ICO25 is our new strategic plan setting out our objectives, purpose and performance measures. We developed the draft plan based on our informed understanding of stakeholder and customer views as well as insights resulting from a ‘listening tour’, conducted in advance of drafting the plan.
Once we had a working draft plan, we issued a public ‘call for views’ consultation to welcome views from customers and stakeholders. This sets out a summary of the responses we received and the changes we made as a result.
Consultation period
The consultation on the ICO25 plan was launched on 14 July 2022 and ran until 22 September 2022. Respondents were encouraged to use a dedicated online form but could also respond by email or post. Respondents were invited to share any views on the plan, we specifically encouraged comments about our purpose, objectives and performance measures.
Summary of survey responses
There were 52 responses to the survey. The clear majority of respondents agreed with our articulated purpose, with our strategic enduring objectives, and with our proposed performance measures.
The responses to the survey came from a relatively even spread of our main stakeholders, with 25% from public authorities, 23% from private sector businesses, 21% from individuals commenting in a private capacity and 19% from the third sector.
The majority of respondents from each sector also agreed with or strongly agreed with our purpose, objectives, and performance measures. Six of the 12 businesses that gave their views strongly agreed with our stated purpose. A large publishing business said: “Great to see. It is clear and well laid out. If this is the direction of travel, it is welcome news.”
There was no equivalent call for views to accompany the launch of the Information Rights Strategic Plan (our previous corporate plan) with which we might benchmark an expected response rate. As such, there were no fixed expectations about how many responses we would receive to this survey.
We heard however, that many of our stakeholders felt they had already shared their comments through the initial listening tour led by John Edwards, the Information Commissioner. The listening tour was an opportunity for John to hear views from a wide range of stakeholders across all four nations. It is worth nothing that the informal feedback was extremely positive, with those that took part in the listening tour feeling they have been heard. For example, an industry body reported their members, ‘felt they had been listened and particularly liked the idea of regulatory certainty as they felt this would provide them with more opportunities to innovate and navigate risks’.
It is reasonable to infer from the responses that there is general agreement with the ICO25 plan. We also recognise that the number of survey respondents is a relatively small sample of our stakeholders and customers but combined with our ongoing engagement across sectors, government and customers, we are satisfied it is a fair representation of the feedback we regularly receive. We considered all of the feedback and reflected on how we could make improvements. As a result, we did make some changes, in particular to the plan’s performance measurement section. The other changes were less substantial but took account of the feedback we received.
Our purpose – survey results
We asked respondents to what extent they agreed or disagreed with our purpose, as articulated in ICO25.
39 of 52 respondents (75%) either agreed or strongly agreed with our purpose. No one suggested an alternate purpose, but some did share their views as outlined below. The total results were:
- Strongly agree: 10
- Agree: 29
- Neutral: 5
- Disagree: 6
- Strongly disagree: 2
We received positive feedback from businesses, public authorities, third sector bodies and individuals on our purpose. One comment described it as “well balanced”, another that it “made sense”, and a third that they agreed with the stated purpose, and that it reflected their own approach as a third sector body.
Commenters made supportive reference to the commitment to openness and transparency, to the benefits of highlighting good practice, and to the commitment to clear and relevant guidance from a regulator that engages with those it regulates.
Where concern was raised was in the suggested tension between our role as a protector of individual rights against our role supporting the needs of business and economic growth.
Seven comments made specific reference to this, with the essence of those comments being that ICO25 leans too far towards making things easier for business.
Two individuals commenting in a private capacity, and one public authority, referred to the term ‘empower’, and suggested we may wish to replace or supplement it with language that sounded tougher, making clear that we have enforcement powers we can use should we need to.
Our response and what changes did we make
We took from the responses that overall there was a good level of agreement with our purpose. However, we do recognise the perception of tension between our role protecting individuals and our role supporting the needs of businesses. We firmly believe we should, and can, do both but also that they are complementary to each other, rather than being in conflict. We made some changes to our language, to make sure this point is clear. Making information rights simple, practical and easy to understand benefits both individuals and businesses. It leads to better, more consistent practice by businesses, increasing trust and confidence in what they do which in turn empowers their customers and users. An increased, more informed customer base powers economic growth.
Our enforcement and investigative powers are used where we find real harm, bad practice or criminal actions. We will take proportionate action in response to instances of real harm, where we can make a difference to people’s lives.
