Decision making structure

The Information Commissioner’s Office has a sponsoring department within government. This is the Department for Science, Innovation and Technology (DSIT). The nature of the relationship is set out in the ICO’s Management Agreement with its sponsoring department. The Management Agreement is available online and sets out how the priorities of the ICO and DSIT align, and the expectations for the Information Commissioner in terms of performance measures, engagement, staffing, financial controls and other related issues. 
 
The Management Agreement sets out that the Information Commissioner and the Secretary of State for DSIT share the aim that the ICO is, and continues to be, a world-class regulator working effectively across the UK, supporting the safe and trusted use of information and the protection of personal data. It also sets out a range of oversight mechanisms to ensure the ICO is run effectively, efficiently and in line with good practice. These include, but are not limited to, performance measures, engagement with the sponsor department, financial controls in line with Managing Public Money, spending and procurement controls, internal and external audit and the governance and accountability mechanisms in place. 

The Management Agreement also sets out the Information Commissioner’s responsibilities in relation to the role of Accounting Officer, as well as the responsibilities of the Management Board. During the current vacancy in the office of Commissioner, DSIT has designated Paul Arnold as Temporary Acting Accounting Officer for the ICO.

The Information Commissioner is held to account overall by the Parliamentary Select Committees, before which the Commissioner usually appears two to four times per year. During the current vacancy in the office of Commissioner, accountability to Parliament continues through those exercising Commissioner functions under the Scheme of Delegations, including Paul Arnold in relation to the Commissioner’s non-delegable responsibilities.

The ICO engages in various and regular reviews with Government and DSIT. The ICO also makes bids for funding (via DSIT) to Treasury spending reviews. 

The ICO publishes an annual report , reporting on our most impactful work over the previous year. The report also includes information on our accountability mechanisms and our financial performance. The report is audited by the Comptroller and Auditor General.  

The Information Rights Tribunal provides scrutiny and oversight of the Commissioner’s regulatory decision-making, including decisions taken by those exercising Commissioner functions under the Scheme of Delegations, application of powers, and progression of statutory work. All of these components are appealable to the tribunal in different ways. The effect of this arrangement is that should the Commissioner take inappropriate or unfair decisions, misapply their powers, or fail to progress complaints made about Data Protection or Freedom of Information matters there is direct judicial oversight and remedy of this. This can include requiring the Commissioner to deal with the matters or substituting the Commissioner’s decision in some circumstances with that of the tribunal. There are roughly 300 appeals made to this tribunal each year, and the ICO successfully defends its position in roughly 75% of those. The UK is the only Data Protection or Freedom of Information jurisdiction in the world that has its own dedicated tribunal chamber specialising in the subject matter of the authority. This is a strong accountability arrangement, which has been commented upon favourably in reviews of the UK's application of these laws including by The United Nations Special Rapporteur.

The Parliamentary and Health Service Ombudsman (PHSO) provides scrutiny and oversight of the service provided by the Commissioner, particularly its progression and handling of approximately 45,000 complaints the office deals with each year. 

For some of our more intrusive investigative powers we come under the inspection remit of the Investigative Powers Commissioner. They inspect us annually to ensure we are exercising these powers appropriately, including making the right judgments as to risk. 

As Accounting Officer, the Commissioner is directly accountable to the DSIT Permanent Secretary for financial stewardship of the ICO and is subject to a range of Government spending controls. During the current vacancy in the office of Commissioner, Paul Arnold has been designated Temporary Acting Accounting Officer by DSIT.

The funding model for the ICO is determined by legislation (agreed by Parliament) and the level of fees and charges that the ICO can levy is agreed by the Secretary of State for DSIT. 

The Commissioner has appointed a Senior Independent Director (SID), whose role leverages the collective contribution of the ICO’s Non-Executive Directors (NEDs) as part of the ICO’s unitary Board arrangements, facilitating their role in bringing effective support, scrutiny and challenge to the Executive whilst respecting the ultimate statutory authority and accountability held by the Information Commissioner as a Corporation Sole. The duties of the SID include conducting an annual appraisal for the Commissioner, serving as an intermediary for the other NEDs to support them in challenging and contributing effectively, providing support and guidance in the event of concerns about the performance of the Commissioner, building and maintaining a relationship with DSIT, and being the main point of contact for the succession process for the Commissioner’s role. During any vacancy in the office of Commissioner, these arrangements operate in line with the Scheme of Delegations and agreed governance arrangements.

There is an Audit and Risk Committee, which comprises two Non-Executive Directors and an independent member. The Commissioner normally attends these meetings as required, including attending when the Committee reviews the ICO’s annual report, prior to publication. During any vacancy in the office of Commissioner, attendance arrangements operate in line with the Scheme of Delegations and agreed governance arrangements. The Committee supports the Accounting Officer and Management Board in their role in respect of the effectiveness of the ICO’s risk management system and procedures and its internal controls, by reviewing the comprehensiveness and reliability of assurances on governance, risk management, the control environment and the integrity of financial statements and the annual report. These meetings are also attended by Internal Auditors, provided by a third-party firm, and External Auditors, provided by the NAO, to ensure that there is strong scrutiny of this role.

In addition to attending Audit and Risk Committee meetings, the externally appointed internal auditors conduct a full internal audit programme over a rolling annual programme. This programme is agreed annually by the Audit and Risk Committee.  

Management Board is also supported by the People Committee and Regulatory Committee, who provide independent assurance as to the mitigation of people and regulatory risks respectively and the delivery of relevant strategies.  

The Remuneration Advisory Sub-Committee provides challenge, advice and scrutiny on matters of Executive Team remuneration and development. This supports internal accountability by ensuring senior pay and reward matters are subject to appropriate Non-Executive oversight. During any vacancy in the office of Commissioner, related decision-making arrangements operate in line with the Scheme of Delegations and agreed governance arrangements.

The Management Board agrees the ICO’s key strategies. Progress in achieving the goals within each of these strategies is provided to the Board, alongside a Corporate Scorecard outlining performance. The Management Board also conducts a review of its effectiveness on a regular basis. 

The ICO has an approach of delegated decision making, which ensures that decisions are taken by ICO staff at the most appropriate level, in line with the mechanisms for consistency of approach across the ICO’s varied areas of work.

As set out earlier, the approach of collective decision-making principles used by Management Board is replicated throughout the ICO’s governance structure. Delegation of decision making also extends to the corporate governance structure, where decisions are taken by Management Board, Audit and Risk Committee, People Committee, Regulatory Committee, Executive Team, Senior Leadership Team (SLT) or SLT’s Boards, as appropriate. The Information Commissioner normally chairs the Management Board and Regulatory Committee; the other groups are chaired by either Non-Executive Directors or ICO staff. During any vacancy in the office of Commissioner, chairing and decision-making arrangements operate in line with the Scheme of Delegations and agreed governance arrangements.