The ICO’s School for Scandal

Do they send Information Commissioners to a special school to learn how to make dramatic claims? New-in-post Chris Graham was at it last week during the Eighth Annual Data Protection Compliance conference in London, one of his first public engagements.

According to Graham, “we’re going to have the resources to go after the bad boys – there’s a well-funded regulator that will hit you hard if you get it wrong. If you don’t take this stuff seriously, it’s going to bite you in the bum.”

That’s all good, knockabout stuff and exactly what the ICO is there for. Data Strategy long advocated stronger enforcement powers and believes the regulator should be more feared than has been the case.

One of the best weapons against carelessness with data will be “naming and shaming”. Fear of a very public exposure of data losses, security breaches or other violations should stop anybody in their tracks next time they plan to load their customer database onto an unencrypted laptop. As Graham told delegates, “If you breach the law, you’re going to be in trouble. It isn’t a nice to have – it’s the law of the land. You will destroy brand value and reputation.”

But here’s the rub. Delegates at the PDP Conference had paid to listen to the Information Commissioner and other experts. They clearly intend to get it right when it comes to data protection, otherwise why spend the time and money going?

So threatening them is like raising a toast to an alcoholic who has just started a 12-step recovery programme. You understand the sentiment, but the action is wrong. What Graham needs to focus on is getting the same message across where the “bad boys” might hear it.

That does not mean an audience of compliance managers, but of MDs, marketing directors or any business manager who still believes that data protection laws do not really matter. The sort of boardroom conversation that arbitrages the risk of discovery and potential fine against the potential revenue to be gained by doing something illegal needs to become a thing of the past.

Back when Elizabeth France was the Information Commissioner, her first speech to an audience of direct marketers was just as dramatic. Whipping out a pair of handcuffs, she told delegates she’d like to clap them all in irons. It was a strong message delivered to the wrong people.

The DM industry has turned out to be a shining example of best practice in data management. As Graham finds his own way into the job, it will be important to recognise allies and suppporters from enemies and genuine targets.