CHAPTER 2
OPERATION MOTORMAN

“Having regard to the sustained and serious nature of the journalistic involvement in the overall picture, there can be little doubt that many, perhaps all, of the journalists have committed offences.
The inference, overwhelming it seems to me, is that several editors must have been well aware of what their staff were up to and therefore party to it.”

1.6 When it came to Operation Motorman, Mr Aldhouse had responsibilities which included providing direction to the head of investigations at the time (and so was formally answerable to Mr Thomas for the conduct of Operation Motorman). He said that it was not his role to direct investigations himself; rather, he had to supervise the person running the investigations department.⁵ His own focus was on policy work, not least on the significant European dimension to data protection, which often took him to Brussels.

1.7 Asked specifically about the operational issues which the discovery of the Motorman material raised for the ICO, Mr Aldhouse had no recollection of when he first heard about the case, nor of any internal meetings to discuss it (including those meetings at which the investigator Alex Owens alleged that decisive policy positions on the operational conduct of Motorman were taken by senior management). Mr Aldhouse himself said he never looked at the original Motorman material, nor the legal advice obtained by the office about it. When asked by Counsel to the Inquiry whether there was anything in the office at the time which was as big or as important as Operation Motorman, Mr Aldhouse accepted that, from an operational investigations point of view, it probably was the largest investigation.⁶ However, he firmly maintained a position of non-involvement and, hence, non-accountability. That exchange included this:⁷

Q: “I think all I’m gently suggesting, Mr Aldhouse, is this -and it’s probably fairly obvious now: we have possibly the most important investigation involving your office, Operation Motorman. It has very serious ramifications. It was clearly being ramped up at this stage. Mr Thomas had it in mind to make a report to Parliament shortly afterwards and he did. Surely you were involved, even in informal discussions with Mr Thomas, as to the direction your office was taking, weren’t you?
A: “Well, I think they would only have been casual ones...”

1.8 These answers were consistent with his brief witness statement which suggested little in the way of senior oversight of operational matters at all. He said:⁸

“I am unable to comment on the detailed history of the Operation Motorman inquiry in the direction of which I was not involved. I believe that the investigators conducted the matter together with the Commissioner’s lawyers....I regret that because of my limited role in the Operation I am unable to help the Inquiry further.”

1.9 Mr Aldhouse was also asked about the senior structure in the ICO. He described a ‘management team’ comprising the Commissioner, two Deputies, a handful of Assistant Commissioners: ‘perhaps ten or a dozen very senior people’⁹. But this team does not seem to have been engaged in any decision-making about the Motorman case, either operationally or strategically. Was it not surprising that neither the responsible Deputy personally, nor the organisation’s senior management team, was consulted or engaged? Mr Aldhouse’s response was:¹⁰

“Am I surprised? I’m disappointed. Not necessarily surprised. ... well, yes, I’m sure in retrospect it would have been - one could well say: wasn’t this big enough for the whole of the management team to be involved? ... I certainly had views, anyway, yes.”

1.10 As will be clear, despite being organisationally and functionally responsible for the investigations team, Mr Aldhouse placed himself at a considerable distance even from personal knowledge of the Motorman material. As Mr Thomas put it, with what appears to be a degree of understatement, “Francis was somewhat disengaged on these matters.”¹¹ Mr Thomas himself, however, appeared to have grasped the implications, appreciated that it was very serious and congratulated Mr Owens and the team.¹² He explained that, in what was the first year of his appointment:¹³

“I was told about a “treasure trove” of evidence which the team had obtained under a search warrant as part of ‘Operation Motorman’ … There was a feeling that the material was of sufficient quality and quantity to make this a major case which would bring home the seriousness of the [s55] offence.”

1.11 The assessment made by Mr Thomas of the Motorman material was that he saw it as “hard prima facie evidence ... of offences”,¹⁴ on a scale that could hardly have been greater for the data protection regime. He said:¹⁵

“So my understanding, I think, remains the case that this was a far more serious matter than a breach of section 55.”

1.12 Specifically, Mr Thomas apprehended that it was likely that that the journalists’ involvement in the acquisition and use of this information took them within the sphere of conduct so seriously at fault as to be prima facie criminal. Criminal conduct by journalists was the ICO’s ‘very, very strong hypothesis’.This understanding was tested during his evidence,¹⁶ fromwhich it appears that the following aspects of the Motorman material were particularly striking:

1. Some of the material from the protected public databases could not have been obtained by lawful means at all, and appeared very likely to have breached specific statutory bars on disclosure.
2. It was known that Mr Whittamore did have corrupt sources in both the public and private sectors: these had been identified.
3. The pricing structure for the commissions was indicative of criminality because they were either too low to suggest that it had been obtained lawfully (because of the effort and time which would have been involved) or high enough positively to suggest a premium relating either to incentivising legal risk or corruption (with some cases, concerning very well known individuals) involving very large sums.
4. The circumstances suggested that it was highly likely that the journalists were knowing or reckless as to the unlawfulness of the means by which the commissioned material was acquired and that, on the face of it, it was unlikely that the s55 defence relating to the public interest would be available in the generality of cases.

1.13 It must, of course, be appreciated that criminal proceedings are complex to mount and involve a high standard of proof but, quite apart from criminality, Mr Thomas understood that serious questions were raised by the Motorman material and there were causes for real concern. In his fifth witness statement, he outlined the way in which the ICO had classified the 13,343 transactions recorded as follows:¹⁷

“

1. 5,025 identified ‘as transactions that were (of a type) actively investigated in the Motorman enquiry and ....positively known to constitute a breach of the DPA 1998.’
2. A further 6,330 representing ‘transactions that are thought to have been information obtained from telephone service providers and are likely breaches of the DPA. However, the nature of these is not fully understood and it is for this reason that they are considered to be probable illicit transactions’.
3. The balance of 1988 lacking sufficient identification and/or understanding of their nature to determine whether they represent illicit transactions or otherwise.”

1.14 Mr Thomas then put the matter in this way:¹⁸

“The classification of the transactions related to the apparent commission of offences … But I suggest that there must be at the very least ethical questions where a journalist is the regular customer of an investigator who commits an offence to obtain the information, whether or not the journalist has also committed a procuring offence in relation to that transaction. Such ethical questions are even more pertinent where … the investigator could obtain the information “more quickly and reliably than they [the journalists] were able to”, at least some of the information was of a confidential nature and Mr Whittamore was pressing to sell other pieces of information obtained for other clients.”

1.15 Mr Thomas was in no doubt that a significant proportion of the Motorman material did indeed constitute evidence of criminality, particularly in contravening specific bars on the disclosure of material from databases under the control of public authorities. As for the possibility of a defence under s55 DPA, he said, for example, that “I haven’t seen a whiff of public interest. It was tittle-tattle. It was fishing. There may be one or two examples, but they would be exceptional.”¹⁹

1.16 He also made two further points. First, the theoretical availability of material by lawful and fair means did not by itself render innocuous the acquisition of material by other means which did, in fact, constitute breaches of the data protection regime. Secondly, at the very least, most of the material in question was not reasonably to be regarded as in the public domain, and therefore had a quality of confidentiality.

1.17 I have no doubt that this analysis is both important and valid. It was for that reason that I took the view that it was both appropriate and correct that Mr Owens should produce the Motorman material to the Inquiry but that (given the privacy of those whose records had been mined), it should be seen by the core participants under strict confidentiality and should remain in redacted form.²⁰ Having said that, I summarised the effect of the evidence in this way:²¹

“It’s abundantly clear, looking at the electronic records, which you’ve checked against the actual documents, that Mr Whittamore had collected together a vast amount of personal data. The documents identify the names of titles and specific journalists at the titles apparently or inferentially making the request. It identifies the names of people from a wide range of public life and in the public eye, and provides addresses, telephone numbers, mobile telephone numbers and charging details for that information. It’s not necessary to go into the identity of the individuals, … it’s not necessary otherwise to identify titles or names and certainly not necessary to identify the persons who were the targets of enquiry. In relation to some of them, it is absolutely right that there may well be a public interest justification in the enquiry. In relation to others, however, it is difficult, if not impossible, to see what public interest justification there could be.”

