Home Affairs - Minutes of EvidenceHC 524

Oral Evidence

Taken before the Home Affairs Committee

on Tuesday 8 October 2013

Members present:

Keith Vaz (Chair)

Mr James Clappison

Dr Julian Huppert

Steve McCabe

Mark Reckless

Chris Ruane

Mr David Winnick

________________

Examination of Witness

Witness: Christopher Graham, Information Commissioner, gave evidence.

Q211 Chair: May I call the Committee to order and welcome again the Information Commissioner? Thank you very much, Mr Graham, for coming as you had promised to do to update us following your last appearance. May I begin, on behalf of the Committee, by thanking you for keeping to your promise of completing your scoping exercise in the time that you told the Committee you would be scoping the information that had been given to you? We do appreciate you have had a huge amount of information; I think 30 very large files from SOCA.

Christopher Graham: Thirty-one, Chairman.

Chair: Thirty-one. You have obviously counted every one of them. You have only had a limited number of staff, but you prioritised this and you have completed the scoping. We are most grateful for that.

Christopher Graham: Thank you, Chairman.

Q212 Chair: Thank you very much. What have you decided as a result of the scoping exercise?

Christopher Graham: Well, I set out the position fairly clearly in a letter to you on 30 September the result of our scoping exercise. You were kind enough to say that it was a very efficient operation. I think you would expect nothing less from a former Detective Chief Inspector of the Greater Manchester force. Working with an investigation manager and seven of our staff, they analysed the material and came up with the conclusions that I have reported to the Committee.

The headline is that by analysing businesses that are active, in other words still in operation, that are within the jurisdiction-because a number of them are not based in the UK-and looking at the prima facie evidence, albeit quite vague in some cases, around the instructions given by clients to the four private investigators who were convicted in Operation Millipede, we identified 19 of the 90 clients that we looked at. We did not look again at those eight who had been witnesses or whose evidence had been used in the Operation Millipede trial, but just as the scoping exercise to identify the scale of the task. We identified 19 clients where it appeared to us there were questions to ask about potential breaches of the Data Protection Act, either civil breaches or criminal breaches, namely breaches of section 55 of the Act, which as you know is a criminal offence. Breaches of the data protection principles are serious, but they are a civil matter and I can address that through civil monetary penalties in the worst case or through other regulatory action. In the case of the 19 that we identified where there was evidence either of a civil offence or a criminal offence, I think we established that in 12 of the 19 there was some evidence of a breach of section 55. That warrants a criminal investigation and that is what we are now embarking on. I must stress that there is some way to go because the evidence was not conclusive.

Q213 Chair: Of course. Yes, thank you very much. That is very, very clear. Of the 19 who you will be investigating, obviously there is prima facie evidence, as you have told this Committee just now, that an offence may have been committed. You yourself, I think, on 26 September in Civil Service World, that well-known publication, talked about the penalties that were currently available for those who had committed a crime under the Data Protection Act. You said, "That just doesn’t send out the message that this matters. It feels like a victimless crime. It isn’t even a recordable offence on the Police National Computer." Are you confident that, even after you have completed your investigation and people are going to be properly investigated and then subject to your powers, they will have paid the price for what they did?

Christopher Graham: This is the start of the investigation. If, for example, we established what looked like a conspiracy, a section 55 case would be pursued in the Crown court rather than the magistrates court. I was referring in that Civil Service World article to the more humdrum day to day, which gets into the magistrates court and where the fine-only regime visits a very unimpressive penalty on the perpetrator. Therefore, I have made the case on several occasions that I do not think people take this sort of thing very seriously.

Could I perhaps observe, Mr Chairman, in view of the news about the Privy Council’s apparent decision not to seal the other charter and the speculation in the press that the whole Leveson thing may be going on until the crack of doom or certainly beyond the general election, that this really is the time to rescue this whole section 55 issue from the Leveson complications.

Q214 Chair: What would you like to see happen?

