1. Do you agree with our approach to how we exercise our regulatory responsibilities in the RAP? Please explain your answer.
Open Rights Group partially disagrees with the approach the ICO envisions in their Regulatory Action Policy: while we appreciate improvement and changes going in the right direction, we are still concerned that the ICO didn’t take full stock of their failures to enforce the law in the past. As a result, the envisioned approach could still be gamed by bad-faith actors.
In turn, we explain what the changes that we believe are going in the right direction (1.1. What we liked), we then analyse problems that persist in this approach (1.2 Our concerns). Finally, we provide some examples to substantiate our position (1.3. Lessons from the past).
1.1. What we liked
We are glad to see that the ICO widened the scope and depth of their review of the Regulatory Action Policy. We also praise the stronger focus the new RAP places on dissuading bad-faith actors throughout the ICO regulatory processes. In particular, we support the decision to spell out “aggravating factors” to guide the ICO enforcement action holistically — as opposed to the existing RAP, that identifies aggravating factors for the specific purpose of “select[ing] the appropriate regulatory activity” —, as well as the inclusion of these particular aggravating factors:
the attitude and conduct of the person or organisation concerned suggests an intentional, wilful or negligent approach to compliance or an unlawful business or operating model;the person or