1.18 A further point that Mr Thomas made was to recognise the possibility that the Motorman material was representative in nature. He said:²²

“I have always recognised that the material seized in Operation Motorman came only from one group of investigators and may have been entirely isolated. Equally, many other private investigators were known to be active and it is difficult to believe the investigators raided by the ICO were the only ones with press clients. This view is strengthened by the quite separate Goodman / Mulcaire prosecutions which came to light after the first ICO report and which had parallels with the section 55 offences and reinforced the evidence gathered during Operation Motorman.”

1.19 This identifies the general awareness of, and concern about, the security of confidential databases in both the public and private sectors, the sensitivity of the concentration in those databases of very large amounts of personal data, and the risks of that getting into the wrong hands.²³ Albeit retrospectively, Mr Thomas also made the connection between the Motorman material and the subsequent evidence of phone hacking undertaken within the press²⁴ as did Mr Owens.²⁵ In any event, however, there was a clear apprehension of a general problem concerning unlawful and unethical trading in personal information, including, but not limited to, the press.²⁶

1.20 In sum, therefore, Mr Thomas, and the ICO more generally, was aware that the Motorman evidence was an indication, in relation to the culture, practices and ethics of the press and beyond, of conduct that was likely to be criminal, probably constituted systematic breaches of confidentiality, privacy and the principles and rights of the data protection regime, was certainly unethical, and was “quite outrageous in policy terms”.²⁷ As summarised in the ICO’s report to Parliament, it amounted to evidence of “a flourishing and unlawful trade in confidential personal information by unscrupulous tracing agents and corrupt employees with access to personal information”.²⁸ The Culture, Media and Sport Select Committee in 2003 described it as a “depressing catalogue of deplorable practices”.²⁹ The modus operandi, and the harm done, was well understood.³⁰ How it was addressed by the ICO now falls to be considered.

2. The ICO response: leadership

2.1 As the office holder, Mr Thomas was in a unique position to influence the culture and priorities of the office and to determine the nature and degree of his own personal priorities. In that regard, it is noteworthy that he was at pains in his evidence to the Inquiry to distance himself from the operational decisions made about Motorman; effectively, he disclaimed significant contemporaneous knowledge of the operational management of the case. It is also striking that, as Mr Thomas was aware, his Deputy, Mr Aldhouse, also distanced himself from the operational management of the case.

2.2 Although aware that a wealth of material had been recovered, Mr Thomas had little recollection of the briefing or of discussing the detail. He emphasised that the question of investigating the role of journalists and newspapers in the events “was not a matter with which in any way I was engaged”;³¹ at the time “I can’t really say that I was giving very active consideration to these matters”;³² and “I personally did not give any serious consideration to that matter, and I cannot recall any conversation or discussion when that particular issue was being discussed”.³³ He said, for example, that it was only as a result of being asked to assist the Inquiry that he had latterly become aware that the MPS had investigated journalists as part of Operation Glade, of the note made by his office of their meeting with Counsel on 3 October 2003 advising that there were grounds in the Motorman evidence for proceeding against journalists,³⁴ or that the judge hearing the Motorman prosecutions at Blackfriars had questioned the lack of proceedings against any journalist.³⁵

2.3 I must admit to being surprised about the extent to which Mr Thomas distanced himself from the practical details of the operation that was later to take up so much of his attention politically. By his own account he did not direct the operational strategy, involve himself in key decisions or, it would seem, keep himself especially closely briefed. One of the earliest notes of his reaction was a handwritten entry in a personal notebook³⁶ written between 3 and 10 March 2003³⁷ recording: “Francis – Newspapers/s55”. Unable to recall any conversation with Mr Aldhouse, Mr Thomas was pressed as to whether this did not suggest a personal interest in the press dimension to Operation Motorman. But he remained firm: he personally did not give any serious consideration to the operational dimension. He ‘assumed’ that an operational decision would be taken at the level of Mr Owens and the in-house legal team, about whether and to what extent to pursue action against the press. Put to him that he must at least have been aware that no journalist was being prosecuted, that he must at least have been alert to the criminal process, he replied that that was only in very general terms. There were, he pointed out, ‘many, many other matters going on at that time’.³⁸

2.4 The ‘Newspapers/s55’ note might, at least, be thought to suggest that Mr Thomas was concerned with the criminal process. It is to that issue that most if not all references to his assumptions about the operational management of Motorman are made in his evidence.³⁹ He stated, for example, that:⁴⁰

“It was my understanding that the case would be pursued in line with established Office practice – prosecutions led by the in-house legal team, advising and acting upon the evidence obtained by the Investigations Unit. I was subsequently kept broadly abreast of developments, notably that the CPS were taking over the prosecutions [this is, of the private investigators] and then that trial had resulted in major disappointment. The ICO lawyer with lead responsibility was Phil Taylor.”

2.5 The Motorman material had emerged in the course of a criminal investigation, but its implications for the data protection regime were much broader than that. There is no indication, however, that aspects other than prosecution were actively being considered within the ICO. It is difficult on the face of it to understand why not: that question is considered in some detail below.

2.6 Both in law and in terms of the reputation of the ICO, operational decisions, especially any involving the press, would have been complex and significant, and Mr Thomas was ultimately accountable for them. Motorman was not a simple operational issue: it was an indication of data protection breaches and poor practice on an unprecedentedly large scale and driven by the newspaper industry. It obviously engaged the ICO functionally and could have reputational consequences. In addition to criminal proceedings, there was a spectrum of powers and functions which, at any rate potentially, could be engaged, in different combinations. These are considered in more detail below. Given the inherent risks in criminal proceedings, contingency planning was also in question. In other words, there were strategic decisions to be taken in considering the operational response to Motorman which could only be taken effectively at the level of strategic overview. However those in a position to take that strategic overview of operations emphasised to the Inquiry that they were not doing so.

2.7 In addition to operational responses there were political possibilities and it is these that Mr Thomas focused on. His strategy was to take a twin-track approach, consisting of initiating a dialogue with the Press Complaints Commission and undertaking a campaign to persuade the government to change the law to introduce custodial sentence maxima for s55 of the Act. In some ways, Mr Thomas characterised this as in itself an operational response:⁴¹

“I think we were using our powers to promote good practice. That was a far more general power, and you know, that was the justification, the rationale – the statutory foundation for much of what we did was promoting good practice. I would describe pretty well everything we did in this area as promoting good practice.”

2.8 There were, however, risks in the extent to which the most senior staff were at a distance from the specifics of the operational response to Motorman. The first was that the strategic approach adopted would be insufficiently informed by detailed operational knowledge and understanding of the problem revealed. The Motorman material was a very rich resource of empirical evidence of the nature and scale of the presenting problem, and any strategic solution was likely to have been importantly enriched by expert analysis of that information in the context of the industry in question. The second risk was that the political and operational responses would be insufficiently well co-ordinated for the maximisation of the effectiveness of each. Decisions made in one context might well be capable of affecting the other at least at a handling level. Mutual knowledge and understanding would be important resources for both. Finally, the third risk was that if the top of the office did not sufficiently communicate with or engage the operational part of the office about the political strategy, operational decisions might be taken on the basis of weak knowledge or assumptions about the operational implications of the political strategy.

2.9 As for the distance that Mr Thomas kept from operational decision-making in Motorman, he put his own frame of mind in embarking on his twin-track political strategy in this way:⁴²

“My speculation is when I was told some time in October or November [of 2003] that it was going to be too expensive or too difficult to pursue the journalists, that’s when I went off to the Press Complaints Commission. But throughout that period from March to October, as far as I was concerned, it was being handled in what I can broadly call the normal way by those who were charged with enforcing Section 55.”

2.10 This speculation does not seem to be strictly accurate. At the time, with the assistance of Counsel, the investigations officers evidently continued actively to consider the possibility of criminal proceedings in relation to the press. The availability of civil investigation and enforcement powers also fell to be considered in the alternative in any event. In other words, Motorman, remained a live operational issue for the ICO at the time Mr Thomas embarked on his political strategy; there were therefore risks both to it and to his own plans.

