The Information Commissioner’s Office has an enviable reputation for high standards among regulators. Its judgments are well considered and the fines it issues are generally proportionate.
This week, though, the ICO has been found seriously wanting.
On Tuesday, the Daily Mail – not the regulator itself – revealed that the RSPCA and the British Heart Foundation were to be fined £25,000 and £18,000 respectively for contraventions of the Data Protection Act.
Rumours of large fines had been circulating for weeks, but given the regulator’s reputation for diligence, no one expected they would be revealed first in the pages of the Mail.
What proceeded as a result of the regulator’s inability to manage the release of information – an irony that has not been lost on some – could be best described as a chaotic mess.
With media outlets and the fundraising community swarming, the ICO was forced to hastily put out a statement confirming the fines and the reasoning behind them. Its choice of language in its statement was precisely that: choice.
Instead of adopting the rather drab and legalistic tone favoured by regulators such as the Charity Commission, the ICO chose to spice things up and accused the RSPCA and the BHF of "exploiting supporters" and said they had "secretly screened millions of their donors so they could target them for more money".
The Institute of Fundraising and others in the fundraising community immediately took issue with the ICO’s statement and the lack of supporting documentation. Daniel Fluskey, head of policy and research at the IoF, took to Twitter to accuse the regulator of "political point-scoring", saying that it was a "value-judgement" to say that charities had been exploiting supporters.
Fluskey added in a forum comment on Third Sector’s story that the ICO’s lack of guidance for charities was comparable to "being told you're driving too fast, but not what the speed limit is".
There is, of course, an element of head-burying and locking the stable door after the horse has bolted. As the data protection consultant Tim Turner points out beneath our story, and others have noted on Twitter, in some ways charities have been the architects of their own downfall. The harsh reality is that very few have truly grasped data protection rules, at least as the ICO sees them. Furthermore, if certain charities hadn’t inundated individuals with donation requests, these inquiries would not have happened.
But this does not excuse the ICO and its approach. Public trust in all charities – not just those implicated in recent scandals – is coming under pressure and the reputation of the sector is under the microscope. The ICO therefore needs to choose its words wisely and ensure that its reasoning is sound and can be justified.
In the coming weeks, the ICO will report on several more cases involving charities. Let’s hope it is less shrill.
Andy Hillier is editor of Third Sector