Compensation claims: a new role for the ICO?

On 19 July 2022, the Information Commissioner's Office (ICO) held its Data Protection Practitioners' Conference 2022.

In a panel session titled "Ask the ICO", John Edwards was asked what the biggest differences were between his current role as the UK Information Commissioner and his previous role as New Zealand's Privacy Commissioner. One aspect of Mr Edwards's response will be of significant interest to data controllers besieged by claims for compensation from data subjects.

Mr Edwards explained that, in New Zealand, individuals can raise privacy violation complaints and allegations of harm to the Privacy Commissioner. In turn, the Privacy Commissioner can investigate the validity of those complaints and facilitate settlement (between the individual and the company allegedly in breach).

Mr Edwards noted that there was "scope for [the ICO] to emulate that [in the UK]", and that the ICO would adopt a "dispute resolution mindset", where it is possible and reasonable to do so. This would be across the ICO's various jurisdictions.

Osborne Clarke comment

This would be a new role for the ICO. It was not clear from Mr Edwards's brief remarks as to how the ICO envisages this role being carried out.

This role would be only be a welcome one for data controllers if the ICO were to exercise it in a way which dissuaded data subjects from bringing speculative and weak compensation claims. However, we suspect the practical reality would be yet more burden and cost for data controllers, even when dealing with spurious claims, as claimant law firms will doubtless look to play the controller off against the ICO. Claimants may also use the process for multiple "bites of the cherry", reserving their rights to issue proceedings if they do not get the result they want.