Christopher Graham: I would like to see, if I dare suggest, an initiative taken by this Committee-if this is within the procedures of the House-for an Adjournment debate or a Westminster Hall debate to ask Ministers why they cannot commence the uncommenced legislation-sections 77 and 78 of the Criminal Justice and Immigration Act 2008 - which provide for more than a fine-only regime. I know this Committee has reported, as have other Committees, and made recommendations; but we just do not seem to be able to press this issue further. Perhaps this could be aired on the Floor of the House-you are the experts; you know how to pursue these matters-but I really think it is worth a further push. Are we really saying we are not going to do anything about Data Protection Act offences this side of a general election because we cannot agree with the Daily Mail?

Chair: That is a very important issue and we certainly will. We have the Home Secretary before us next Tuesday, so before we even get to an Adjournment debate we will ask her.

Q215 Mark Reckless: Why do you think Ministers have yet to take the opportunity to commence this piece of the legislation? What is stopping them?

Christopher Graham: I think there was a feeling at the time the Leveson inquiry was established that while this was uncompleted business and some sections of the press had been resisting the implementation of this change, they seemed to be claiming at the same time, "We don’t do this sort of thing but, by the way, even if we did it would be disgraceful to have more than a magistrates court fine." Section 77 introduces a potential prison penalty but, of course, offers the opportunity of everything between a fine and prison, including community service and so on. Section 78 specifically deals with the freedom of the press. It specifically strengthens the journalists’ defence. You would only have to show a reasonable belief that what you were doing was for publication and in the public interest, which is consistent with the whole of the rest of the Act.

We then waited for Leveson’s report. A year ago Lord Justice Leveson did report and said two things. First, it is a bad principle to have uncommenced legislation; and, secondly, we ought to get on with providing a more impressive penalty. Then I think we were waiting for the consultation on all things Leveson, but that does not seem to be happening any time soon. I just think this is an opportunity to get the issue back out from Leveson because it is not really about journalists, as we have seen.

Q216 Chair: Yes. Just going back to the numbers here, 19 are going to be the subject of further investigation. You told the Committee in the letter, and you have repeated it today, that of the original 90, 24 are outside the jurisdiction so you cannot pursue them. Is it not possible for you to ask those agencies-the equivalent of the Information Commissioner or other law enforcement agencies in those countries covered by those 24 cases-to help you pursue this? It seems rather sad that we cannot bring these organisations or people to justice because they are outside the jurisdiction. Do you not think we should write to the relevant law enforcement agencies and get them pursued?

Christopher Graham: We certainly intend to focus our activity on the potential criminal breaches of the Data Protection Act, but also to co-ordinate contact and engagement with other data protection authorities within the jurisdiction of the eight organisations that are operating overseas and where we have seen some evidence.

Q217 Chair: Yes, so it is eight countries, is it?

Christopher Graham: It is eight.

Q218 Chair: Eight countries covering the 24 other cases, covering the 24 names?

Christopher Graham: Well, one thing that I hope might emerge from this session is that you would consider publishing on your website my 30 September letter. By the way, I am going to answer your question, but it is quite a complicated subject and not everyone is in a position to follow it.

Q219 Chair: We will certainly do that, but there are 24 we cannot do anything about because they do not live in the UK?

Christopher Graham: Of the 67, 67 clients are clearly active. This is from evidence at Companies House and from having an active website and so on or, in the case of the few private individuals who are on that list, the person concerned can be traced and contacted.

Chair: Sure.

Christopher Graham: Of these 67, 24 are located outside the jurisdiction.

Q220 Chair: If I stop you after each category so we can get clarity for the Committee, of those 24 you intend to get in touch with law enforcement agencies or data protection agencies in those eight countries covering those 24 cases in order to get them pursued.

Christopher Graham: Yes.

Chair: They are not left on a shelf?

Christopher Graham: No.

Chair: Good.

Christopher Graham: What we are proposing to do, Chairman, in the same way that the scoping exercise was very methodical, we have new actions and then we have next steps.

Chair: Indeed.

Christopher Graham: Certainly, in the next steps there is the contact with data protection authorities outside the jurisdiction, and we do work very closely with the other member states of the European Union through the article 29 working party and so on, and indeed more widely through the International Conference of Data Protection Commissioners.

Q221 Chair: You were just in Warsaw?

Christopher Graham: Which was why the letter was a week late.

Chair: You were chatting to them.

Christopher Graham: You would have had the letter. The report was delivered to me on 23 September, as I said it would be.

