ICO softens stance on GDPR enforcement due to coronavirus crisis


The UK data regulator says it will relax its regulatory approach to enforcement during the coronavirus crisis, in line with its commitment to be “pragmatic” and “proportionate”.

The ICO will take into account the strain on frontline services, including government and health services, as well as organizations that are under staff shortages and financial pressures to implement data protection laws. A newly published document states that the law allows the body to be flexible in how it performs its regulatory role.

“We see the organizations facing staff and capacity constraints,” said Elizabeth Denham, information commissioner, in a statement. “We see that the public institutions are under a lot of pressure at the front. And we see the many companies that are facing acute financial pressure.

“Against this background, it is right that we have to adapt our regulatory approach.”

This flexibility enables the regulator to “recognize the unique challenges facing the country and engage with them,” says the document. “For example, privacy laws contain checks and balances to ensure that personal data flows and can be used effectively for healthcare.”

This part of the document seems to echo Health Secretary Matt Hancock’s statement about GDPR on Twitter, in which he wrote, “GDPR does not inhibit the use of data in coronavirus response. The GDPR has a clause that excludes work in the overwhelming public interest. Due to data protection laws, nobody should limit the response to coronaviruses. “

He added: “We must all give up some of our freedoms; The rights of the GDPR have always been weighed against other public interests. “

The ICO document also refers to the use of personal data of British citizens in the response to the coronavirus crisis and says: “There are reasonable and adequate safeguards for personal data of persons, which for example also allow an acknowledgment of the public interest when used of apps, research projects and digital tools based on large amounts of personal data. ”

No specific cases were mentioned where personal information could be used in this way, but Hancock has already given NHS agencies the ability to share confidential patient data with any organization while it is in the fight against the coronavirus.

Regarding the handling of public complaints about the misuse of data, the ICO stated that it “will continue to recognize the rights and safeguards afforded to people by law in relation to both their personal information and their right to freedom of information will “but will focus your efforts on” the greatest challenges and threats to the public “.

It states: “We will proceed flexibly and take into account the effects of the potential economic or resource stress that our actions could have on organizations.” This could mean that people with a problem are “advised to wait longer than usual and come to terms with organizations”.

The body says “expect[s] conduct fewer investigations and focus our attention on the circumstances that indicate serious violations. “It will, however,” take a strong regulatory approach against organizations that violate data protection laws to exploit the current crisis. “

“As stated in the regulatory policy, we consider economic impact and affordability before imposing any fines. In the current circumstances, this likely means that the amount of the fines will decrease. “

Regarding the Freedom of Information Act and the Environmental Information Regulation, the regulator said: “We will approach our role in regulating access to information regulation in a sensitive and pragmatic manner, recognizing the importance of transparency, especially where citizens have compromised their civil liberties.

“We recognize that reducing the resources of organizations could affect their ability to comply with freedom of information aspects such as: B. how quickly FOI requests are processed. However, we expect that appropriate measures will still be taken to capture decisions so that information is available at the end of the emergency. “

“We have to reflect on these extraordinary times,” said Denham. “We will continue to recognize the continued importance of privacy protection and the value of transparency through freedom of information. These rights are a part of modern life that we must not lose. However, my office will continue to protect information rights in empathic and pragmatic ways that reflect the effects of the coronavirus. “