Data Protection: Assessments
(asked on 26th November 2015) - View Source
Question to the Department for Digital, Culture, Media & Sport:
To ask the Secretary of State for Culture, Media and Sport, how much the Information Commissioner's Office has spent on processing assessments pursuant to section 42 of the Data Protection Act 1998 in each of the last five financial years; how many such requests that Office has received in each of the those years; and what the recorded outcomes were of those requests.
Under section 42 of the Data Protection Act 1998 (DPA), any person who is, or believes that he is, directly affected by the processing of personal data, can ask the Information Commissioner to consider whether the processing is likely to comply with the law. On receiving such a request, the Commissioner is obliged to consider the concern and make an assessment. Any such request, and cases taken forward are dealt with by the ICO's customer contact and performance improvement business areas. The ICO does not cost up S42 assessments separately from other data protection casework, but the total staffing costs for these two business areas for the last five financial years are set out below:
2015/16 (April-Nov) | £2,883,256.14 |
2014/15 | £3,879,782.83 |
2013/14 | £3,969,104.17 |
2012/13 | £3,581,161.82 |
2011/12 | £3,389,336.87 |
Numbers of assessments received and concluded for each of the past 5 years are set out below:
Financial years | |||||
2010-11 | 2011-12 | 2012-13 | 2013-14 | 2014-15 | |
Number of assessments received under s42 DPA | 13034 | 12980 | 13760 | 14738 | 14268 |
Number of assessments completed under s42 DPA | 14276 | 12725 | 14280 | 15492 | 15052 |
The recorded outcomes of those assessments are set out below:
Financial years | |||||
Outcome of s42 assessment | 2010-11 | 2011-12 | 2012-13 | 2013-14 | 2014-15 |
Not progressed | 14% | 11% | 13% | 14% | |
Compliance likely | 22% | 21% | 22% | 19% | |
Compliance unlikely | 33% | 31% | 35% | 34% | |
Ineligible/Made too early | 27% | 36% | 30% | 33% | |
Reopened - pending final outcome | 4% | 1% | |||
No Action for Data Controller | 35% | ||||
Data Controller Action required | 22% | ||||
Concern to be raised with Data Controller | 17% | ||||
compliance advice given to Data Controller | 10% | ||||
Response needed from Data Controller | 7% | ||||
Complaint not applicable under DPA | 4% | ||||
General advice given to Data Controller | 4% | ||||
Data Controller outside UK | 1% | ||||
Improvement action plan agreed with Data Controller | 1% | ||||