3. The approach to the PCC

3.1 Mr Thomas was clear that it was his personal decision to approach the PCC;⁴³ this was reinforced by his Deputy, Mr Aldhouse. In oral evidence to the Inquiry, Mr Aldhouse said:⁴⁴

“I do recall that Richard Thomas decided that he wanted to pursue the route of going to the Press Complaints Commission and writing to Sir Christopher Meyer, but I have to say I think that was Richard Thomas’s decision rather than the result of some discussion.”

3.2 Pressed as to whether he would not have expected, as Deputy, to have been involved, he said he would, but he was ‘otherwise engaged’, including in Brussels. Although Mr Aldhouse saw his own role as somewhat dissociated, given the policy ramifications that the Motorman case might throw up and the potential cost implications for the ICO, when asked whether it was strange that he was not at least involved quite closely in discussions with Mr Thomas, his response was:⁴⁵

“What can I say? It’s for the Commissioner to decide how he runs the office. If - and it is worth bearing in mind, of course, that it is - that the Commissioner is a one-man band and if the Commissioner decides to take a route, so be it.”

3.3 In the event, on 4 November 2003, Mr Thomas wrote personally to the Chairman of the PCC, then Sir Christopher Meyer.⁴⁶ He explained that his idea had been to ‘go collectively’ rather than individually to the press.⁴⁷ This gives rise to a number of issues. First, what his understanding of the role and functions of the PCC was (and how that developed); second, to what extent he understood the PCC to be a representative of the press collectively and to what extent a regulator of the press (two very different propositions); and third, how he judged the ICO and PCC would relate to each other functionally and how he managed that relationship. The resolution of these leads to the overarching question about the objectives in approaching the PCC, whether they were appropriate and how effectively were they achieved.

3.4 In relation to his approach and objectives, Mr Thomas was looking at these at a high level and generic nature which was some distance from the immediate operational issues faced by the ICO. He did not have it in mind to ask the PCC to investigate the specifics of the Motorman material or the conduct of the press (although he does not appear to have resolved how an investigation would be handled if at all within the ICO). He wanted a general, forward- looking exercise, conducted across the industry as a whole, with a view to putting a halt to the practice of commissioning unscrupulous private investigators to obtain confidential personal information without regard to whether means such as blagging and corruption were used. He considered that this would principally be achieved by issuing a prominent and general condemnation of the practice and securing appropriate changes to the Editors’ Code.⁴⁸ There is, however, no clear indication of how Mr Thomas thought condemnation by the PCC and changes to the Code would definitively terminate the practice, nor of what, if any, complementary action would be necessary or desirable on the ICO’s part to achieve that result.

3.5 Mr Thomas was also concerned about the tone of his approach. He wanted to make a ‘constructive and friendly’⁴⁹ overture to the senior leadership of the PCC. He evidently had in mind that a ‘good relationship’⁵⁰ would be important. There was to be an element of outreach and informality, so lunch meetings were contemplated, Mr Thomas would attend on the PCC so far as location was concerned (a concession inevitably constrained by the location of his premises in Cheshire), and formal or agreed notes were not expected. In other words, Mr Thomas intended to conduct the relationship himself, at a personal level and in a personal manner.

3.6 The letter⁵¹ drew attention to a recommendation of the Parliamentary Culture, Media and Sport Select Committee that the Editors’ Code should be amended to include explicit bans on payments to the police for information and on the use and payment of intermediaries such as private detectives. The letter outlined the Motorman findings and the Metropolitan Police investigations. It stressed the considerable volume of material uncovered; the indication that journalists from most newspapers and many periodicals were customers of Mr Whittamore; and that numerous journalists routinely obtained confidential information that ‘they should have no access to’. It suggested that this material was being obtained in the service of celebrity gossip, not to expose wrong-doing, and that the sums involved and the nature of the documentation made it ‘difficult to believe that senior managers were not aware of what was going on, and were therefore at least tacitly condoning it’.

3.7 The letter also indicated that the ICO was considering whether to take action under the DPA against individual journalists and/or newspapers. It was put to Mr Thomas by the Inquiry that this was an empty threat; he resisted the idea that it was a threat of any sort, on the basis that he intended the letter to be a ‘constructive and friendly opening in my engagement with the Press Complaints Commission’ but he did accept that ‘it may have been somewhat overstating the case’.⁵² It suggested however that the ICO had provisionally concluded that it would be appropriate first to give the PCC and its Code Committee the prior opportunity to ‘deal with’ the issue in a way which would put a stop to the ‘deplorable’ practices across the media as a whole. It envisaged that the ICO would provide some of the Motorman material to the PCC and that the PCC would respond with a suitable change to the Code; this could provide a more satisfactory outcome than ‘legal proceedings’ and would also, it was suggested, be consistent with Sir Christopher Meyer’s wish expressed to the Select Committee to demonstrate the effectiveness of the PCC.

3.8 In the light of all that has been said about the PCC, it is significant that the letter addresses the relationship between the ICO and the PCC as Mr Thomas saw it. Intending to discuss the relationship, he said:⁵³

“I believe it would be to our mutual advantage to meet at an early opportunity to discuss the matters raised in this letter and, more generally, our respective roles and the relationship between our organisations.”

He also indicated that: “though I do not wish to usurp your role as the regulator of the press - newspapers, and their employees, are subject to the Data Protection Act 1998.”⁵⁴

3.9 Mr Thomas was surely correct to suggest that the respective roles and responsibilities of the two organisations, namely the statutory data protection regulator and the industry’s voluntary body, would be an important issue. The obvious asymmetry made it so. The ICO had legal functions and duties to be discharged in relation to the matter of how businesses acquired and used individuals’ information; the PCC did not. It is inevitable therefore that Mr Thomas’s approach would have had to have been at the level of seeking to elicit the voluntary cooperation of the PCC rather than making a claim on any complementary or overlapping formal legal jurisdiction.

3.10 Mr Thomas’s letter suggested a meeting within days at the offices of the PCC; he approached that meeting in a structured way, preparing a speaking note⁵⁵ setting out his evident hope that the PCC would respond with a ‘general condemnation’ and changes to the Editors’ Code. The meeting took place on 27 November 2003, Sir Christopher was accompanied by Guy Black (then the Director of the PCC, now Lord Black of Brentwood).

3.11 Mr Thomas said that, initially, the PCC had at first not really known why the ICO had approached them, but that the atmosphere changed as he set the matter out and he convinced them a serious matter was in issue and that the two organisations would work together to deal with the problem.⁵⁶ His subsequent written notes stated:⁵⁷

“The PCC would like time to consider their response. They were clearly surprised by the scale and nature of the material we have collected and see this as a ‘watershed’ in terms of this sort of activity. “Although this was not suggested by us, they would be resistant to ‘taking over’ individual cases and taking action in each case instead of us. Their starting point was that statutory bodies should enforce the law, not them. But they seemed to be increasingly ready as the meeting progressed to work with us as ‘fellow regulators’ with a strategic response. This might lead to some sort of general condemnation and – though there are some difficulties – an amendment to the Code. “It is for them to identify precisely what they might do, and they recognise this. They want a second meeting before Christmas.”

3.12 It is somewhat surprising that Mr Thomas appears to have seen a measure of equivalence between the roles of the ICO and the PCC, if not actually of deference to the latter. In oral evidence he explained that “I think we were both very proud of independence, I’m sure” ,⁵⁸ and he noted to himself after that first meeting that it had been “constructive – ‘fellow regulators’”. In the circumstances, I felt driven to ask:⁵⁹

“What are you relying on as concluding that the Press Complaints Commission was a regulator? You’re a regulator, but you’ve concluded here that they’re a regulator, or asserted that they’re a regulator. I’m just interested to investigate your understanding of that.”