Chair: Mr Graham, we are very happy. Please quit while you are ahead.

Christopher Graham: All right.

Q222 Chair: We think that you acted very swiftly and efficiently. There is no complaint about the receipt of the letter. I was just making the point that you know these people because you have just met them in Warsaw so you are aware of how to pursue this. So that is the 24. Of the 67, no case can be brought against the 24. Why is that? Another 24-the second lot of 24. According to your letter, 24 are outside the jurisdiction; in 24, no case can be brought.

Christopher Graham: In the case of a further 11 clients, we said we have at present insufficient information. That is insufficient information to work out exactly where they are or where they are not in the jurisdiction.

Q223 Chair: Okay, so what are we doing about that 11?

Christopher Graham: Well, we are going to have to make further enquiries. I had a very satisfactory conversation yesterday with the Director General of the new National Crime Agency, Keith Bristow, and he clearly regards this as important work-an important project. He clearly sees that in the serious and organised crime area there is potential for great mischief from rogue private investigators.

Q224 Chair: Sure, yes. So he is helping you with getting the information? Mr Bristow is helping you get information on the 11 others even though SOCA was-

Christopher Graham: Can I work from the outside in?

Chair: Right, sure.

Christopher Graham: Keith Bristow and the National Crime Agency are very keen to provide any appropriate NCA support the ICO requires in respect of our current work on private investigators.

Chair: On this issue, yes.

Christopher Graham: We are meeting Mr Bristow’s senior lieutenants to work out how we, the ICO and the NCA can work together to refine further the information we have from the scoping exercise.

Chair: On the 11?

Christopher Graham: But I am saying we are going to concentrate first of all-

Q225 Chair: No, no, I understand that. We just want to know next steps. Mr Bristow, who now, of course, runs what is left of SOCA-

Christopher Graham: Well, he runs the National Crime Agency, which is SOCA-plus.

Chair: Yes. Well, SOCA has now gone into the National Crime Agency.

Christopher Graham: I must say, Chairman-I know he is coming to see you next week-I was very encouraged with the conversation I had. I thought there was a lot of energy there, a very clear strategic grip, and I am very confident we are going to work well together.

Q226 Chair: Yes, indeed. We are very pleased. We all admire Mr Bristow’s grip and his energy and we will see it for ourselves manifesting itself next week. But of the 11, I just want to try to be specific because we do not want to have to write to you again. On the 11, you are seeking further information. You say "awaiting further information" in your letter. From whom are you awaiting further information?

Christopher Graham: By engaging with the National Crime Agency, the Metropolitan Police and others, we can understand a little better, because although we had 31 files of evidence, there are some questions arising from that. By pursuing this engagement, we think we will be in a better position to identify the priority cases.

Q227 Chair: Yes. The next group is the 24 where you say no case can be brought. That is it; they are off the list. Are we closing our files on the "no case to be brought" 24?

Christopher Graham: If further evidence emerges in our contact with other agencies, we will certainly take cases forward. What we are saying is the priority is those 19.

Q228 Chair: No, I understand that. I am just looking at the other 67 because, of course, if the Committee is handed a list of 102 and then you get a list of 98, we just want to know that we are doing our job and that the public understand what has happened to all these cases. Twenty-four no cases to be brought, according to your letter, and 12 are inactive?

Christopher Graham: There are 24 outside the jurisdiction.

Chair: Sure, I have that.

Christopher Graham: Let us go through the maths. Of the 90, there are 67 that we have established are active.

Chair: You said that before, yes.

Christopher Graham: But 24 of them are outside the jurisdiction. I will undertake that we will work with our colleagues in other data protection agencies to make sure that they are at least aware of-

Q229 Chair: You have said that. We accept that undertaking, but I am interested in the 24 where no case is to be brought. We just want to know. We are not having a go at you here. Are we just closing those files and waiting in case somebody writes in? You made it clear for the 11 that you are awaiting further information. You are going to talk to Mr Bristow and the Metropolitan Police, and you are seeking further information from someone.

Christopher Graham: Well, the only reason why I am being cagey is that I do not want to rule out what action we might take by pursuing the obvious cases because we might well find evidence relating to things that were not staring at us from the files.

Q230 Chair: Of course.

