well good morning everybody and thank
you very much boy Jana for those very
very generous words it's a bit like
hearing your own funeral oration but I
do i do assure you and you know I'm not
gone yet Hera Wilson famously said that
a week is a long time in politics well
I've got ten weeks to go and ten weeks
in digital is a long time to the power
of of 10 and there's a lot of politics
going on in case you you hadn't noticed
so it's a great pleasure to be with you
this morning and to see a lot of old
friends and possibly just reflect a
little bit on what we can learn from
from seven years that's relevant to
what's going on now um I think the first
point I would make is that it's a it's a
miracle that i'm still here you see 70
years seven years as it's a traditional
time for it for apprenticeships i'm just
about ready to start now but seven years
it's been a time when there's been so
much change in the digital space and so
much time so much change in the economy
as a whole i think one thing i have to
be very thankful for is that that i'm in
a job and that you're in a job because
lots of people aren't and one of the
reasons that i'm in a job is that the
information commissioner in the UK is
this peculiar animal a corporation soul
appointed by Her Majesty the Queen and I
think we ought on this on this
auspicious day the occasion of her 90th
birthday to wish her majesty many happy
returns of the day because in my warrant
appointing me as the information
commissioner she describes me as trusty
and well-beloved so I think I should
return the
the compliment but term it's um it's
it's a point i like to make that the
Independence of the Data Protection
Authority in the UK is established
because the Information Commissioner
once appointed can only be removed by
joint resolution of both houses of
parliament and dismissed by Her Majesty
the Queen so it gets kind of good job to
have in a recession and looking back
over seven years what what a recession
it's been you are in an area that's been
growing but a lot of a lot of other
areas haven't and it's as well to
remember that and the ICO over seven
years I think reflects the growth in the
importance of the digital business
because the extra responsibilities that
we've been given by Parliament mean that
if you compare the head count now with a
head count when I when I came in the
growth has been spectacular so much more
to do we've had to do as they say better
for less we've had to find new ways of
doing things but if you look at
full-time equivalents in 2009 we just we
had just over 300 staff and it's now
just over 400 it's been a thirty five
percent increase in the full time
equivalent of people working at the ICO
and that's supported not by government
money not by granting aid because that
for the Freedom of Information side of
the business has been consistently cut
year after year after year it's been the
growth in notifications under the data
protection act the growth in in people
signing up as as data controllers and
that's provided the resources for the
Data Protection Authority here in the UK
to do the job that boy Jana has been
describing and as Trevor said it's a
good time to be a privacy profession or
two isn't it because we've heard that
the data protection regulation will
require the recruitment of 28,000 data
protection officers
um and the the the game that we're all
in is making sure that we can get the
benefits that digital offers while
avoiding the risks now the benefits that
digital offers if you think back over
seven years part of my standard stump
speech will be will be hearing from
lauren from Transport for London shortly
but part of my standard stump speech
when I started was isn't it exciting all
the wonderful things that can be done by
mashing digital information looking at
maps of transport maps of London looking
at accident statistics and planning safe
cycle routes and this was before we ever
got to silicon roundabout and all that
sort of thing but clever people in bike
sheds in Hackney were developing apps
that would make for safe safe cycling in
London and all of us are in the business
of making sure that digital delivers the
good things and that we avoid the
pitfalls that we we find the
opportunities and and that and the
growth and the prosperity that comes
from that but but we avoid the threats
it's been said I don't know who said it
I'd be in shamelessly repeating it that
we thought that digital was the new oil
and then we discovered that it was also
the new asbestos so it's about managing
the the threats as well as the
opportunities and that's the business
that you're in when i was attending the
recent I APPL summit in Washington on
the subway there was an an an ad for a
digital security service wasn't a very
good ad because I don't remember who it
was advertising but I do remember the
line which was digital is rockstar but
it needs a good manager or it trashes
everything and it's the balance of the
opportunities and the threats that the
that is the business that we are all in
but at the global privacy summit
listening to some of the speeches I
wondered whether we actually are in
quite the same business because the