3.13 The response from Mr Thomas was that the PCC called themselves a ‘self-regulatory body’ and confirmed that at that point he certainly saw them as such; and therefore as likely to be ‘intelligence-driven, proactive, mainly focused on either prevention or punishment’. He had drawn parallels with the Advertising Standards Authority and the banking and insurance ombudsman schemes with which he was familiar from his previous career, and saw the PCC as, like the ASA, able to intervene and take action to prevent unacceptable behaviour. It was with that expectation that he had approached Sir Christopher. The PCC was ‘supposed to be in charge of the press, they ought to know what’s going on’⁶⁰ and, indeed, to stop it.

3.14 Mr Thomas accepts now that this was a misconception. In oral evidence to the Inquiry he confirmed that:⁶¹

“I did see them and they held themselves out as a regulator and I think experience showed that they were not a regulator in the conventional sense.”

He went so far as to suggest that the inadequacy of the PCC to the task he had envisaged for it formed a part of the dialogue:⁶²

“I can recall saying, you know, ‘Why can’t you transform and change the Press Complaints Commission to make it look more like the effective self-regulation models I’ve encountered elsewhere?’”

3.15 His current understanding was that the PCC was essentially a complaints handler, with functions focused on the investigation of complaints from the public. That leads to the question of the steps he might have taken to ascertain the position at the outset, or as his understanding of the PCC developed over time, not least bearing in mind his express placing the question of the relationship between the two bodies on the agenda at that original meeting. This is important because the assumption of equivalence (or deference) with which he mistakenly embarked on the initiative with the PCC could have had direct implications for decisions the ICO might otherwise have made about the exercise of its own powers and functions. That, as well as Mr Thomas’ personal distance from the operational issues raised for his office by the Motorman data, put him in an unsatisfactory position in embarking on this enterprise.

3.16 Furthermore, although the initial letter expressly put the question of respective roles and relationships on the agenda for discussion with the PCC, it is evident that the opportunity was not in fact taken to clarify that fundamental question. Mr Thomas was specifically asked whether the role of the PCC was described and his perception discussed and corrected.⁶³ His response was that over the course of his interactions with Sir Christopher ‘we’ve probably touched on some of these matters’. Given the significance that Mr Thomas attached to this approach that cannot, in the circumstances, be considered a satisfactory basis on which the ICO, as a statutory regulator, ought to have made any decisions about respective roles and responsibilities. The likely explanation for (and consequences of) this is considered below.

3.17 Sir Christopher’s own account of that first meeting was more highly coloured. He was evidently interested in what he heard about Motorman: he characterised the ICO as describing a ‘fairly apocalyptic situation’,⁶⁴ leading them to expect court action in relation to the press (which did not materialise), but principally in getting to the data underlying the issue:⁶⁵

“I wanted beef. I wanted red meat, Mr Jay, and he didn’t give it to me.”

3.18 Sir Christopher’s appetite for beef, therefore, was evidently related at least in part to seeing the proof of the message he was being given. Pressed as to whether the PCC could not simply have taken on trust the ICO’s indication of the extent of the problem without the underlying data, Sir Christopher’s answer was that while of course it could be assumed Mr Thomas would not have made the allegations without some substance, they never saw the substance or the expected litigation.

3.19 Sir Christopher also describes telling Mr Thomas that he was the Information Commissioner and should “get on with it. Prosecute these guys”, noting that “And prosecutions came around none, ever, in my time, anyway.”⁶⁶ This reaction is echoed in Mr Thomas’s own note where he records the PCC as emphasising ‘not our role to enforce law, not arm of ICO’.⁶⁷

3.20 The refusal of the PCC to take any action while criminal proceedings were pending or possible was also made plain;⁶⁸ this was a position which Mr Thomas on his part made very clear he did not accept, but from which the PCC refused to move. The message from Sir Christopher, in other words, was that the Motorman evidence was ICO business rather than for the PCC; they were prepared to help as far as they could, but needed more to go on.⁶⁹

3.21 The reaction (that the PCC wanted details of the underlying data and decisive action from the ICO before it could act) continued to set the tone and might be viewed as an early warning of the extent to which the PCC was either unwilling or unable to deliver what Mr Thomas hoped to achieve. It might (but did not) cause a reconsideration of his investment in the twin-track strategy of approaching the PCC and the government, but without at the same time attending closely to the operational response itself.

3.22 A year passed with little progress. Mr Thomas described the joint effort to produce a guidance note as seeming to “sort of grind to a halt in April of 2004”.⁷⁰ He wrote to the PCC on 8 December of that year expressing concern that the work had ‘run into the sand’,⁷¹ and that there was consequently a real risk that the problematic practices would continue unabated. This comment is particularly significant because if the ICO apprehended that there was a real risk of continuing unlawful conduct after the Motorman seizure there was again no indication that this was the subject of any reassessment, either of the PCC strategy itself or of the operational response and options within the ICO. A whole year had elapsed since the first approach to the PCC, two years since the seizure of the Motorman material. These were potentially very serious matters, and the PCC strategy had yet to bear any fruit. Mr Thomas explained that he did not ‘lose all faith’.⁷² In the circumstances, the basis of that faith and his continued reliance on it are increasingly hard to understand.

3.23 Both sides appear to have thought that the matter had become bogged down in legal details, including over the matter of the effect of the public interest exemption in s55 of the DPA in relation to actual or potential criminal liability of journalists. Mr Thomas put it to the PCC in his letter that he was strongly of the view that inaction on their part would show the ‘principles of self-regulation in a poor light’.⁷³ If his intention was to suggest either that the PCC risked its own credibility politically, or that the industry risked direct regulatory action from the ICO, there is no evidence that Mr Thomas had any particular basis for making such a suggestion.

3.24 On 15 December 2004, Sir Christopher replied⁷⁴ indicating that he was going to “resurrect” the project with a view to approving a note the following February. He made it clear, however, that the key objective of the note from the point of view of the PCC was to assist journalists in understanding how to comply with the DPA: that would be ‘most welcome’. A very brief was issued (‘probably in the spring of 2005’)⁷⁵ but evidently with little impact; it contained no reference to Operation Motorman and no warning to journalists.⁷⁶

3.25 In evidence, Tim Toulmin (then the Director of the PCC) agreed that “there was no attempt by the PCC in 2005, through its guidance, specifically to warn the press of what they should do in the future by reference to what they might have done in the past.”⁷⁷ His view was that, given that the PCC was ‘a complaints body looking at breaches of the code of practice rather than the Data Protection Act’, there was some question about whether it should even have issued the note it did, but ‘it did want to be helpful’. The PCC had regarded it as ‘pretty much outside its remit’ and required a specific decision from its board to proceed with the matter at all. Mr Toulmin also agreed with the proposition that the PCC’s view was: “Well, there isn’t a specific complaint here, therefore our powers aren’t engaged and we’re only going to take second place to the Information Commissioner, who is the real regulator in this area”.⁷⁸

3.26 Mr Toulmin also said:⁷⁹

“The question was, I think, where the different responsibilities lay. The PCC, as a platform for discussing the behaviour of journalists and so on in another context, which was about the application of the code of practice, was happy also to say, “By the way, Richard Thomas has this campaign about the Data Protection Act and he’s right to do so”, but beyond that, it was difficult really to know what the PCC could do.”

3.27 The next step was the publication by the ICO of What Price Privacy⁸¹ on 10 May 2006; the ICO included the PCC in its distribution list. A response (described with conscious understatement by Mr Thomas as “disappointing”) came on 31 May in a form acknowledged by Sir Christopher as a bit “sneering”. It was in these terms:⁸²

“Thank you for sending me a copy of your report, What Price Privacy? It was an interesting read. I am sending you a copy of our annual report, which we have just published, along with the text of a speech I gave last week in which I refer to your remarks about the PCC. I think that, as a next step, it would be helpful if we organised a meeting so that we can explore what more it is that you think the PCC can do. You will appreciate that your call for us to act came rather out of the blue, and we have no material to work with other than what you put into the public domain in your report. Perhaps someone in your office could be in touch ... to arrange a suitable time.”

