|
UNCORRECTED TRANSCRIPT OF ORAL EVIDENCE To be published as HC 146-ii House of COMMONS MINUTES OF EVIDENCE TAKEN BEFORE JUSTICE COMMITTEE
THE WORK OF THE INFORMATION COMMISSIONER
MR CHRISTOPHER GRAHAM Evidence heard in Public Questions 23 - 38
USE OF THE TRANSCRIPT
Oral Evidence Taken before the Justice Committee on Members present Sir Alan Beith, Chairman Mr David Heath Alun Michael Julie Morgan Dr Nick Palmer Mrs Linda Riordan Mr Andrew Turner Mr Andrew Tyrie Dr Alan Whitehead ________________ Witness: Mr Christopher Graham, preferred candidate for the post of Information Commissioner, gave evidence. Q23 Chairman: Mr Graham, welcome. This is the second appointment hearing that this Committee has held. We are glad that in good time an appointment has been made for a very important post of Information Commissioner. The present holder of the post has appeared regularly before the Committee. I wonder if you could just tell us in a few words what features in your own background and experience you think will actually help equip you to do this job. Mr Graham: Good afternoon, Chairman. I come from a regulatory background. Since April 2000 I have been running the Advertising Standards Authority, which deals with 26,000 complaints about advertising each year. It is an industry self-regulatory body, but since November 2004 we have had contracted out responsibility from Ofcom to deal with TV and radio advertising as well as the non-broadcast advertising which traditionally we have been dealing with since the organisation was established in 1962. In that role I have to deal with codes, with the possibility of being judicially reviewed, with the need to provide a proper customer service and the need to get compliance. I think it has given me, particularly with my two years as Chairman of the European Advertising Standards Alliance, a familiarity with the regulatory landscape. It has also given me the experience of running a large organisation, the experience of managing change, developing a customer service culture and so on. Chairman, before that I was a BBC lifer. I joined as a journalist and I ended up as the Corporation's secretary. For three years I was making sure that the Director-General and the Governors of the BBC were carrying out the terms of the World Charter and so on and so on. That was not an easy row to hoe either. I think I am broadly familiar with the challenges of this job. It is very exciting. Only today we have seen stories of a significant leak of personal information from one of the job recruitment websites, possibly the biggest leak of personal information since the loss of all those child benefit records recently. We have had a decision from the Information Tribunal this afternoon supporting the Information Commissioner's ruling on the release of the 2003 Cabinet records. I followed with great interest the debate in the House of Commons yesterday on the Second Reading of the Corners and Justice Bill. There is a lot going on. I am very humbled but excited to be asked to take on this responsibility subject to the approval of your Committee and some other procedures. I think I am equipped through my skills and experience to bring something to this role. Q24 Alun Michael: Could you say something about your philosophy and your approach to the role? This role started off in data protection and has moved to a much more sophisticated and therefore more challenging brief over recent years. Having seen the way that has been developed, particularly in the accumbency of the current Information Commissioner, how do you see yourself taking that forward? What is your attitude to the issue of information, data management, sharing and retention? Mr Graham: My first reaction is that a challenging job is getting even more challenging. There are new powers and duties, some already have been granted and some that are in the Bill that you are considering. In the course of 2009/2010 the Information Commissioner is going to have significant new powers, particularly on the data protection side and one hopes the resources to use those powers effectively. You asked what my overall approach is. First of all, that the organisation should be well led and well managed, that it should be effective and efficient. I think that is the sine qua non, it is the licence to practice. The Information Commissioner has got to demonstrate that he is delivering a service across the responsibilities of data protection and Freedom of Information and so on, that we can tackle the backlog of delays on the Freedom of Information side, for example, and win the respect of all stakeholders, which I think then gives the Information Commissioner the platform on which to contribute to public policy debates around data protection and Freedom of Information and so on. I would emphasise very much the importance of the education and information side with the enforcement and the sanctions as the big stick in the cupboard. It is important that everyone knows it is there and will be got out only if necessary. There is the huge task of education and helping people to comply, which has always been my approach with the Advertising Standards Authority. I am not particularly interested in waiting around the corner saying, "Aha, we've got you," but that is necessary from time to time. It is much more important to put the resources in to making sure that public authorities and commercial organisations decide what their responsibilities are and they get on with it, but they have got to believe that if they get things wrong the Information Commissioner will be effective and will be prompt and, in addition to the reputational damage which necessarily arises from getting things wrong, there will be sanctions visited upon miscreants. And finally, my approach would very much be the need to convince the authorities and stakeholders in general of the absolute independence and integrity of the Information Commissioner. I think we achieve that by being absolutely evidence based, cool, calm, determined to defend decisions that are being properly arrived at, praised when necessary, but the first thing to do is to win the respect of all those who are interested in this area by manifestly running an effective operation at a time of great challenge and great change. Q25 Alun Michael: There is sometimes a tendency when there is regulation and when there is quite tough regulation to look for ways of playing safe. There have sometimes been swings in public mood, on the one hand, to say that everything needs to be shared, an example was of the Soham murders, which was actually a technical problem but led to that sort of public reaction, and, on the other hand, saying nothing should be shared or you should keep everything to the minimum. Where do you stand on that spectrum? Mr