danger is that some people are inclined
to use the the term privacy when they
actually just mean digital some of the
speeches that I heard you could just
take out the word privacy and put in the
word digital and it was exactly the same
message in other words it was all about
the opportunities and and none about
threats now it's the Data Protection
Authority for the UK the Information
Commissioner's Office is very much about
advice and guidance and enforcement to
make sure that the threats the personal
privacy are properly managed and if we
get too excited about all the wonderful
opportunities and don't manage our way
through the regulation then we're not
doing anyone any favors and I I I heard
a little bit too much buccaneering
speech from the people charging off to
the great new world not bearing in mind
sufficiently the way in which you can do
that but you can do that safely and if
you don't do that safely then you're
going to be in trouble with the
authorities it's no good saying what we
don't it's a brave new world we don't
need all this regulation it's just
getting in the way the clever thing to
do is to work out where you want to go
and how you're going to get there but
making sure that you don't disrespect
individuals autonomy and the rights of
citizens and consumers and the
information commissioner's office under
whoever's leadership is going to be
constantly making the point to you this
is how you get the best of both worlds
this is how you get the opportunities
and the growth in the excitement of
doing things a new and exciting way but
you do it without disrespecting and
people's privacy and I found myself
playing a little game because I like
anagrams and I discovered that the
whether you call it privacy or privacy
there's only one letter difference
between privacy and piracy and be
ambitious do what you want do what you
want to do but stick within the rules
and the Information Commissioner's
Office will be your ally but get it get
it wrong and you're going to be in
trouble with the regulator who ever
whoever it is now if you were attending
the session on the the jurisprudence
around the general data protection
regulation yesterday you'll have heard
my my colleague steve wood talking about
some of the things that the the ICO is
doing to make sure that the regulation
when it comes in finally in two years
time is something that can be complied
with relatively easily I'm sure he will
have referred you to the ICO website WWI
co uk where you can access our 12 steps
to take now to compliance with the the
new regulation yesterday we were holding
an event for small business in in
Birmingham and we were bigging up our
SME toolkit which you can also find on
on the website we've been conducting
stakeholder consultations and we're
standing ready for advice and guidance
and I had a call yesterday for one of my
opposite number data protection
authorities in Europe saying it can you
send us all your stuff because we need
to do that too and we don't we don't
want to reinvent the wheel so working
with our colleagues in the article 29
working party we're going to make sure
that we are effective partners and in
implementing the data protection
regulation Brianna said some heroic
things about fines I don't know whether
Spain finds more than the UK or UK finds
more than Spain what I do know is Spain
gets to keep the money in and and I have
to hand it over to to George Osborne but
the the fines that we do impose our are
pretty small beer I mean it's it's not
it's not good ahead
is it if you're hit with them 350
thousand pound fine for doing stupid
things with the nuisance phone calls but
I'm sure you will have heard and it's
it's a it's a point that I think you
need to take back and stress to your
chairman and the board and your chief
executive and your chief finance officer
it's not about half a million pounds
from the information commissioner
anymore it focus on 20 million euros up
to 20 million euros focus on up to four
percent of global global turnover I
think those are figures that should
interest the chairman on the board and
the chief executive in the chief finance
office of course they sure as hell will
interests shareholders now I'm not
suggesting that we're suddenly going to
go into a very butch world of finding
finding everybody but this regulation
the European general data protection
regulation means business when it comes
to enforcement so that's the big stick
in the cupboard yes we want to work with
you yes we want to give clear advice and
guidance yes we want to enable good
things to happen and show you ways of
achieving what you want to achieve while
sticking to the rules but in the
background for those organizations that
don't take any notice for those
organizations that don't care for those
organizations that think they can get
away with it it's not a question of
shrugging off up to half a million
pounds if you're some great global
company that can well afford it this is
serious money and serious enforcement
which which you would do well to plan
for very carefully if you look at those
12 steps a lot of it is about raising
awareness within the organization of the
role which people like you need to play