Strategic enduring objectives – survey results
We asked respondents to what extent they agreed or disagreed with the four strategic enduring objectives set out in ICO25.
40 of 52 respondents (77%) agreed or strongly agreed with these objectives. The total results were:
- Strongly agree: 9
- Agree: 31
- Neutral: 6
- Disagree: 3
- Strongly disagree: 3
We received a positive body of comments to this question, suggesting that the draft objectives are those our respondents would expect us to have.
Three businesses and one public authority made direct positive reference to the objective to empower responsible innovation and economic growth.
Two comments supported the openness and transparency agenda, and two welcomed the objective to safeguard and empower particularly the most vulnerable.
Two public authorities expressed their support for the revised approach to public sector fines and enforcement.
A significant proportion of comments, all from organisations, reinforced the message that engagement with the ICO was important to them. It was raised specifically by a large businesses, a third sector body and a number of public authorities.
As above, the only concerns raised regarding our proposed objectives were in relation to the perceived incompatibility of defending individual rights and supporting economic growth. Comments suggested that economic growth should not be our concern, or that we need to say more about the apparent conflict.
There were three comments that made specific suggestions for change to our objectives: A third-sector body proposed using explicit reference to specific types of incidents where we would use enforcement powers to address; a public authority asked if our commitment to provide timely responses would have the effect of placing unfair pressure on public authorities that did not have the same resources as the ICO; and a member of the public suggested that ICO25 was missing language to recognise the historical failures in the lack of diversity and frame the narrative on why inclusion is so important.
Our response and what changes did we make
Our commitment to economic growth is a statutory responsibility as described in the Deregulation Act 2015. However, we also believe that empowering businesses to handle information properly and provide transparent, timely, and innovative services to their customers is beneficial to individuals as well as to the businesses and the wider economy.
We know that all public authorities have finite resources, in the same way that we do. We reflected on all our commitments to be timely and whether we were indicating an unreasonably high bar for regulated entities. Our targets are challenging, but reflective of our role as information rights regulator and the importance we place on cornerstone rights and delivering the best service we can for our customers. We know our targets might not be appropriate in every organisation. Our regulatory approach will be predictable and proportionate and we will focus on areas of most risk and harm. As we have done before, we will continue to work with public authorities to help them improve the way they do things and, as we have committed to elsewhere in the plan, we will maximise the tools and guidance we make available, sharing our expertise at every step.
Performance measures – survey results
We asked respondents to what extent they agreed or disagreed with how our performance will be measured.
35 of 52 respondents (67%) agreed or strongly agreed with our proposed performance measures. The total results were:
- Strongly agree: 4
- Agree: 31
- Neutral: 9
- Disagree: 3
- Strongly disagree: 5
Our proposed performance measures received less support than our purpose and our strategic enduring objectives, but the majority of comments were still supportive. Three commenters described the measures as ambitious, with others commenting that the ICO would need effective resourcing if we were to meet them.
Three welcomed the commitment to publish things such as our training materials and recommendations made in our complaint handling work, as well as measures for our performances against complaint handling. Initiatives like the guidance pipeline and iAdvice were also considered positive.
Four comments touched on the lack of clarity on our current performance which made it difficult to judge the extent to which the proposed measures were achievable. Two comments made reference to wanting more effort to improve the consistency of advice given by ICO staff. This echoed a theme raised in the listening series survey.
Four comments suggested that six months to complete complaints was lengthy. Two small businesses suggested that the measures were not challenging enough, and that the timelines targets should be closer to the timelines we place on organisations with less resource than ourselves.
Our response and what changes did we make
We received positive feedback to our commitment to be clear and transparent about our progress towards achieving our objectives. As a result, we have further developed our performance measures in the plan to show both the performance needed to effectively and efficiently deliver our objectives, as well as the sentiment and outcomes measures that will demonstrate whether we have had the desired impact and influence through our work for the benefit of our stakeholders.
For each of our objectives, we have included our ambition, and how we will measure progress. For our last objective, which is about continuously developing the ICO’s culture, capacity and capability, we have developed five ‘shifts of approach’ that show the changes we will need to make to deliver our objectives. For each of these shifts, we have included measures which will allow us to demonstrate that, over the life of ICO25, we have made these changes. We have reviewed all our measures to ensure they are challenging enough and have, where needed, made changes, in particular to the performance measures. We have also clarified language where needed and ensured that the plan now represents a full range of measures to demonstrate our progress towards achieving our objectives.