3.28 The enclosed speech was largely a celebration of the achievements of the PCC, and immediately before closing with the claim that ‘15 years of the PCC has changed the culture of an entire industry’, dealt with the ICO in two short paragraphs which strongly suggested that it had reached the limits of the action it was prepared to take:⁸³

“There is one issue not touched on in the Report which merits an observation. Recently, the Information Commissioner, Richard Thomas, wrote to me, as he did to members of the newspaper and magazine industries, about the suborning of people by agencies paid by publications to obtain confidential information. This is something that I have intermittently discussed with Mr. Thomas over the last two years or so. It was as a result of our exchanges that the PCC published last year, in collaboration with the Information Commissioner’s office, an advice note to journalists about the Data Protection Act and how it impinged on their profession. “Part of the purpose of the note was to remind journalists that offering money for confidential information, either directly or through third parties, was illegal. Mr. Thomas is clearly concerned that this is a practice which continues. He would like the PCC to do something more about it. I intend to tell him once again that we can and do urge on journalists respect for the law – bribery has no place in journalism. I will go on urging. And I look forward to discussions with Mr. Thomas about what more he thinks the PCC can do about this within the self-regulatory framework. But clearly it would not be viable simply to duplicate the criminal law in the Code of Practice .”

3.29 This did not prompt a reassessment of the strategy, but, on 13 July, a further meeting between Mr Thomas and Sir Christopher took place. The ICO note of the meeting⁸⁴ identified as key issues the PCC response to What Price Privacy?, support so far and next steps, along with ‘the respective roles and responsibilities of the PCC and the code of practice committee of editors’. Sir Christopher was reported to have said that ‘the PCC is not able to act as a general regulator. He believes that what is needed is a strong stance from the ICO including prosecutions. He queried what more the PCC could do.’ The ICO considered that the PCC’s role was to come up with proposals on raising awareness to help prevent misconduct, and seemed to consider in turn that there was little more that the ICO could be expected to do. Sir Christopher encouraged the ICO “to engage directly with the industry” and Tim Toulmin stressed the need for the PCC to act ‘with the consent from industry’ in the matter of issuing guidance, and also recommended direct engagement with the industry.

3.30 A number of action points were recorded for the meeting. These were:

1. the Code of Practice Committee of Editors was to be engaged by the ICO and the PCC to discuss the possibility of changes to the Code and production of guidance;
2. the PCC was to give thought to the production of question and answer style guidance separate of the Code;
3. the PCC was to continue to condemn the illegal obtaining of confidential personal information by journalists; and
4. the PCC was to provide the ICO with a formal response to the recommendations in the report.

3.31 The disappointment felt by Mr Thomas with the response of the PCC remains keenly felt in his oral testimony.⁸⁵ He was exasperated with the PCC’s line:⁸⁶

“[…]Coming back all the time: “What do you want us to do? Tell us exactly what to do.” My line was: “Well, you are the self-regulators. You’re the ones supposed to be working out what is needed to stop the press getting into unacceptable territory. It’s not my job to tell you what your job is.”

3.32 Sir Christopher’s account of this meeting also evinced a certain amount of exasperation also:⁸⁷

“I was sort of repeating the same message like a parrot: where’s the beef? For Pete’s sake – you know, we can do general exhortation, we can do guidance, we can do this stuff, but if you really want me to home in on miscreants, I must have some evidence of who has been procuring enquiry agents – or hiring enquiry agents to procure information illegally, and he was unwilling to do that.”

Asked what he might have meant by saying that the PCC was unable to act as a general regulator, Sir Christopher said this:⁸⁸

“I think what I had in mind there was a notion that we should in some way take on the work of the Information Commissioner by virtue of being a Press Complaints Commission, and this is what I wanted to reject. The point I always made to Mr Thomas, apart from my insistent demands on beef, was to suggest that we had to work in a complementary way. He did his thing, but there were things that we could do to help him, and I’ve described them...”

3.33 It is not the function of this part of the Report to analyse the response of the PCC on its own account;⁸⁹ rightly or wrongly, however, the PCC had unmistakably demonstrated that it was unwilling or unable to take action of a sort which could or should have convinced the ICO that the problems with the culture, practices and ethics of the press evidenced in the Motorman material had been definitively addressed by the industry for the future. It had also demonstrated a challenge back to the ICO to address the situation through the discharge of its own powers and functions, and specifically by direct engagement with the industry.

3.34 The result is that it was evident that the strategy adopted by Mr Thomas (dialogue with the PCC, and distance from both from the operational choices of his office and from direct engagement with the regulated members of the industry) was becoming increasingly unlikely to achieve its aims. Whether Mr Thomas considered himself to be dealing with an ineffective industry regulator, or with a recalcitrant representative body of the industry itself, the onus was clearly firmly on the ICO to reflect further on the direction that it wished to take with the Motorman evidence. No such reconsideration appears to have taken place. Nor is it clear that the ICO explained to the PCC either its position or its operational approach.

3.35 Doubtless in the hope of making progress, in accordance with the action points from the meeting, Mr Thomas wrote to the Code Committee on 19 July 2006 and a meeting was fixed for 21 September. In the meantime, there was a ‘formal response’ from the PCC to the effect that the ICO should take up the question of Code amendment directly with the Code Committee and that the PCC would await the outcome of that process before turning its mind back to the issue of guidance⁹⁰. Mr Thomas later described himself as having been “fobbed off” to the Code Committee by Sir Christopher.⁹¹

3.36 Notably, the question of a response by the PCC was now ‘complicated’ by the fact that the then Department for Constitutional Affairs, had issued a consultation paper (picking up from What Price Privacy? ) relating to the introduction of custodial penalties for conviction under s55 of the DPA. In other words, at this point, if not earlier, the strategy around the approach to the PCC became inextricably entwined with the political campaign which was the second limb of the ICO response to the Motorman material. In relation to this campaign, the PCC unambiguously positioned itself not as a regulator of the industry but as a champion of the view opposing any legislative change: it did so by active political lobbying (not least through Guy Black). The twin tracks of Mr Thomas’s approach effectively became one. It is to the political campaign that it is now appropriate to turn.

4. What Price Privacy? The political campaign

4.1 Any new statutory regime can take time to bed down in practice and a regulator created by statute will be in the best position to report on its practical operation. In relation to the DPA, the ICO had two channels for doing so. The first was to do so informally to the sponsoring government department with policy responsibility,⁹² the second was to do so formally by reporting directly to Parliament either generally on the exercise of its functions under the Act or on specific aspects of those functions.⁹³ It was this second channel which had been used in the case of the What Price Privacy? Reports.

4.2 Reporting on effectiveness of legislation is not the same as campaigning to change it. The duties of the ICO under the DPA focus on performance of statutory functions⁹⁴ and do not themselves very obviously provide the platform from which to mount such a campaign. Clearly, the general desirability of a statutory regulator undertaking such a role is a matter of judgment on which I do not express an opinion but a number of issues do fall to be considered.

4.3 The first is the risk that a political campaign might impact on the principal function of a regulator such as the ICO, that is to say, the discharge of regulatory obligations which must be undertaken independently, impartially, fairly and objectively, and many of them in a quasi- judicial fashion. As a matter of law, therefore, any campaign should raise no issue, whether as a matter of fact or of perception, which could cast any doubt on the proper conduct of those functions. In that regard, it is relevant that the ICO exercises regulatory functions in relation to the Government itself both as users of personal information and therefore subject to the ordinary data protection regime but also of course as the single largest collective subject of the freedom of information regime. The Information Commissioner would obviously have to be circumspect in relation to any campaign for change in data protection law and, when personally identifying himself with it, have regard to its effects on the reputation of the office and the enhancement of its role and functions.

4.4 The second issue relates to the choice of the topic on which to campaign. S55 creates a criminal offence with statutory defences and a maximum sentence on conviction of a fine.⁹⁵ Yet Mr Thomas had said that the ICO was not principally a prosecuting authority. In most regulatory regimes, criminal provisions usually constitute a measure of last resort, dealing with situations either of egregious breach for which no other response is appropriate, or for persistent and escalating breach where other, stepped, interventions have been tried without success. Criminal prosecution is complex and expensive. The deterrent effect of differential maximum sentences is not straightforward (and, as discussed below, of potential relevance at all only if there is a realistic prospect of apprehension and conviction).

