Information commissioner Elizabeth Denham: How to be a pro-active regulator

The UK's information commissioner, Elizabeth Denham, is stepping down from her role after five years

Elizabeth Denham has done far more than most to rein in big tech. But she is alarmed at the mismatch in power between democracies and Silicon Valley - and efforts to politicise the regulator she leaves.

For the past five years, stories about the harms caused by social media giants have followed a wearisome and familiar pattern.

First, scandal erupts. Next, the cry goes up: Something Must Be Done! (See also: Up With This We Will Not Put!)

Then, reflecting headlines and noise on (ironically) social media, a meeting is convened, for which ambassadors of the tech giants are summoned.

Finally… not much happens.

This pattern has been seen over and over and over again.

And the common theme in these stories is how some big societal harm often falls between regulators, with Ofcom, the Advertising Standards Authority, and the Competition and Markets Authority, all sticking understandably to their remits.

Elizabeth Denham, the information commissioner who steps down next month, has been something of an antidote to this pattern.

Pro-active and increasingly vocal in her concerns about the mismatch between regulators and the Silicon Valley giants, she used her exit interview to reflect on this alarming gap, resist the politicisation of her office and chronicle a very busy five years.

Busy, busy, busy

Since it is technical, complicated, and often extremely boring to those not involved, the work of regulators is largely unknown to most people, who nevertheless depend on them.

Indeed, many staff at regulators feel as though their work amounts to mere quotidian drudgery.

But if the ICO is different it is because, in regulating personal data, it is now regulating the most commercially valuable commodity in the history of our species.

Moreover, the power of the global data giants is growing exponentially, whereas - as I have often written on this blog - regulation is slow, consensual and national.

Ms Denham leaves a substantial legacy.

One of her early interventions was in reforming the personal data that charities could keep. She argued that donors need to be able to trust that their data will not be spread around between bodies in the third sector.

There had been reports that some charities were targeting vulnerable donors, including the elderly. Ms Denham introduced major reforms that now keep a much tighter leash on the information stored by charities.

She oversaw the introduction of the General Data Protection Regulation, GDPR, and the communication to businesses who had to adapt to it.

She helped the UK to achieve something called data adequacy, which means, as she put it, "the EU has said the UK is a safe and trusted environment for citizens' data". After Brexit, this has been critical for British businesses.

In the wake of Sarah Everard's murder, a lot of attention has been devoted to police behaviour. Ms Denham considers one of the most radical achievements of her tenure to be her work on mobile phone extraction by police forces.

Victims of sexual assault had been required to hand over huge amounts of personal data to be uploaded from their phones and given to police and prosecutors, creating - as Ms Denham puts it - a "chill on women and men reporting sexual assault". The law is being changed so that the police first need to be clear about their lines of inquiry.

One of her biggest legacies is the Children's Code. After extensive effort by campaigners, including by Baroness Beeban Kidron, a code has been introduced in Britain to require safety features to be designed into online games, apps and social media sites likely to be accessed by children. The settings for children's data now need to be set high by default.

But inevitably, it is her broader work on the Silicon Valley giants that has most defined her tenure.

Fight of their lives

Critics of social media often tend also to be critics of the attempts by regulators to mitigate their worst effects. It is true that regulation has often been weirdly slow. Here, Ms Denham is frank about how much more she would like to have done.

"Regulation is hard," she says. Ultimately, the sheer scale of the companies that regulators are confronting often overwhelms those with a licence to punish them.

"The other thing that I've learned in this job is that big tech not only has lobbying power but it also has really deep pockets," she says. "So when it comes to litigating, these companies are definitely willing to litigate against public authorities like my office. [Their] deep pockets means that there is an inequity of arms when we are tackling these."

Ms Denham's investigation into Cambridge Analytica led to her imposing the maximum possible fine on Facebook at the time - £500,000, which she describes as "measly".

Under her tenure, the ICO has doubled in size, from 400 to 800 people. And some of the other major areas that Ms Denham wanted to work on were delayed by the pandemic.

In particular, the ICO has simply not been able to get stuck into the hugely contentious arena of the digital advertising industry, or adtech, and what is known as real-time bidding.

This is the basis of how much of the internet works and, according to critics, constitutes the biggest data breach in history - except one that we almost all willingly sign up for each time we use a search engine.

Every time you enter a search on, say, Google, there is an instantaneous, algorithm-driven auction for your attention, in which a huge number of companies bid. Your data is sprayed to these companies, usually without much thought given to them by the user.

When I challenge Denham over the ICO's work in this arena, she accepts there is a lot more to do, and cites Covid-19.

"My office works on the basis of the highest risk of harm," she says. "And we undertook the investigation into real-time bidding and adtech. We wrote a report that set out our expectations of companies in the way that they operate real-time bidding. We gave companies six months to comply with our findings in the report but we had to pause the work because of the pandemic. And the ICO doesn't have unlimited resources as a regulator.

"During the pandemic we have been running a field hospital for advice and guidance for everything from proximity to vaccine certificates, to the test-and-trace programme. So many of my team I needed to move into looking at the pandemic and how data was being used in public-health surveillance. That was the immediate pressure on the office.

"That said, I've undertaken five audits of the big firms. [We've] almost finished those audits and as a result of what we find, we will decide if there is enforcement action."

Investigating what happens to your data in real-time bidding will be a major story in the tenure of Ms Denham's successor, John Edwards. He is currently data commissioner for New Zealand.

Major lessons

There are several major lessons from the past five years. The need to plough on despite public criticism is one - reforms to the use of data in the charity sector, now widely accepted, met with vociferous opposition.

The importance of linking up regulators has become clear. Ms Denham helped bring together the ICO, Ofcom and the Competition and Markets Authority on key issues.

The independence of regulators is vital. In an unusually frank assertion of sovereignty for a public official, Ms Denham says that proposed changes to how the ICO is mandated could make it a political tool. She says she might not have been able to conduct her investigation into Cambridge Analytica if she had had to take "marching orders" from government.

Above all, the exponentially growing mismatch between the tools available to democracies and the sheer might of technology giants is one of the great challenges of our time. (Azeem Azhar's excellent book Exponential offers some solutions.)

All the most effective solutions will have to be global. This is why the idea of new international bodies to manage technology - a digital Bretton Woods, perhaps - is gathering momentum.

When I asked Denham, who plans to return to her native Canada, whether she would be willing to run such an organisation were it founded, she smiled. A portfolio career beckons. Hardly a household name in Britain, her influence here will endure.