No one who has encountered Elizabeth Denham could accuse her of being sensationalist. She personally has maintained a composed tone throughout her stint as Information Commissioner. So it’s a little depressing to see her using the now-weary "fake news" term in her blogs looking at the General Data Protection Regulation.
In the blogs, she sets out to weed out some of the myths that, as she sees it, seem to have somehow spontaneously sprung up in the media and elsewhere around GDPR.
Her latest instalment was on consent. Denham seems genuinely surprised that so many organisations think they need consent to process people’s personal data, and don’t seem to understand that other legal options, such claiming a legitimate interest in processing data, are available.
Denham has chosen to illustrate her blogs with a clipart-style picture of a newspaper entitled the "Fake News", suggesting she’s got her tongue at least partially in her cheek, but what such references do is throw responsibility for any confusion firmly towards the media.
Now, there’s no reason to suppose Denham is referring to the charity press in particular here, but it does seem a tad disingenuous for her to suggest all this confusion has nothing whatsoever to do with the Information Commissioner’s Office.
If the media’s focus around GDPR has been on consent, then in part that has been because the ICO’s focus has been on consent.
The ICO produced its draft guidance on consent in April and the immediate response from the Institute of Fundraising, the Direct Marketing Association and even the Fundraising Regulator was to ask "Er... what about legitimate interest?"
That was a separate issue, they were told, we’re not talking about that - what we’re talking about now is consent.
In her latest blog, Denham says: "Headlines about consent often lack context or understanding about all the different lawful bases businesses and organisations will have for processing personal information under the GDPR."
This could be because there has been a lack of information available to give that context and understanding on the other lawful basis available - guidance on legitimate interest isn’t due to be published until early next year, perilously close to the 25 May GDPR start date.
Producing the guidance is no easy matter: interpretations of the legislation have to be agreed with the ICO’s equivalent regulators across Europe, so it’s understandable that it will take time.
But the ICO has made a rod for its own back by not producing some sort of guidance for organisations looking to rely on legitimate interest. And its relative silence on the issue, compared with its emphasis on consent, has created the perception, in the charity sector at least, that the ICO believes organisations should rely primarily on consent.
Not only have the headlines created confusion, Denham goes on, "it’s left no room to discuss the other lawful bases organisations can consider using under the new legislation".
On the contrary, there’s been plenty of room to discuss these areas. There has been a yawning vacuum that those organisations that do want to comply with GDPR have desperately filled with the only thing they do have information about - consent.
Denham’s blog is an attempt, however belated, to fill that information void, and based on the conversations I’ve had with those in the charity sector, it is going to be very welcome.
It would be trite to quip that Denham’s comments about the media are themselves fake news, especially since calling Fake News has become at best a cliché and, at worst, misdirection.
In making these comments, Denham is probably at the more benign end of the spectrum, but that’s for the reader to decide. In the meantime, keep an eye out forThird Sector’s news article on Sir Stuart Etherington, who this morning was seen joy-riding a unicorn through King’s Cross. Story to follow soon...
Rebecca Cooney is senior reporter at Third Sector