4.5 The importance of s55 to the data protection regime did not therefore lie in its centrality to the operation of the regime, any functional dependence on it of other powers, the regularity with which it was likely to be deployed or its operational visibility to the senior leadership of the office. Nor, of course, is s55 a provision of inherent particular relevance to the press: it is a provision of complete generality, the offence able to be committed by ‘any person’, whether or not they are formally subject themselves to regulation by any of the other provisions of the data protection regime.

4.6 In his first witness statement, Mr Thomas suggested that s55 was likely to be the most relevant provision of the Act to the Inquiry’s terms of reference.⁹⁶ Doubtless, he did so because of the prominence that he had given the issue in his strategic response to the Motorman evidence and the role of the press. It was on 15 April 2005, with the conviction and conditional discharge of Mr Whittamore for s55 offences arising out of Motorman, that Mr Thomas records, “When I heard this, I can recall personally and strongly sharing my team’s feelings of frustration.”⁹⁷ He understood Counsel to have advised as a result that further prosecutions would not be in the public interest. “It was then my personal decision to commission a report to be presented to Parliament…”

4.7 It will be necessary to consider the sentencing remarks of the judge and the reasons for the sentencing decision but they are, obviously, fact-specific, not least in relation to the personal circumstances of Mr Whittamore and his inability to meet the obligations of a financial penalty. The disappointment in the office at the Whittamore result is understandable, but consideration must also be given to the extent to which the disappointment was, in any event, the direct result of the choices that had been made within the ICO about the extent of its own engagement with the criminal process, and about pursuing alternative or additional operational options more generally.

4.8 The outcome of the prosecution may have been a blow to the ICO principally because, in the first place, it had represented the majority of its investment in an operational response to the Motorman material. It is beyond question, however, that there was an entirely justifiable and genuine sense that it would have been a travesty for matters to have been left there, given the sheer extent of the evidence uncovered. It is not entirely clear why the approach adopted was seen as the principal way forward.

4.9 What Price Privacy? The unlawful trade in confidential information⁹⁸ was the report to Parliament on the Motorman affair and its implications by the ICO issued pursuant to its powers under s52(2) of the Act.⁹⁹ The foreword provided by Mr Thomas introduced the report as being essentially about the evidence of a “pervasive and widespread ‘industry’ devoted to the illegal buying and selling” of information contrary to s55, and about the need for change to the law. He put it this way:¹⁰⁰

“The crime at present carries no custodial sentence. When cases involving the unlawful procurement or sale of confidential personal information come before the courts, convictions often bring no more than a derisory fine or a conditional discharge. Low penalties devalue the data protection offence in the public mind and mask the true seriousness of the crime, even within the judicial system. They likewise do little to deter those who seek to buy or supply confidential information that should rightly remain private. The remedy I am proposing is to introduce a custodial sentence of up to two years for persons convicted on indictment, and up to six months for summary convictions. The aim is not to send more people to prison but to discourage all who might be tempted to engage in this unlawful trade.”

4.10 What is striking about this analysis, and indeed about What Price Privacy? more generally, is the absence of any context within which s55 sits in the wider data protection regime. Even ignoring the unexamined assumption that different sentence maxima would have a definitive impact on the problem, no attention is given to the obvious question of what other operational means were available to the ICO to address the problem it had diagnosed. On the contrary, the entire thrust of the report is directed to legislative change on criminal penalties. As the foreword concludes:¹⁰¹

“These concerns, and the need for increased penalties, have been raised with the Department for Constitutional Affairs. The positive response that I have received so far is encouraging. These are early and welcome indications of progress on the possibility of Government action.”

4.11 Putting to one side the important argument that breach of the criminal law should not simply be seen as a cost of doing business, the most important deterrent the criminal justice system can provide is the likelihood of being caught. In the analysis of the perspective provided by the criminal law,¹⁰² the first problem in relation to data protection is that those whose personal information is being illegally traded are unlikely to know about it with the result that no complaint will ever be made. Thus, the critical aspect of Operation Motorman was the unexpected discovery of the ‘treasure trove’ (as was equally the case in relation to Operation Caryatid).¹⁰³ This is particularly so in relation to cases involving the press because of the complications that will flow from the legal protection afforded to journalistic materials and to sources. In truth, without victim complaints, the only systemic way of identifying criminality of this sort is by the exercise of regulatory investigative powers. If there is a measure of confidence that crime will not be detected, the possibility of a custodial sentence may not be sufficient to discourage the behaviour: it was not sufficient, for example, to prevent the phone hacking exposed by Operation Caryatid.

4.12 Mr Thomas explained the objective behind his focus on increasing the maximum available sentence for s55 in this way:¹⁰⁴

“I think I had quite a long list of objectives by the end of the day, by the time we got to publishing this report. The first objective was to tell the world what was going on. The primary stated objective was to get the recommendations taken seriously, particularly to get the government to increase the penalty, because we felt the penalty was the main problem. But I also felt – and I’m not sure this was articulated, but in my own mind – the more noise we could make about this, even if not successful in getting the law changed, the more that was likely to have a beneficial result. I wanted to get people on the back foot.”

4.13 It is possible to sympathise with the description of the problem in the introduction to What Price Privacy? that low penalties devalued the data protection offence in the public mind and masked the true seriousness of the crime, but it is possible to argue about the degree to which the sentence maxima stood proxy for the regime as a whole. In the perennial struggle to get data protection (and, thus, the ICO) taken seriously, whether by regulated business, by the public, by the courts, by politicians, or by the press, the ICO quite understandably needed to make a public example of the Motorman find. The outcome of the Whittamore prosecution could be thought to reveal that the wider objective had been set back and that failure was in turn symptomatic of the lack of seriousness with which the courts seemed to consider data protection. The sentence maxima contributed to that lack of seriousness, and were in turn a sign of a lack of legislative seriousness: a failure at the political level to take data protection seriously. The s55 campaign was to that extent a test of political commitment, and as such existential for the ICO. The Motorman evidence, and the other evidence referred to in What Price Privacy?, gave the ICO an impressive platform from which to make its case for data protection.

4.14 Mr Thomas put it this way:¹⁰⁵

“The ICO put heavy effort into promoting the two reports. The main aim was to secure implementation of our recommendations – especially custodial sentences which were primarily seen in terms of deterrence – but also to raise awareness about the nature and scale of the illegal trade and get it taken much more seriously. The technique of announcing the intention to produce a second (progress) report was deliberately part of this strategy. I was personally involved in this promotional activity to a very considerable extent. The Commissioner - as the personification and leader of the ICO - is obviously expected to be a visible part of all major activity. In this case, I attached particular priority to the issue and also viewed promoting the reports as a tangible way of fulfilling a wider ambition to get data protection taken more seriously.”

4.15 Operation Motorman triggered the political campaign on s55 although that campaign was neither a specific response to the evidence uncovered by Motorman, nor was it addressed specifically to the culture, practices and ethics of the press. At its heart, although it was much more general and, in the mind of Mr Thomas, symbolic of the struggle to get data protection taken seriously by a wider political audience, it very quickly acquired totemic resonances of a very different kind in the political arena into which What Price Privacy? had ventured.

4.16 It is important to appreciate that the ICO campaign on s55 was not targeted specifically at journalists although the campaign against it was championed by the press.¹⁰⁶ The publication of What Price Privacy? marked the emergence into the public arena of what had until then been low-key policy discussions with the Department for Constitutional Affairs about law reform. It also coincided with a point in the protracted and frustrating dialogue between Mr Thomas and the PCC at which the latter had formed a view that there was little it was able or willing to contribute to the nominally jointly-espoused aim of effecting culture change in the press, without direct regulatory engagement by the ICO with the industry.