Finally, the last group that makes up the 67-though 24, 24, 11 and 12 comes to 71 in my book, but my maths is not brilliant-is the 12 that are inactive. They have ceased to exist. They are gone.

Christopher Graham: Yes.

Chair: There is no point in pursuing them.

Christopher Graham: We would say not unless it turns out the directors of the company were running a different operation. We might well want to ask questions of that. What I am saying is that we are going to focus on the case where we think a little bit of further investigation could bring a criminal case to court, and that is the 19.

Q231 Chair: Yes. So we come to the end of the numbers situation. One final question from me before I bring in Mr Reckless. Having gone through all these cases and received some of these cases four years after it came to the attention of SOCA and the Met, had you received it earlier, which is what you told the Committee you would have liked when you last appeared before us, presumably some of these companies would still be in existence.

Christopher Graham: I suppose that follows, though whether having established that those companies were still in business-this is a hypothetical game, isn’t it?

Chair: Of course.

Christopher Graham: I am not saying that we would establish that there was a case. I am sticking to the ones where I know I have locus, it is within the jurisdiction and there is the prima facie evidence-off we go then with that.

Q232 Chair: We understand that, but you have told us that there are cases where you cannot bring action, cases where you need further information and cases where the companies have ceased to exist. You have made the point today, quite rightly, that if you had it earlier, some of these still might be in existence.

Christopher Graham: I do not think it is very profitable for me to speculate about that. I am just getting on with the 19.

Q233 Chair: No, but I am just taking you back to what you said last time. You wished you had had this earlier so you could have done this amazing scoping exercise in two weeks that no other agency in the country has managed to do.

Christopher Graham: Hindsight is a wonderful thing.

Chair: Take the plaudits while they are there, Mr Graham.

Christopher Graham: Thank you, Chairman, but I really prefer to get on with the task in hand, which is the 19 cases.

Chair: Of course you do.

Q234 Mark Reckless: Mr Graham, you say hindsight is a wonderful thing, but surely there were people within SOCA for, I think, up to seven years who were sitting on this information and not passing it to you. Is that not wrong?

Christopher Graham: Having said I do not want to get into this game-I do stand by that-nevertheless I will observe that all organisations have to prioritise. The Serious Organised Crime Agency was presumably established to deal with serious and organised crime. Those who were responsible for decisions taken in the past are accountable for them. I cannot speculate about decisions. I do know that one does have to take very difficult decisions about priorities and choices, and I do not think anyone is suggesting that the Serious Organised Crime Agency was sitting there twiddling their thumbs. It is not as if there is not a lot of serious and organised crime around.

Q235 Mark Reckless: But is it not the case that some people have suggested that the Serious Organised Crime Agency was not taking this forward because it exposed misconduct among police officers, some serving, some retired, at least potentially in their dealings with the private investigators, and that it was not a priority to expose that?

Christopher Graham: Well, I think from my point of view, that is pure speculation. I have heard no evidence as to that.

Q236 Mark Reckless: I find it difficult to understand, Mr Graham, if you do not consider that anything reprehensible happened within SOCA and its discretion of prioritisation and no blame is ascribed to anyone, why would you expect to get this material with any alacrity in the future?

Christopher Graham: I do not propose, as the Information Commissioner, to worry away at that rather old bone. The Committee is well across all this. My job clearly started on 28 August when the material was handed over. We have carried out that scoping exercise, which the Chairman was kind enough to say was very effectively done. Now the question is moving on to the next stage of the serious investigations and making sure that where there are cases that we can bring to court, we do that, and where there are cases that are breaches of the data protection principles, we apply appropriate regulatory action.

Q237 Mark Reckless: If a firm wishes to employ a private investigator for nefarious purposes, would they be well advised to do that through a front company set up for that purpose such that they could expect not to be investigated?

Christopher Graham: They would be very well advised to stick to the law and follow the proceedings of this Committee and realise that the alarm has been sounded very loudly. The regulator is alert to the suggestions from this Committee and others that all is not well. I remind the Committee that, even for basic breaches of the data protection principles, if they are serious enough I have a power to impose a civil monetary penalty of up to £500,000. I do not think breaches of section 55 are regarded seriously enough by the courts at the moment but, nevertheless, it does not do the reputation of a company any good to be dragged into the magistrates court. If it is an organised conspiracy, I will take it to the Crown court and I will go for not only an unlimited fine, which the current law provides, but the restitution of the proceeds of crime.

