[Music]
and I think intensive is a very good
word to describe this event because the
expectation and the scrutiny on all of
us to step up and make change is intense
it's clear the data protection is
essential for our democracy and that's
why last spring my office launched
comprehensive inquiry into the use of
data protection in political campaigns
the Cambridge analytic Facebook
allegations is only one line of inquiry
in our broader investigation but of
course that line of inquiry was
heightened in February when
whistleblowers came forward with their
stories in all in our inquiry we're
looking at 30 organizations social media
platforms data companies political
campaigns political parties to pull back
the curtain and to be able to understand
how the use of personal data takes place
in modern political campaigns so our
report is going to describe the
realities of the data driven campaign
are the rules clear how is personal data
use enabling the micro targeting of
adverts and campaigns what public policy
changes can we recommend one thing I
will say is that I've never been
involved in an
investigation that is playing out so
publicly with witnesses giving evidence
on YouTube with witnesses coming forward
to Congress coming forward to Parliament
and so many details published online
speculation is rife but our
investigation will be thorough
it'll be independent it'll be focused
and we will make our findings and our
conclusions public if we find that the
law has been breached we will take the
necessary enforcement action but as I've
mentioned this investigation is ongoing
this investigation is live and it
wouldn't be appropriate for me to give
you a running commentary but I do want
to use this case to comment on our
powers and also on the unique nature of
data protection regulation has a
regulator we need to investigate systems
in six you to see how personal data are
actually being used and being managed
the unique nature of modern data
protection regulation is that our role
means understanding the effect that
algorithms and analytics has on
decision-making we have to look at the
interrelatedness of data and the effect
that they have on decisions and we also
may have to look at these effects in
very short time periods and in the
context of a fast-moving investigation
so under the gdpr I will have the power
to audit all of those who hold and use
and share personal data so in other
words
soon I'll be able to look behind the
curtain and see what those who hold our
personal data are doing with it but in
the context of this investigation the
GDP our audit power is already being
outpaced by technological advances in
data analytics and I need I want to see
that addressed I'm in intense discussion
with government to ensure that as part
of the data protection bill the ICO has
the ability to move more quickly to
obtain the information that we need to
carry out our investigations in the
public interest of course we need to
respect the rights of companies but we
also need streamlined warrant processes
with a lower threshold than we currently
have in the law we need the regime to
reflect the reality that data crimes are
real crimes and as society moves
increasingly online data protection law
needs to have the comprehensive reach
that people would expect of laws in the
physical world I wanted to tell you this
morning about how I'm reshaping my
organization so that we can be the
relevant and the future focused
regulator that all of you expect us to
be DP Day is only 27 working days away
by my calculation but the 25th of May
will merely mark the end of the
beginning of a very long journey for
data prefer the data protection
immunity as the regulator of the GDP are
we support we educate we consult we
audit and we enforce and from my seat
where I sit we're expecting more of
everything
more breach reports because the law
requires it in certain high-risk
situations more complaints because
people are becoming more aware of their
data protection rights and greater
engagement with all of you as you turn
to us for advice at the outset of your
projects and submit your dpi A's to us
I'm leading an ICO that's made up of
incredibly committed people who are
equipped to meet the challenges and the
opportunities that lie ahead for us
they've all given their consent for
their photograph to be shared with you
they really have so what am i doing I'm
strengthening my team in both numbers
and in expertise we'll be ready to
deliver on our responsibilities and
obligations to organizations but also
more importantly to the public the ICO s
future funding model has also been
agreed by Parliament taking our current
budget of twenty four million pounds a
year to 38 million in 2018 2019 we're
recruiting at all levels of the
organization for our offices in
Edinburgh and Cardiff Belfast Wilmslow
and London I hope I didn't miss anyone
out to give us the capacity and the
capability and the resilience to be able
to tackle our growing regulatory brief
we have a current headcount of about
five hundred and twenty and we
expect our numbers to increase to 700 by
2020 and to give you a sense we have
right now 200 caseworkers that are
taking in the complaints from the public
we have a 60 strong enforcement group
that are taking forward investigations
and we have a similar number that are
charged with policy and guidance and
assistance to the community the ICO has
provided a whole suite of resources on
our website including the guide to the
gdpr which has been accessed 2.5 million
times we have interactive checklists we
have industry specific fa Q's we have a
special SME helpline which gets 2,500
calls a week and we're going to be
assessing our demand for our services as
the gdpr goes live and beyond and adjust
accordingly and I think all of you in
the in the room are in the same place as
I am there's nothing like taking
advantage of a comprehensive change in
the law to develop and to grow and in a
sense to reinvent ourselves so over the
past 18 months the ICO has undergone a
phenomenal internal change program we
know that we need to be the tech savvy
relevant regulator which is why I've
recently published the ICO s
first technology strategy we've
identified three areas of focus cyber
security artificial intelligence and
device tracking and those three areas
will inform our guidance our proactive
work our audits and our advisory
services
and taking proactivity further we want
to recognize that innovation is
absolutely essential in this space we're
working to establish a regulatory
sandbox for you to beta test your new
initiatives so that we can support
innovative new project new products
digital products and services whilst
ensuring that the right safeguards are
in place we intend to focus our sandbox
on AI applications and will launch this
new program in 2019 after we finish the
consultation that will take place this
year and I I hope that you'll engage
with us fully with our consultation and
bring the benefit of your industry
experience to the IC o----
so our technology strategy is based on
the strong belief that privacy and
innovation go hand-in-hand it also
allows us to build our own technical
