,
has got 52 servers—some of them are virtual servers, but
52 servers—we are very IT dependent. I will not say we are
paperless, but we are paper less—less than we were. Anyone
who is running a modern organisation these days has not to try
to run the IT themselves but to have a good IT department and
to keep abreast of the issues. I am on the receiving end of the
data protection side of this issue in a number of ways. We deal
with database practice in the marketing business. It is a breach
of the British Code of Advertising Sales, Promotion and Direct
Marketing to do direct marketing using databases in the wrong
way. So this is very much the currency of what we deal with, but
also for an organisation like the Advertising Standards Authority,
which presumes to tell everyone how they ought to behave and goes
on about standards, to be caught out with a big data leak or promoting
ourselves inappropriately under the rules, and so on, would be
a disaster: that is why we were talking about it this morning.
These are issues that I am familiar with in a general way. I do
not kid myself that I do not have to do an awful lot of preparation
before I take over, if I am asked to do that, at the end of June.
Q30 Dr Whitehead: When Mr Thomas
gave evidence to the committee he commented quite strongly on
the principle of the source of funding for the Information Commissioner
and felt that, in principle, the funding of the Information Commissioner
might be transferred to Parliament. Is that your view and, if
you do proceed to become the Information Commissioner, would you
actively pursue that as a future model for the funding arrangements
for the Information Commissioner's Office?
Christopher Graham: I cannot pretend
that I have got views on every subject under the sun. I have applied
for a job, I have been given a provisional okay, and there is
a lot of work I now need, as one would in any job, to see how
one would approach things, so I do not want to make rash promises.
It would be a popular one to make here, because I think that most
of the running on this issue has been made by this committee.
Perhaps I should just confine myself to saying it seems logical,
it is the way they do things in Scotland; I would not resist it.
Q31 Mr Tyrie: Did I hear you right
when you said that you had not clarified with the department the
level of resources that you would have to do your job?
Christopher Graham: I know what
is in the three-year strategy; I know what is in the public expenditure
plans. I have agreed with the existing Information Commissioner
that there can only be one Information Commissioner at a time.
He is conducting the usual negotiations with the Ministry, and
if this committee concludes that I am a fit and proper person
and if the rest of the process goes through, then I will be in
a position, over the period before I take up the position on 29
June, to get into a further level of granularity, but I have never
been in a position where I have applied for a job where I have
been negotiating on next year's business plan before I have been
appointed.
Q32 Mr Tyrie: But once you have been
appointed, your leverage is somewhat less, is it not? Would you
not want to be clear what you are going to have available to you
to do the job, bearing in mind that if you do not have the resources
it is your head on the line if, as a consequence of inadequate
resources, people blame you for not doing the job well?
Christopher Graham: Assuming this
process runs to plan, I believe that I will be in a position to
have further discussions with the Ministry by the end of February,
and I am not scheduled to take up the position until the end of
June.
Q33 Mr Tyrie: So you are going to
have a negotiation about the resources before accepting the job?
Christopher Graham: I am going
to have to talks about lots of things, but I have yet to learn
the ways in the Civil Service, and I had probably better not make
it up before a select committee.
Q34 Mr Tyrie: Let us just have one
more go. Are you going to make sure you have got the resources
to do this job before you finally say "yes" to the Government?
Christopher Graham: If I form
the conclusion that I have not got the resources to do the job,
then there would not be any point in proceeding, but I have not
had the discussion, so I do not know what the outcome will be.
Q35 Alun Michael: If you do work
out the ways of the Civil Service, perhaps you could come back
and let us know! The phrase that was used when we asked the current
Information Commissioner about his role was that it is as an individual
who is a corporation sole, which is unusual. We took evidence,
as you will have seen, and it was referred to in the evidence
that we took from him. I must say, I am a little bit puzzled about
the relationship. We are seeing the phrase "Information Commissioner's
Office" coming to the fore more, but the responsibilities
lie with the Information Commissioner. Do you have any insight
into how you are likely to refer to your role and the role of
those who will be supporting you?