I think the message is being heard. On the list of 19, there are four law firms. I had the Solicitors Regulatory Authority write to me straight away saying, "We need to know what you are doing about this because if you are not going to be prosecuting, we need to make enquiries about disciplinary action and so on." Similarly, we got engagement from the financial services people when we had the meeting on 19 September with other regulators and a further meeting is planned for November, so I think the message is getting through.

Q238 Mr Clappison: It is worth remembering that the beginning of this was the police investigation into the very unpleasant activities of the individuals who were originally convicted in Operation Millipede in pretending to be friends with people they were not in order to get personal details of their bank accounts and other things.

Christopher Graham: Yes.

Mr Clappison: We know that there were other police operations with different names also investigating private investigators who obtained personal information by other means, not just what is called blagging but interfering with people’s computers, listening into telephone conversations and the like. If you were given lists of clients for those private investigators, would you be able to do the same thing as you have done here?

Christopher Graham: Well, when it is a breach of the Regulation of Investigatory Powers Act, which carries a much heavier sentence, it is regarded as a more serious offence and that has been taken forward by the police and by the Crown Prosecution Service. When it gets to RIPA territory, it may be a breach of the Data Protection Act at the same time, but that is almost beside the point. Those organisations that have been investigated in the various other police operations with interesting names have not come my way because the Computer Misuse Act or the Regulation of Investigatory Powers Act are seen as more serious offences.

Q239 Mr Clappison: I am grateful for that but, as I understand it, those investigations on the regulatory Act and so forth have been directed against the private investigators, not the clients. We imagine that there were clients in each of those cases in the same way as there are clients in this case.

Christopher Graham: Yes. I think it is no easy task to establish that the client knew that the information that they were seeking could only be obtained by illegal means, or knew that the private investigator who had been commissioned was going to use illegal means. That is one of the reasons why it is quite a tall order us undertaking the investigation that we are undertaking.

Mr Clappison: I understand that.

Christopher Graham: You can imagine obviously things will be very strongly resisted, but I am going to have to prove beyond reasonable doubt that the client was party to an illegal act.

Q240 Mr Clappison: But it would defy common sense that somebody would come out and say, "Here is my bank account, please take it."

Christopher Graham: Yes, but if you asked a more general question of a private investigator, I suppose there are some things that are in the public domain and other things that are not. There is quite a lot you can do through open research.

Q241 Mr Clappison: I understand that and I understand the task that you face in relation to this matter, but for clients of the other private investigators in the other types of case involving infiltrating people’s computers and so on, you could perform the same operation as you have done here in this sort of timescale?

Christopher Graham: I am very happy to leave the Computer Misuse Act and the Regulation of Investigatory Powers Act to the authorities established to deal with that. This is a very standard police methodology. This is not rocket science. It is achieved by, in effect, deprioritising some other project because you have to take a team of eight people off whatever they were doing and put them on to this, which we gladly did in this case.

Mr Clappison: I understand that.

Christopher Graham: But I am not touting for extra work and extra projects.

Q242 Mark Reckless: Given the desultory speed of some of the Met investigations we have seen of late, when this is over, might they not perhaps profit from some secondments from your staff?

Christopher Graham: I do not have any staff to spare. Look, we are going to work very closely together on this and I am really not coming before you and saying the ICO is so much better at doing policing than the police. You gave me a very clear deadline and we met it, but from here on in it is going to be quite a task. I think we probably have an eight-month investigation on our hands before we can take it to the lawyers. I do not want to hold out hope that this is all going to be done tomorrow and I am going to have to deploy a team to do it. I hope that the National Crime Agency is going to assist, but one way or the other I am going to have to devote between £50,000 and £200,000 on this, which is fine and we will do that. The lower end is if the National Crime Agency can join in. If they can second staff to this, and possibly make available some office accommodation that they have nearby in the north-west, I can do it for £50,000. If I have to do it by recruiting agency investigators and provide additional accommodation, it is £200,000.