4.17 The arrival of What Price Privacy? proclaimed the introduction of custodial penalties as ‘the solution’ to the problem the ICO had been describing to the PCC. This could reasonably have been expected to have been interpreted by the industry as ‘the solution’ directed to the culture, practices and ethics of the press in relation to the acquisition and use of personal information. It was a solution the press entirely rejected for itself. Two results predictably followed. The first was the mobilisation of a political lobbying effort by the press against the campaign, directed to the heart of government. The second was a hardening of the attitude of the press (now unmistakably represented by the PCC) towards the ICO.

4.18 As Mr Thomas described, his political campaign was both elaborate and extensive; on any basis, it was a major undertaking and a substantial investment of his personal time and attention. In the end it involved him engaging at the highest levels in Government and extensively in Parliament, including by giving evidence to no fewer than four Select Committees.¹⁰⁷ By December 2006 (the time of the promised follow-up report What Price Privacy Now? The first six months progress in halting the unlawful trade in confidential personal information ),¹⁰⁸ the campaign had, at least in its own terms, achieved a measure of success. On 24 July 2006, the DCA had published its public consultation paper on increasing the sentencing maxima for s55 to include custodial penalties.¹⁰⁹ There had been a degree of public attention and media coverage ( What Price Privacy Now? had included four pages of headline press cuttings) and the report claimed an encouraging response from the investigations industry, and raised awareness among (at any rate intermediary) media organisations.

4.19 The follow-up report expressed disappointment with the opposition from within the press (both by editors and proprietors) to the s55 campaign and considered it misconceived in underestimating the existing protections in the law and the commitment of the ICO itself to freedom of expression. Its conclusion was that:¹¹⁰

“There is still further work to be done to reduce the demand for illegally obtained confidential information. This work will be ongoing. We will continue to track down and prosecute offenders. We will continue to press the Government to introduce the option of a prison sentence and see this progress report as supporting that goal. We will continue to raise awareness and we will encourage and work with any organisation that wants to raise standards or produce clear guidance on data protection obligations. In particular we will be working closely with the media on the development of relevant guidance and standards for journalists.”

5. What Price Privacy? The reaction of the PCC and the editors

5.1 At this point it is appropriate to return to the dialogue between Mr Thomas and the PCC whose ‘formal response’ had been to direct the ICO to the Editors’ Code Committee while noting that the issue had become ‘complicated’ by the publication of the DCA consultation on s55.

5.2 On 21 September 2006, Mr Thomas met Ian Beales, Secretary of the Editors’ Code of Practice Committee. Mr Thomas described the meeting in his internal note as ‘interesting and intelligent’.¹¹¹ In addition to the established themes of louder condemnation of unacceptable practices and suitable amendments to the Code, Mr Thomas was explicitly now also looking for ‘better awareness of s55’ from the industry. S55 was evidently the dominant theme in the event, Mr Thomas with a degree of understatement indicating that “support for the prison sentence would be welcome, but I did not expect that” and Mr Beales dismissive of the DCA paper and stressing the ‘chilling effect’ of the proposal. Mr Thomas had proffered some proposed Code changes of his own but came away from the meeting largely empty handed.

5.3 On Mr Thomas’s account, Mr Beales’s position was simple: “his main difficulty is that there is not much incentive to improve the Code unless the threat of increased penalties disappears at the same time”. If accurately represented, this is a somewhat remarkable position to adopt: the offence contained within s55 was the law and contained within it a defence for journalists acting in the public interest. A Code of Conduct should surely provide the very best guidance it can and it is difficult to see why there needs to be an incentive to improve it.

5.4 In any event, the press had fully subsumed the dialogue between the ICO and the PCC into its own political campaign in opposition to reform of s55 and it may be legitimate to infer the extent to which Mr Thomas had accepted that reconstitution of the agenda: his note suggests that the talk of producing joint guidance was now explicitly in terms of ‘better section 55 guidance’ rather than anything more generally addressed to the culture, practices and ethics of the press in the handling of personal information.

5.5 On 27 October 2006, there was a follow-up meeting (at NI’s Wapping premises): the Committee Chairman Les Hinton, and Stephen Abell from the PCC also attended. The note of that meeting suggests that Mr Hinton made plain from the outset that the Code Committee had no mandate to take a position at that point but was considering its response to What Price Privacy?.¹¹² The conversation appears to have amounted to a further turn around the familiar course but with Mr Thomas now leading on s55. Dealing with the ‘illegal trade’ needed tougher sentences, but these were not targeted at journalists (who in any event had the protection of special exemptions), he was seeking co-operation with guidance and code revisions as a means of addressing journalism’s contribution to the demand side of that illegal trade. Mr Thomas had evidently responded to the industry’s elision of the PCC dialogue and the s55 campaign, not by attempting to return the dialogue to its original broader purpose but by accepting the redrawn terms of reference and trying to argue his side of that debate.

5.6 Mr Hinton’s response, however, is illuminative of the distance this dialogue had shifted from the original sceptical but pragmatic tone of the PCC in the opening stages of the encounter. Not only did he deploy the familiar challenge back to the ICO on the question of regulatory inaction, and the clear statement of objection to the s55 campaign, cast in the language of the chilling effect on journalism, but he moved the counter-attack on to the territory of the principles of press self-regulation. Mr Thomas records the Committee representatives as having:¹¹³

“expressed the view that a prison sentence would undermine the effective operation of the PCC as legal advice is likely to result in journalists not cooperating with PCC investigations in case they incriminate themselves. In addition explicit inclusion of offences in the code would need to be investigated by the prosecuting authority not the PCC effectively taking that provision outside of and therefore undermining the self regulatory model.”

5.7 In a contemporaneous handwritten note by Mr Thomas,¹¹⁴ the words ‘last chance saloon’ appear. At one stage earlier in the dialogue, Mr Thomas appears to have deployed an intimation that the credibility of the PCC as a ‘self-regulator’ was at stake in response to the action he sought from them in the aftermath of Motorman. If he was seeking to deploy it again in the highly-charged context of the s55 debate that was undoubtedly a high-risk political strategy, and Mr Hinton’s response would be to a degree less startling. Needless to say, Mr Thomas emerged from that meeting empty handed again. Mr Hinton’s follow- up letter of 17 November was more positive in tone, but non-committal as regards further industry action.¹¹⁵

5.8 It was now fully three years since Mr Thomas had moved to open a dialogue with the PCC, during which period he had identified himself very personally with the conduct of that relationship. The return on that significant personal investment was not evident. But even now, at a point which might be described as open antagonism, there was no evidence that he sought to reappraise his approach. It is possible that one effect of the elision of the PCC and s55 strands of his strategy had been to reframe the former not as a practical end in itself but, by keeping open a channel of communication, as a means of furthering (or at least seeking to manage opposition to) the latter. At any rate, Mr Thomas persisted in it.

5.9 What Price Privacy Now? provided some public comment on the interaction between the ICO and the PCC, thereby to some extent setting the agenda for its future interaction. It also records an understanding that the PCC ‘monitors and adjudicates on disputes about breaches of the Editors’ Code of Practice, which sets out the conduct the press have agreed to follow as part of a self regulatory system’.¹¹⁶ The progress recorded was, however, relatively modest and is in these terms:

1. The PCC had confirmed publicly and in writing that journalists must act within the law.
2. It had agreed to keep repeating that message – and the ICO “hopes that this will be done as loudly and actively as possible”.
3. There had been discussion about Code amendment relating to the acquisition of personal information – “unfortunately, however, no concrete proposals have so far been brought forward”.
4. The Code Committee had rejected the ICO’s own suggested amendments, but had agreed to keep the matter under review.
5. There was agreement in principle to the issue of “guidance for journalists” by the PCC with ICO assistance.

5.10 On 4 January 2007, there was a further meeting with Murdoch MacLennan (then Chief Executive Officer of Telegraph Media Group) and Guy Black, both by this stage leading actors in the s55 counter-campaign. On Mr Thomas’ account,¹¹⁷ the agreed action points were that the ICO should prepare guidance on s55 and the public interest defence with a view to helping journalists to navigate it. It is notable, first, that the focus appears to have swung fully around from the industry representatives being asked to take action to change the culture, practices and ethics of the press, to the regulator being asked to clarify the law and his approach to regulation. Secondly, this appears, in itself, to have become part of what was, by now, a three- way negotiation on s55 between the press, the government and Mr Thomas.