Graham: It is a bit like health and safety in that it can often be given as an excuse for not doing something and perhaps the excuse is given by those who do not quite understand what the rules are. Again, there is a challenge to the Information Commissioner's office to make it very clear how we do data protection and how we do Freedom of Information. A point that was made by Richard Thomas' study with Sir Mark Walport about data sharing was that the current rules were rather imperfectly understood. I am not going to go further down this road because it is a matter that is absolutely for debate with the Coroners and Justice Bill. I saw there was a difference of view in the Second Reading debate last night. It will be very interesting to see how it pans out. At the moment within the Bill there is a very considerable responsibility laid on the Information Commissioner to take a view about individual departmental applications for data sharing. I would take that very seriously. Let us see how the legislation ends up. All I would say specifically on that is that I note it all has to be turned round in 21 days. I hope very much that departments that are contemplating this sort of thing are going to be in early dialogue with the Information Commissioner's office because if everyone is trying to do it 21 days ain't long to turn it round. Q26 Chairman: You have got the problem, which you mentioned, of a substantial backlog on the Freedom of Information side. You said that it was a priority to deal with that backlog. I am not quite sure whether you have had any promises made to you of better resources or you have got an understanding with the Ministry of Justice about this. When you take on board new responsibilities on the data protection side, which data sharing itself generates, it is going to be pretty challenging, is it not, to deliver in this organisation? Christopher Graham: It is very challenging. To answer to your question, I have not had any discussions with the Ministry of Justice about resources. I have not had many discussions beyond the job application. I think the fun now starts. On the data protection side, there is, as I understand it, given the proposals in the Bill, the possibility of some, should one say, elasticity in resourcing, and resourcing on the data protection side is likely to be very considerably increased because of the graduated fee structure. Q27 Chairman: This committee recommended that. Christopher Graham: That is very good news, and to an outsider that looks to be fine, but I also know, from those who have explained to me the mysteries of the Public Accounts Committee and managing public money, that there cannot be an environment between the two sides of the business and so one cannot make a profit on the data protection side in order to subsidise the freedom of information side. The freedom of information side looks to me, but I have not been up to Wilmslow, I have not spoken to anyone, to be pretty tightly resourced. I think there was an extra half million or so voted this year in order to assist in clearing up the backlog, but it is a backlog that has been there pretty much from day one, and I thought, reading Richard Thomas's evidence in a session you had a fortnight ago, it was very compelling when he said words to the effect that the level of applications to the Information Commissioner on freedom of information matters is up 15% this year. So it will be interesting to see how we can deal with that increase and clear up the backlog unless there are significant resources made available, but I would also say that this is a problem that is not unfamiliar to me. When I arrived at the Advertising Standards Authority in 2000, I made a priority the turn round of complaints within a reasonable period of time, because I said justice delayed is justice denied. Unless you can demonstrate that you are an efficient organisation handling the business promptly, people will not take you seriously on anything else. We did manage to make a considerable impact through introducing a number of things that would actually not be new at the Information Commissioner's Office. I am not pretending I have got a magic bullet. Key performance indicators, regular reporting, proper triage, and so on - I think all those are in place. I would merely say that I regard it as a priority, it is very important, to make progress on that backlog, and the reason is this: a deterrent only works if people fear it. People have to have a reasonable expectation that there is going to be a result pretty quickly that will either be welcome or unwelcome, and so that suggests that there is a considerable benefit in turning round cases promptly which has a wider benefit than just doing the job you are there to do but has a resonance about effectiveness that runs right through the work. Q28 Mr Heath: A lot of the work of the Information Commissioner, as has already been suggested in this session, is dealing with the applications, the complaints side effectively. Part of the job, surely, must be, however, to prevent those applications and complaints ever reaching the Office of the Information Commissioner by instilling a proper culture within the organisations over which you have an interest, and I think one of the concerns that is often expressed is that those officers who are dealing with data protection, dealing with freedom of information are at too low a status within the organisation and that it is not being sufficiently considered at chief executive level, at board level. How would you set about changing that culture and reminding organisations that actually it is a core responsibility to make sure that the organisation understands FOI and understands data protection? Christopher Graham: It could be that they will have to learn the hard way. There is tremendous reputational fallout, both for departments of state, public authorities, but also commercial organisations, when things go wrong, and it may be that the delays in a decision being made have the unfortunate effect of somehow making it seem it does not really matter. If you remember, Dr Johnson said that the prospect being hanged tomorrow concentrates the mind wonderfully; the prospect of being hanged in about three or four years' time is probably less effective - that is point one. But I very much respond to the suggestion, which I know is shared by the current Information Commissioner, that information needs to be regarded as a risk to be managed at main board level. In the same way that you have financial risks, there are also huge risks to reputation, to effectiveness, to the business, by people being careless with people's personal information or by people appearing to be shifty because they do not want to let the public know what is going on. There is a virtuous