Q243 Chair: Mr Graham, before we go into your budget, let me just get this straight. You are going back to the National Crime Agency to help you with this investigation whereas, in fact, this whole thing started with SOCA, which is now part of the National Crime Agency. I am baffled as to why you are returning to a law enforcement agency over an issue that is to do with your powers as the Information Commissioner.

Christopher Graham: It stays under my command and the senior investigating officer will be our head of enforcement.

Chair: Of course.

Christopher Graham: But if I can persuade the National Crime Agency to deploy seven additional officers in my direction to do this, I do not have to go out and hire seven additional staff. That is what it comes down to. There is no question of it being handed back to SOCA.

Q244 Chair: This is the point Mr Reckless was making and I think Mr Clappison as well. Had this been started by SOCA 18 months ago-and you were reluctant to be drawn because of reasons of hindsight-you would not have to go back to the very people who gave you the files in the first place. This is a bit of a merry-go-round. They start with the files. They sit on the files for 18 months. They hand you the files. You were not very happy when they handed you 31 files when you came to see the Committee on the last occasion. You are now much more calm, if I may say so, about having to read through 31 files because you kept to your deadline and we are very grateful for that. Now those very files that have come from this agency are going back to this agency, which is now called-

Christopher Graham: No, the files are not going back to the agency. I need to have the conversations with the National Crime Agency but, as I say, we had a very satisfactory conversation with Keith Bristow yesterday. It is simply a question of manpower. If I have to hire in seven additional investigatory staff, that is going to cost me £200,000 and there will be a delay in recruiting. If I can get seven experienced police investigators on to the case, I am absolutely not handing command of this back to the National Crime Agency. I am just saying it is manpower.

Q245 Chair: But, Mr Graham, one of the concerns of this Committee is that SOCA sat on this for 18 months. We still do not know why and you are giving it back to an agency that SOCA is now a part of, so the same people who could have been part of the original investigation could be the people seconded to you. It does not seem to me the best way to proceed with an independent investigation. The Committee is not done with SOCA yet. We still want to know and no one has given us an answer. You have not because you are not part of SOCA. Mr Pearce has not. Nobody else has given us an answer as to why it took 18 months to give you 31 documents.

Christopher Graham: It is simply a question of manpower and I can give you the undertaking that as Information Commissioner the team under my command will take this forward. In order to do a lot of legwork I need seven extra people. Working with the National Crime Agency is one way of getting the additional manpower. I am picking up from the Committee that somehow the National Crime Agency is in quarantine at the moment. I had not understood that was the case.

Q246 Chair: No, it is not in quarantine. It is not the purpose of the National Crime Agency to assist the Information Commissioner with an investigation that has been going on for some years that started with SOCA. There is nothing wrong with the National Crime Agency; I actually support it. But whether or not it is right for your investigation, we want to see you going in there as an independent Information Commissioner pursuing this matter, relentlessly trying to find out those who are responsible, not going back to the very people who sat on the file for 18 months.

Christopher Graham: It depends at what level you think decisions to sit on something were taken.

Chair: We do not know.

Christopher Graham: But if we are saying that it is a question of the priorities of different agencies and I am telling you this is a priority for my agency, it is simply a question of boots on the ground, Chairman. But I listen to what you say.

Chair: I think it would compromise your independence, frankly, but in any event we have not heard from the Lord Chancellor. We asked him to provide you with more footwear, so if we can get some more boots on the ground, that might be able to help you.

Q247 Mark Reckless: Could I just ask, Mr Graham, is it because the National Crime Agency has improved on SOCA and is a different organisation that perhaps you have this level of confidence now?

Christopher Graham: All I am seeking to say is I had a very satisfactory conversation with the Director General of the NCA, Keith Bristow. I know he is coming to see you next week. You will form your own view. The sort of people who you need to conduct this police-like investigation are very likely to be the sort of people that the National Crime Agency employs and I would employ if I was employing even more investigators. It is either a question of me going and spending £200,000, which I do not have, to recruit, on an agency basis-because it is an eight-month project-some trained investigators, or I can work with other regulatory bodies. I do stress that I am not going to surrender command of this investigation to any other agency.