5.11 The course of that negotiation is set out more fully in that part of the Report that deals with the relationship between the press and politicians.¹¹⁸ It culminated in a compromise arrangement whereby a custodial penalty for s55 was finally introduced by the Criminal Justice and Immigration Act 2008,¹¹⁹ together with an enhanced, more subjective defence for journalists, but neither provision was commenced as operative law; commencement relies on the exercise of an Order-making power which has not to date been exercised. At the same time, further desultory exchanges were continuing between Mr Thomas and the PCC. By letter of 27 March 2007, the Code Committee eventually rejected the amendments to the Code that he had proposed, but suggested some alternatives.¹²⁰ The ICO responded on 16 April, accepting the changes on the basis of a “hope that they will be introduced with maximum publicity and advice to the media. Otherwise, the ‘burial’ of the changes within the existing Code, and the absence of a section explicitly prohibiting the obtaining of any private information without consent or a public interest justification, may present the risk that unacceptable activity will continue.” There is no indication that the ICO saw itself as playing a direct role in publicity and advice to the media. The letter reaffirmed the ICO’s commitment to the s55 campaign and to producing guidance on s55 for journalists.¹²¹

5.12 On 25 April 2007, there was a further meeting with Guy Black and colleagues from press representative bodies to discuss ‘stakeholder engagement’ and the preparation of the guidance. It seems to have been inconclusive. The press representatives saw their role in relation to the guidance as ‘supporting and commenting and they do not envisage a jointly badged product’; the ICO undertook to shorten and simplify the latest draft of the s.55 guidance.¹²² A new version was worked on over the late spring and summer of 2007. Work also began within the ICO on a draft statement of prosecution policy on s55, designed to provide a measure of reassurance to the press as the ICO continued its campaign for custodial penalties over the first half of 2008.

5.13 An insight into the extent to which Mr Thomas had become very personally engaged in the politics of the passage of the relevant provisions of the Criminal Justice and Immigration Bill can be gained from some of the contemporary documentation which he provided to the Inquiry. In February 2008, the ICO prepared a draft report to Parliament in response to its apprehension that the amendment would be withdrawn by the Government in the face of press-sponsored opposition¹²³ as well as briefing for Ministers and recommendations for Parliamentary handling.¹²⁴ It also shows Mr Thomas directly lobbying the Government against withdrawal of the amendment in terms which included:

1. urging that ‘withdrawal would damage the reinvigorated credibility and authority of data protection law and the Information Commissioner’s Office’;
2. an intimation that withdrawal would ‘sit strangely’ with the Government’s legislation on identity cards;
3. the anticipation of support in a number of outstanding Select Committee Reports;
4. ripostes to the press campaigning;
5. averring a determination on his own part to stop the pernicious, largely hidden and illegal market in personal data; and
6. a conclusion, ‘with considerable reluctance’ that he would respond to withdrawal by laying a further specific report before Parliament.¹²⁵

In due course, Mr Thomas met the Prime Minister, preparing for an agreed role in the continuing political negotiations between the Government and the press. He said that ‘the PM started by saying that I had the most difficult job in the country ’.¹²⁶

5.14 It is noteworthy that Mr Thomas was placing no (other) operational action by the ICO into this political arena. There was no proffered action plan for the means by which the ICO would structure its priorities and operations so as to ensure that the legislative change would, indeed, stop the trafficking of confidential personal information. The assumption appeared to remain that the change in its own right, and the accompanying publicity for the role of the ICO in promoting that change, would be effective in themselves. An internal note of a meeting that Mr Thomas had with senior officials from the Ministry of Justice (the successor department to the DCA) is illustrative of the way he was thinking.¹²⁷ As well as offering an assessment of the party politics of the Bill’s provisions, he described his likely public reaction to a then-current possibility to change its provisions significantly in favour of the press. It would, he said, be “nuclear”

“I said it would be very noisy and very messy. We will publicly denounce any such attempt. If we lost, we would publish a third report to Parliament, documenting how this state of affairs had come about.”

5.15 Suggestions that the press might finally take steps of their own (such as amendment to the Code, training and guidance) to address the extent to which their own culture, practices and ethics were in issue were now dismissed as ‘too little, too late’. Only a change in the law would do. To that end, Mr Thomas wrote to selected high profile opposition politicians (including the Conservative and Liberal Democrat leaders) as ‘a warning shot across the bows of those who might be wavering and as an encouragement to potential supporters’ and planned press releases and a public media initiative.

5.16 This was not a regulator simply enhancing public debate from an expert point of view. Mr Thomas himself described it as ‘playing hard ball’¹²⁸ or, in other words, full-blooded political campaigning. As noted above, the issue was settled for the time being by the compromise solution of legislation for custodial penalties (along with an improved defence) which was not then and has not since been commenced. At the same time, correspondence continued with industry representatives over the summer of 2008 about the publication of guidance and the promotion of awareness.

5.17 About the compromise solution on s55, Mr Thomas himself said this:¹²⁹

“This was clearly the end of this particular road. I saw the compromise in “half a loaf” terms and – although very disappointed – recognised that it would still serve some deterrent and awareness-raising purpose, though less direct or powerful than originally envisaged.”

5.18 Reflecting more generally on his interaction with the PCC, Mr Thomas referred many times to an overall sense of disappointment. This is important commentary and it is worth setting some of them out in full.

“I think over time I was somewhat disappointed. Although I don’t decry everything they did, it fell short of what I’d hoped they might be doing.”¹³⁰

“The evidence shows that I went back a number of times to the PCC throughout 2005, 2006 and 2007, and tried to keep – engage their interest with it. But it is true to say that I thought their response was less strident and I think I used the word “disappointing” more than once in this context. I thought they could and should have done more.”¹³¹

“We thought and had some hopes that the PCC would be a better way of addressing the problem than anything to do with [pur]suing the prosecutions, which we were, at that time, recognising was going to be very expensive and demanding for the office. Now, with hindsight, I think I would have been more aggressive and more assertive with the PCC and with the Code at the outset, and they did disappoint me, as I said, in terms of their response.”¹³²

“Overall – with only the limited progress recorded on page 19 of What Price Privacy Now? – I was disappointed by the response from the PCC and the Editors’ Code of Practice Committee before and during 2006. I had hoped for much stronger and louder condemnation of wholly unacceptable misconduct, an explicit change to the Code, and more focussed guidance. Instead, there seemed to be a “Catch-22” view that the conduct was already illegal and that therefore not much – if anything – could be done by way of self-regulation. The exchanges did lead to guidance (with which the ICO assisted) on data protection law at large and some discussion about possible changes to the Code, but this increasingly seemed directed as much as heading off tougher sentences.”¹³³

5.19 Notwithstanding all of this, Mr Thomas made clear his view that his strategy (that is to say, the continuing dialogue with the PCC, publication of his two reports to Parliament, and getting the law changed, despite the non-commencement of the changes) had proved to be very effective, at any rate in relation to the press.¹³⁴ His grounds for saying so come down to what he claimed was the lack of evidence of criminal conduct within the press postdating 2006:¹³⁵

“I am not saying it’s been eliminated altogether – this is under the surface, clearly – but I am saying – and my successor has said this to Parliament very recently, in October of this year [2011] – that it appears that the press are now behaving themselves in this particular area.”

5.20 Such empirical evidence as Mr Thomas offers for this conclusion appears to amount to accepting the word of the industry.¹³⁶ Without asserting the contrary, absence of evidence that undermines that assertion is not the same as saying that there is evidence that it is so. In the circumstances, it is necessary to consider the claims made by Mr Thomas for his strategy in general and to examine the paths that the ICO chose not to follow in parallel and, from there, to review whether, in more recent times, the press has, in fact, ceased to be any real source of interest to the ICO.