UK ICO clarifies its auditing powers

TODAY THE UK'S Information Commissioners Office (ICO) cracked its knuckles and told the country's data controllers just what they can expect when its men in black come knocking, subject of course to parliamentary consultation (PDF) and approval.

The ICO has a reputation for shuffling along, and although the launch of these proposals promises much they could be watered down. In the meantime, picture it holding a truncheon in a velvet glove and writing a memo.

"The ICO will take a proportionate and risk-based approach to auditing, based on a range of intelligence including complaints received, business and media reports and annual statements issued by the organisation. The auditing process allows the ICO to assess whether organisations are processing personal information in line with the Data Protection Act (DPA) and to advise on best practice. The ICO will continue to request consent for an audit to be carried out where it is identified that personal information may be at risk," it said in launching the consultation.

While this all sounds fine, should consent not be given then the velvet glove may come off. The ICO said that if a firm refuses it access, it will demand it. Initially this extra power will only apply to government departments. So, by the time the government mandarins work out how to get 'round the requirements, private firms should find themselves under the same limp scrutiny.

This is not to say that the ICO does not go after hard targets. Also today it chastised the Alzheimer's Society for losing staff details on a laptop computer. The jokes may write themselves, but when burglars broke into its offices, found some laptops unsecured and stole them, the names, addresses, national insurance numbers and salary details of staff went with them.

The Alzheimer's society, a charity, has confirmed that it will take care to abide by the ICO's rules from now on.

What were they again? µ