it's not it's no longer something that
happens down the end of the of a
corridor we don't care very much about
it this is absolutely slap bang on the
risk register of any organization
commercial or otherwise and needs to
needs to be taken on board
now Vienna said we dealt with we've
dealt with the previous of shield and
now we can move on and think about the
regulation well I wish we had dealt with
the the privacy shield because I saw a
story running on Reuters yesterday but
some high-up figure in the American
administration was saying 'yeah will
read very carefully what the article 29
working party had to say about the
regulation but basically we're not very
interested in in say much more about
this and I paraphrase the article 29
working party of the data protocol the
dead protection authorities was
reviewing the documentation that emerged
from the European Union and American
negotiations on the privacy shield and
we asked some very simple and basic
questions which are about clarification
and if the data protection authorities
who are fairly expert in this area are
asking questions and you can be pretty
sure that the Court of Justice of the
European Union will also the asking
question so it'd be very sensible if
both the European Union and the
Americans actually answered the
questions then the questions arise about
the lack of clarity within the
documentation around the justification
for bulk data collection the
independence on the over the Ombudsman
and by the way it is an ombudsman even
if the post holder is female it's a
Swedish word you can't suddenly put
person it into it European Ombudsman is
Emily O'Reilly the American Ombuds man
is is also a woman it's not a sexist
point it's just Swedish
so and the third point is that we were
concerned about processing of
information transferred to the states
which then moves on to to third
countries now these are perfectly
reasonable questions to ask and if there
aren't answers there's only going to be
trouble down the road so I would urge us
corporates who have a great interest in
getting this thing sorted out so we can
move on to other more constructive for
users of our time to have a word in the
air in the ear of the administration to
to get the answers to those questions
and then we can all move on safely
because the amount of data that's moving
between Europe and and estates is of
course massive and that's the that's
what underpins the prosperity on both
sides of the Atlantic so we need to get
on with that a final a final thought I
think really is that what what's driving
things at the information commissioner's
office at the moment is not just the
change of guard in fact the change of
guard is almost a peripheral because
you've got 400 people working away on
information rights both access to
information and enter data privacy and
the general data protection regulation
is absolutely the focus of our
activities that's what we're getting
ready for that's what we're gearing up
to it advise you about there's a whole
change program in the organization
designed to make sure that we can meet
our obligations under the under the
regulation to help you two to meet yours
and we have to work out how we fit in
with the European data protection board
and our colleagues in the article 29
working party and so on so that's really
the focus of event but at the end of
this month there is a change of guard
I'm really delighted that the
Commissioner for British Columbia
Elizabeth Denon has been identified as
the government's preferred candidate as
my successor I benefited hugely from
take
from Richard Thomas back in 2009 and
it's really great to see an experienced
a Privacy Commissioner like Elizabeth
denim being nominated she goes before a
parliamentary committee next week and
it's it's it's it's really really good
news at the ICO we've got a really good
team yes okay it was careless of me Lady
Bracknell was right I managed to lose to
Deputy Commissioner's but there's a
fantastic team still still in place that
will carry things forward absolutely
focused on the priorities that are of
great importance at this at this
difficult time and I know that Elizabeth
will be a great leader of the ICO and
we'll continue with the approach that
was developed by Richard Thomas carried
on by by myself to to to make sure that
the ICO is an effective partner in
delivering information rights in the UK
and an influential voice within within
Europe so that together we can find the
oil without the asbestos and hit the
stars without trashing the right of
citizens and consumers to get the
benefits of digital but also retain
their privacy their security and and
their respect so I wish you all the very
best of success in this very important
sector in which you work and ask you to
take back the message to your
organization that respecting information
rights is the sinner qua non for opening
up all the excitement's that the digital
world offers and if senior people in
organizations are not prepared to give
their time and attention to the rights
of consumers and citizens then they're
not going to end
oi the benefits and and the
opportunities and yes the profits of the
digital world thank you