Q248 Chair: Okay. Let us finally ask you some questions about the victims of these terrible possible crimes. You identified in your very helpful letter 125 victims. Have all these victims now been notified?

Christopher Graham: No.

Q249 Chair: Are you planning to do so?

Christopher Graham: We need to do this step by step.

Chair: Sure.

Christopher Graham: As we eliminate classes of client from further interest because there is apparently little going on, either because the organisation is inactive or because we could not see that there was any fault, we need to work out how we put that information to those who were affected and also into the public domain. That means talking, for example, to some of the regulatory bodies. I would imagine it would also involve informing clients. So far with the 19 cases that we are investigating, we have identified 125 data subjects, as we like to say. Now I am not going to contact the 125 data subjects at this stage because that is going to muddy the investigation, but at some stage I would need their assistance in bringing cases to court. At some point then, certainly, we do want to make sure that "victims" are informed.

Q250 Chair: Sure. It is the case at the moment that some of those 125 people do not actually know that their private data has been accessed by private investigators, is it?

Christopher Graham: It is possible they do not know. It is highly likely they do not know.

Q251 Chair: All right, but you know who they are and at some stage you might contact them to assist you in your prosecution?

Christopher Graham: Yes. The fact that we have identified 125 means the information must be in the files.

Q252 Chair: As far as the meeting you had with the regulators, the insurance companies, the solicitors and the financial services, I think you said in your letter to us that it was a very productive meeting. Do you know if any of them are planning to bring out new guidance for their organisations that form part of their remit on this issue? Are they waiting for you to finish?

Christopher Graham: I was not at the meeting myself. I had very good reports of it. I certainly had the response that I mentioned to you from the Solicitors Regulatory Authority, which is very keen and says, "Let us look at the files as soon as possible." We have a further meeting in November and I think everyone wants to play a constructive role. It is not just criminal action or formal enforcement action by the regulator, but there is clearly a job of work to be done in terms of education and guidance to encourage compliance with the Data Protection Act that way.

Q253 Chair: Excellent. What would be very helpful-you have given us a kind of a timetable of eight months, you say, before you can begin.

Christopher Graham: Yes.

Chair: Presumably, at the end of that process, you will be naming those responsible for breaking the law because that is part of the system, isn’t it?

Christopher Graham: You as a lawyer, Chairman, will know that once the evidence is pulled together, you then have to discuss it with the lawyers to work out how you can prosecute the case. I do not want to over-promise and say that there is going to be a great publication of names at the end of eight months.

Q254 Chair: No, but if you are going to prosecute, presumably even that cannot be kept between the NCA and the Information Commissioner.

Christopher Graham: When people are prosecuted in open court, of course it is made available. As soon as it becomes clear that we are not going to be able to take matters forward, there is more information one can give about what did not happen.

Q255 Chair: Indeed. That is very helpful. What would be helpful to this Committee-we do not want a running commentary on what you are doing because obviously you are extremely busy-would be if you could let us have an update by Christmas, which is three months into your eight-month period.

Christopher Graham: I do not think, Chairman, that I will have more that I can say about the ongoing investigation at that stage.

Q256 Chair: No, but issues about your accommodation and your manpower are of concern to us.

Christopher Graham: Of course. Well, I am grateful to hear that.

Chair: We do not want you to be homeless in the north. We want you to make sure that you have proper facilities, you do not have to borrow pencils and rubbers from the National Crime Agency, that you are fully in tune and you have control of this investigation.

Mark Reckless: And whether the files are going back to the NCA.

Christopher Graham: Could I in turn ask about the letter that I wrote to you on 30 September? Am I going to publish it on my website or you are going to publish it on yours? It is just because that sets out very clearly what the situation is, I think. I know it was made available to the press last Friday, but presumably now we have had this session it will be published on your website.

Chair: Absolutely. I think the Clerks will take that as an instruction. As you said in Civil Service World, "I am interested in the communication side of things because it is very important to get our message across." Do not worry, your message will get across on the Home Affairs Committee website. We are extremely grateful to you-I mean that sincerely-for the effort you have taken to make sure the scoping was completed and you provided us with full and complete information. That is the model for all agencies and organisations that deal with Committees of Parliament. Thank you very much, Commissioner.

Christopher Graham: I am most grateful, Chairman.