The Information Commissioner’s Office (ICO) has said it wants to take a flexible approach and fast track advice for organisations in dealing with the coronavirus crisis.
It has adopted the position in a document setting out what public and private sector bodies should expect it to do in the coming months.
The regulator said it has a responsibility to take the exceptional circumstances into account and that the law gives it scope to be pragmatic and empathetic, with a promise that its efforts will be focused on the greatest threats.
Information Commissioner Elizabeth Denham (pictured) said: “Regulators apply their authority within the larger social and economic situation.
“We see the organisations facing staff and capacity shortages. We see the public bodies facing severe frontline pressures, and we see the many businesses facing acute financial pressures.
“Against this backdrop, it is right that we must adjust our regulatory approach.”
She added that UK data protection law is not an obstacle to flexibility and is underpinned by a principle that the processing of personal data should be for the public good. This means that, while the ICO will continue to recognise the importance of privacy protections, it will do so in a way that reflects the impact of coronavirus.
Public emergency factor
Among the points made in the document are that organisations should continue to report data breaches and it will take a strong line against any breach data protection laws to take advantage of the circumstances. But it will also take the public emergency into account in conducting investigations and try to understand the individual challenges facing organisations.
In the meantime, it is suspending its audit work and all regulatory action work connected with outstanding information requests.
The ICO has also recognised that organisations may struggle to handle subject access requests for the data they hold on individuals due to their resources being stretched by the crisis.
It also promises a pragmatic approach to regulation around the Freedom of Information Act, again recognising the extra pressure on organisations and saying they may have to reduce or suspend parts of what they do to give the public access to information.
The document concludes: “With the correct application of flexibility in regulatory response, we do not consider that any of the legislation we oversee should prevent organisations taking the steps they need to in order to keep the public safe and supported during the present public health emergency.
“There is plenty of flexibility built into the legislation for organisations to use in such times, including some specific public health related exemptions.”