skills recruiting and retaining
technology expertise and establishing
partnerships on tech issues with outside
experts with other regulators and
certainly with international networks
we've launched an active secondo
which so far has brought in an influx of
new talent into the office in the form
of legal staff and auditors forensic
digital forensic expertise and
international liaison experts and our
seconded program is over it is
open-ended so will we'd be delighted to
hear from you if you believe your skills
and experience would complement the IC
o---- digital regulation has become the
spy
or the backbone that runs through our
entire organization we're also taking
this opportunity to relaunch our
regulatory action policy which sets out
the pragmatic and the policy approach
that we're going to take in discharging
our duty as the UK's data protection
regulator and there'll be more detail on
our regulatory action policy from our
Deputy Commissioner James Dibble
Johnston tomorrow I've spent a lot of
time busting myths in this area and I
think particularly misinformation that
massive fines are going to be the ico
default position after the 25th of May I
have no intention of changing our
proportionate and pragmatic approach
after the 25th of May the aim of our
office is to prevent harm and we place
support and compliance at the heart of
our regulatory action voluntary
compliance is still the preferred route
but we will back that up with tough
action where it's necessary hefty fines
can and will be levied on those are
organizations that persistently that
deliberately and negligently flout the
law report to us engage with us show us
your effective accountability measures
and if you do that's going to be a
really important factor when we consider
any regulatory action and now we have a
whole new set of tools for compliance
privacy by default design
to protection officers accountability
mechanisms all of these things and more
form an integrated package and when we
do apply a sanction fines will not
always be the most appropriate or the
most effective choice compulsory data
protection audits reprimands warnings
enforcement notices and stop processing
orders are often going to be the most
appropriate tools and none of those
tools involves writing a check to the
Treasury but they will have a
significant impact on a company's body
and thought them line another of the
myths that I've worked really hard to
dispel is around data breach reporting
under the gdpr
and I know we've said it many times but
it's worth repeating that you will not
need to report all personal data
breaches to the ICO please don't but
where you do need to report we've tried
to make the reporting process simple and
effective and part of our change
management program has included
researching the best ways to manage the
new volumes of work created by the GDP
ours reporting regime and so looking
across the continent has really helped
us plan in an informed way we
extrapolated from the work of our Dutch
colleagues and we plan to put in place a
breach reporting service that can handle
30,000 reports a year so quite a
challenge to resource so we've built a
telephone based reporting service that
ensures fast direct entry to the ICO
but if you call our breach reporting
line you will get a human response and
our focus will be on identifying whether
your breach is a reportable one working
with you bringing in whoever we need to
be able to help you with your response
in those first very critical few days
we've built a dedicated team around
breach reporting and we'll be extending
the hours of our office to manage
reporting under both the gdpr but also
the MS directive when I accepted the
role of information commissioner of the
UK I expected challenged enough to bring
in the new data protection laws and
representing the ICO at the article 29
working party as it morphs into the
European Data Protection Board what I
hadn't anticipated was the result of the
referendum on June 23rd 2016 and the
referendum results impact on our legal
and policy relationship with Europe has
occupied much of the time that I have
been commissioner as commissioner one of
the most important jobs that I do is the
independently advised government and
Parliament on law reform that ensures
high standards of data protection for UK
citizens and consumers no matter where
their data is processed uninterrupted
data flows to Europe and the rest of the
world and legal certainty for business
and law enforcement government has
explicitly said that it values data
protection as fundamental to the digital
economy
and security cooperation data protection
is a priority area for the brexit
settlement right now and these are the
questions I get all the time are you
still sitting on article 29 right now
the ICO is playing a full role in EU
institutions article 29 Europol euro
just and we're fully immersed in
creating guidance for the GDP are the
ICO is also preparing for the post
brexit environment in order to ensure
that the information rights of UK
citizens are not adversely affected
unfortunately the most significant
unknown from my point of view is the
exact nature of the relationship that we
will have with our DPA colleagues across
Europe during two recent speeches the
Prime Minister has made the case for an
ongoing role for the ICO whether that's
a seat at the table of the European Data
Protection Board with voting rights or
some other form of relationship that is
acceptable to the UK and the EU the ICO
is deeply embedded and committed to the
EU regulatory community and that's the
message that I've been giving to
parliamentarians when I give evidence to
committees looking at the implications
of brexit so the government has thus
thus far made good on its commitments to
fully implement the gdpr and it clearly
accepts the importance of high standards
of data protection I think the
government should be commended for their
commitment and their effort in this
river
and through our expert advice to the
government and through our strong
engagement with the article 29 working
party we are striving to ensure that the
priorities that I identified become a
reality that's heavy
so further to our focus at this
conference let's step back for a moment
and remember why we're all doing this
it's about people and it's about
increasing the public's trust in
confidence in the way that their data is
handled and this is a very high priority
for me it's a very high priority for our
office and I know it is for you too I
think that the recent revelations in the
media have fired up the data protection
debate and so they should I think across
the world people are beginning to wake
up to the importance of personal data
and it's up to us it's up to us as
regulator and those that are striving to
comply with the law to keep that fire
burning I think that might be Burning
Man I don't know what that is if we if
we fearlessly
and tirelessly apply the principles that
the ICO and the ia pp hold dear then we
can build the public's trust and
confidence because their data matters
there has never been a better time to be
in data protection thank you
[Applause]
[Music]