Christopher Graham: I notice that
you raised this point with Richard Thomas at the last session,
and it is interesting. My experience of corporations: I have only
had experience of one, and that was the BBC. There were 12 governors
and they were the corporation. They were issued with a charter
and they just happened to employ the Director-General and a whole
load of people to make television and radio programmes. So I knew
what that was about. I have not encountered a corporation sole
before. I notice that Richard Thomas made the point that, as the
responsibilities of, first, data protection and, then, freedom
of information expanded, he has got quite a considerable operation
in Wilmslow, about 300 staff overall. There is a big management
job to be done and bringing everybody forward in the pursuit of
effective strategy, you do not get very far if it is all for the
greater glory of one individual. He has very much emphasised team
work, and I can understand why he has done that, but at the same
time I think in the report he did with Sir Mark Walport one of
the recommendations talks about reconstituting the Information
Commissioner operation as a multi-member commission on the lines
of the Office of Fair Trading and many of the other regulators,
and that is a perfectly logical position to adopt. I must say,
reading the decision notice on the Iraq Cabinet minutes from 2003,
I could not imagine that being tackled in the way we take decisions
about advertising standards, where the Advertising Standards Authority
Council considers something and sometimes there is a vote. On
that occasion the Information Commissioner, according to the decision
notice, had gone to Downing Street, had read the minutes, had
read the bits that were too secret to be mentioned, and so on.
It seemed to me that that is work that only one man can do. There
is, of course, the Information Tribunal, which has uttered today
on this, and there I think there was a majority vote, but this
seems to me a job where an awful lot of responsibility rests on
one individual, and perhaps it is just a question of clarifying
when this is a decision of the Information Commissioner, no doubt
supported and advised by a cast of several, and when you are talking
about "the machine" advising companies on how they ought
to comply, and so on, and possibly it is a question of getting
the branding right.
Q36 Alun Michael: I think that is
a very good point to make, if only from ministerial experience.
It has always seemed to me odd, if decisions are placed in the
name of the minister, if they have not been taken by the minister.
They may be in the powers of the minister, but actually making
clear that distinction is probably quite important. I am glad
that you picked up on the point of the responsibility lying with
the Commissioner. In the current arrangement that does seem to
be very much the focus of the arrangements. In that context you
referred to your experience of managing systems within your current
and previous arrangements, but increasing the decisions of the
Information Commissioner and, indeed, the team are going to have
to depend on an understanding of the systems that are being used.
Do you have a great deal of experience of IT systems? Are you
familiar with the sort of technicalities that would be used by
many of the organisations to which you will be the regulator,
and to what extent do you think that is an issue?
Christopher Graham: I think it
is important that one should understand the language; I think
it is important that one should know what questions to ask. I
do not claim to be an IT nerd. I employ a number of IT professionals.
We have been very ambitious with the IT developments at the Advertising
Standards Authority. I was the director general who said everything
has to be done online, I was the director general who said all
adjudications have to be published online, searchable, we will
do it weekly, instead of monthly in a little telephone directory,
and so on. So I am a great advocate of the potential of IT to
make organisations more efficient, to open up to the public, and
so on, but I do not claim to be an IT whiz who can do it all himself.
I think in this role it is very important and one should have
around one colleagues in whom one can trust, whether it is managing
the IT, or managing human resources or, indeed, giving very good
legal advice. It is important to be able to draw on various expertise,
not to pretend that one knows it all.
Q37 Chairman: How are you going to
deal with the Ministry of Justice, bearing in mind that unless
we get it our way it is going to be responsible for your pay and
rations? It is a body that you will want to scrutinise in its
role promoting freedom of information across government—that
is part of its duty—and it is a department which actually
has a rather weak record in its own management of freedom of information.
Christopher Graham: I am sure
that the committee is a very effective terrier snapping at the
heels of the Ministry, and perhaps it is a two-pronged fork with
the committee keeping up the pressure and the Information Commissioner
doing what the Information Commissioner does, but I would not
have thought that megaphone negotiations before the select committee
are going to get me very far.
Q38 Chairman: So you do not propose
to start any today?
Christopher Graham: No.
Chairman: Christopher Graham, thank you
very much indeed for what has been an interesting session for
us. Can I ask the committee members to stay behind; we have some
private business to do. Thank you very much.
|