circle where efficiency in the office contributes to the organisation being feared, in the sense of being properly respected, and I absolutely support Richard Thomas's suggestion that information is something that should be a main board responsibility, and he spoke, I thought, very compellingly at your last meeting about the threat of toxic information. We have heard about toxic assets. Companies are sitting on information which is sometimes badly managed, not properly safeguarded, and the fallout of the company is absolutely huge. I would not like to be in the position of the people at the Monster recruitment agency who have just managed to lose absolutely everyone's details apparently; that is not good for business. Q29 Mr Heath: One of the problems (and perhaps you have just touched on it) is the ever increasing size of databases and also the ever increasing complexity of the IT systems that underpin them, to the point where possibly the people who operate them cannot aspire to really understand entirely what they are doing, but certainly your office is going to have more and more difficulty, are they not, in keeping pace with the technology that you are policing? Christopher Graham: In any modern organisation you have got to keep pace with technology. We were discussing it at our ASA directors' meeting this morning and one of the pieces of information I picked up is that a small organisation like the Advertising Standards Authority, with 100 staff and a budget of about eight million pounds, dealing with 26,000 complaints, has got 52 servers - some of them are virtual servers, but 52 servers - we are very IT dependent. I will not say we are paperless, but we are paper less - less than we were. Anyone who is running a modern organisation these days has not to try to run the IT themselves but to have a good IT department and to keep abreast of the issues. I am on the receiving end of the data protection side of this issue in a number of ways. We deal with database practice in the marketing business. It is a breach of the British code of advertising sales, promotion and direct marketing to do direct marketing using databases in the wrong way. So this is very much the currency of what we deal with, but also for an organisation like the Advertising Standards Authority, which presumes to tell everyone how they ought to behave and goes on about standards, to be caught out with a big data leak or promoting ourselves inappropriately under the rules, and so on, would be a disaster: that is why we are talking about it this morning. These are issues that I am familiar with in a general way. I do not kid myself that I do not have to do an awful lot of preparation before I take over, if I am asked to do that, at the end of June. Q30 Dr Whitehead: When Mr Thomas gave evidence to the committee he commented quite strongly on the principle of the source of funding for the Information Commissioner and felt that, in principle, the funding of the Information Commissioner might be transferred to Parliament. Is that your view and, if you do proceed to become the Information Commissioner, would you actively pursue that as a future model for the funding arrangements for the Information Commissioner's Office? Christopher Graham: I cannot pretend that I have
got views on every subject under the sun.
I have applied for a job, I have been given a provisional okay, and
there is a lot of work I now need, as one would in any job, to see how one
would approach things, so I do not want to make rash promises. It would be a popular one to make here,
because I think that the work and most of the running on this issue has been
made by this committee. Perhaps I should
just confine myself to saying it seems logical, it is the way they do things in
Q31 Mr Tyrie: Did I hear you right when you said that you had not clarified with the department the level of resources that you would have to do your job? Christopher Graham: I know what is in the plan; I know what is in the three-year strategy; I know what is in the public expenditure plans. I have agreed with the existing Information Commissioner that there can only be one Information Commissioner at a time. He is conducting the usual negotiations with the Ministry, and if this committee concludes that I am a fit and proper person and if the rest of the process goes through, then I will be in a position, over the period before I take up the position on 29 June, to get into a further level of granularity, but I have never been in a position where I have applied for a job where I have been negotiating on next year's business plan before I have been appointed. Q32 Mr Tyrie: But once you have been appointed, your leverage is somewhat less, is it not? Would you not want to be clear what you are going to have available to you to do the job, bearing in mind that if you do not have the resources it is your head on the line if, as a consequence of inadequate resources, people blame you for not doing the job well? Christopher Graham: Assuming this process runs to plan, I believe that I will be in a position to have further discussions with the Ministry by the end of February, and I am not scheduled to take up the position until the end of June. Q33 Mr Tyrie: So you are going to have a negotiation about the resources before accepting the job? Christopher Graham: I am going to have to talks about lots of things, but I have yet to learn the ways in the Civil Service, and I had probably better not make it up before a select committee. Q34 Mr Tyrie: Let us just have one more go. Are you going to make sure you have got the resources to do this job before you finally say "yes" to the Government? Christopher Graham: If I form the conclusion that I have not got the resources to do the job, then there would not be any point in proceeding, but I have not had the discussion, so I do not know what the outcome will be. Q35 Alun Michael: If you do work out the ways of the Civil Service, perhaps you could come back and let us know! The phrase that was used when we asked the current Information Commissioner about his role was that it is as an individual who is a corporation sole, which is unusual. We took evidence, as you will have seen, and it was referred to in the evidence that we took from him. I must say, I am a little bit puzzled about the relationship. We are seeing the phrase "Information Commissioner's Office" coming to the fore more, but the responsibilities lie with the Information Commissioner. Do you have any insight into how you are likely to refer to your role and the role of those who will be supporting you? Christopher Graham: I notice that you raised
this point with Richard Thomas at the last session, and it is interesting. My experience of corporations: I have only
had experience of one, and that was the BBC.
