Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Digital, Culture, Media and Sport, what assessment he has made of the adequacy of the powers available to the Information Commissioner's Office to enforce its decisions against search engines located outside of the UK.

The UK’s data protection laws include extra-territorial scope and allow the Information Commissioner's Office to engage in international cooperation mechanisms to facilitate effective enforcement and to provide mutual assistance through notification, complaint referral, investigative assistance and information exchange.

Both the General Data Protection Regulations 2018 and the Data Protection Act 2018 provide for extra territorial scope, which applies to organisations offering goods or services, or monitoring the behaviour of data subjects within the UK, regardless of whether the processing actually takes place in the UK or not. In certain circumstances, this may allow the ICO to take action against companies located outside of the UK. Where enforcement is required to secure the data protection rights of UK users, the ICO will apply its powers as appropriate.

The Information Commissioner has an international team responsible for engaging with data protection and information regulators globally. The Information Commissioner’s investigative teams will, where appropriate, coordinate their investigative and evidence gathering activity; this may be either jointly or individually depending on the circumstances of the case. They also have operational protocols and memoranda of understanding with their international partners in support of this engagement.