There were 12 governors and they were the corporation. They were issued with a charter and they just
happened to employ the Director General and a whole load of people to write
television and radio programmes. So I
knew what that was about. I have not
encountered a corporation sole before. I
notice that Richard Thomas made the point that, as the responsibilities of,
first, data protection and, then, freedom of information expanded, he has got
quite a considerable operation up in Wilmslow, about 300 staff overall. There is a big management job to be done and
bringing everybody forward in the pursuit of effective strategy, you do not get
very far if it is all for the greater glory of one individual. He has very much emphasised team work, and I
can understand why he has done that, but at the same time I think in the report
he did with Sir Mark Walport one of the recommendations talks about
reconstituting the Information Commissioner operation as a multi-member
commission on the lines of the Office of Fair Trading and many of the other
regulators, and that is a perfectly logical position to adapt. I must say, reading the decision notice on
the Iraq Cabinet minutes from 2003, I could not imagine that being tackled in
the way we take decisions about advertising standards, where the Advertising
Standards Authority Council considers something and sometimes there is a
vote. On that occasion the Information
Commissioner, through the decision notice, had gone to Q36 Alun Michael: I think that is a very good point to make, if only from ministerial experience. It has always seemed to me odd, if decisions are placed in the name of the minister, if they have not been taken by the minister. They may be in the powers of the minister, but actually making clear that distinction is probably quite important. I am glad that you picked up on the point of the responsibility lying with the Commissioner. In the current arrangement that does seem to be very much the focus of the arrangements. In that context you referred to your experience of managing systems within your current and previous arrangements, but increasing the decisions of the Information Commissioner and, indeed, the team are going to have to depend on an understanding of the systems that are being used. Do you have a great deal of experience of IT systems? Are you familiar with the sort of technicalities that would be used by many of the organisations to which you will be the regulator, and to what extent do you think that is an issue? Christopher Graham: I think it is important that one should understand the language; I think it is important that one should know what questions to ask. I do not claim to be an IT nerd. I employ a number of IT professionals. We have been very ambitious with the IT developments at the Advertising Standards Authority. I was the director general who said everything has to be done online, I was the director general who said all adjudications have to be published on line, searchable, we will do it weekly instead of monthly in a little telephone directory, and so on. So I am a great advocate of the potential of IT to make organisations more efficient, to open up to the public, and so on, but I do not claim to be an IT whiz who can do it all himself. I think in this role it is very important and one should have around one colleagues in whom one can trust, whether it is managing the IT, or managing the human resources or, indeed, giving very good legal advice. It is important to be able to draw on various expertise, not to pretend that one knows it all. Q37 Chairman: How are you going to deal with the Ministry of Justice, bearing in mind that unless we get it our way it is going to be responsible for your pay and rations? It is a body that you will want to scrutinise in its role promoting freedom of information across government - that is part of its duty - and it is a department which actually has a rather weak record in its own management of freedom of information. Christopher Graham: I am sure that the committee is a very effective terrier snapping at the heels of the Ministry, and perhaps it is a two-pronged fork with the committee keeping up the pressure and the Information Commissioner doing what the Information Commissioner does, but I would not have thought that megaphone negotiations before the select committee are going to get me very far. Q38 Chairman: So you do not propose to start any today? Christopher Graham: No. Chairman: Mr Graham, thank you very much indeed for what has been an interesting session for us. Can I ask the committee members to stay behind; we have some private business to do. Thank you very much. |