OTHER POSSIBLE REGULATORY OPTIONS
1. Criminal proceedings in respect of journalists
1.1 No journalist was ever subject to prosecution as a result of Operation Motorman. Indeed, the ICO never got as far even as interviewing any journalist in connection with examining the possibility of criminal proceedings (however limited the value of doing so might have been). There is considerable dispute as to why that happened.
“informed that we were not to make contact with any of the newspapers identified and we were not to speak to, let alone, interview any journalists. Despite our protests we were told this was the decision of Richard Thomas and that he would deal with the press involvement by way of the Press Complaints Council. It was at this moment we knew no journalist could or ever would be prosecuted in relation to our investigation. No journalist or Newspaper Group was ever spoken to by anyone from the Information Commissioner’s Investigations Unit in relation to Operation Motorman. We also now knew that one of the major questions that needed to be asked but could never be asked, let alone answered was ’Why did you want all these ex-directory / mobile / family and friend telephone numbers and most importantly what were you doing with them?’”He was, he said, given to understand that the focus of continuing criminal investigation was to be exclusively on the private investigators, the blaggers and the corrupt officials and employees:2
“Basically they’d drawn a red line, with the press and the reporters above that line and we dealt with anything below that line.”
1.3 He described the way in which the team continued to prepare papers for conspiracy charges in respect of the remaining defendants (specimen charges relating to breach of s55 of the Act), interviewed some 50 to 60 victims and (under caution) all persons suspected of the unlawful obtaining, disclosing or blagging on behalf of Mr Whittamore. This material was passed to the ICO legal department for action and, by February 2004, the work was completed. He described having attended a conference with external counsel, in October 2003, in order to consider the weight of the evidence, and the written advice received that December which supported taking forward the conspiracy charges. counsel also directly addressed the question of criminal proceedings against journalists, advising:3
“Having regard to the sustained and serious nature of the journalistic involvement in the overall picture, there can be little doubt that many, perhaps all, of the journalists involved have committed offences. “The inference, overwhelming, it seems to me, is that several editors must have been well aware of what their staff were up to and therefore party to it. I understand that policy considerations have led to the view that enforcement of some sort rather than prosecution is the way forward in respect of the journalists/newspapers. “I understand and sympathise with that approach. This is, I believe, the first occasion upon which the scale of the problem has come to light and it may not be unreasonable to give the Press Complaints Commission the chance to put their house in order.”
1.4 On the basis of that policy, counsel considered whether journalists or editors should be cautioned in the light of the evidence of the extent of their involvement and the ‘often unpleasant’ nature of the offending. He also registered a measure of anxiety about taking forward the conspiracy charges to the exclusion of press defendants:4
“Those defending in the prosecution might seek to make capital from the fact that the journalists are not being prosecuted. The judge might also comment on the basis that the journalists are the ones (it seems) who created the demand for this offending. With this in mind, it is a sensible precaution to equip me at some point before trial with the detail of the reasoning not to prosecute. I may need to explain or even defend the decision to the judge.”
There is no evidence that a detailed statement was in fact produced.
“we received no feed back whatsoever as to what action was being taken in relation to the press’s involvement. On those occasions we did ask the question the only response we received was that ‘Richard [the Commissioner] was dealing with it’.”
The prosecution was ultimately conducted by the CPS and he describes how the ICO was neither formally aware of or involved in the prosecution of Mr Whittamore; the next they heard, in April 2005, was that he had been conditionally discharged by the Crown Court at Blackfriars. Mr Owens left the ICO at around this time, with, he said, unanswered questions about what if any action had been taken in respect of the press, and why such prosecution as had proceeded seemed to have involved Mr Whittamore but none of the other conspirators. He concluded that ‘something had gone drastically wrong with the prosecution case’, producing an outcome which did not begin to do justice to the Motorman material.6
1.6 On Mr Owens’s account, therefore, the suggestion within the Motorman material of prima facie criminality within the press could and should have been taken forward to prosecution. He said “we were in a position to prosecute everyone in the chain from the ‘blagger’ right up to the journalists and possibly even the newspaper groups”.7 However, he said that the intervention of a policy decision by Mr Thomas to proceed with the matter himself and exclusively in dialogue with the PCC as a result of, or additionally because of, a reluctance to engage directly in enforcement action in relation to the press prevented this from happening.
1.7 This account was vigorously disputed by both Mr Aldhouse and Mr Thomas. The evidence of Mr Aldhouse was that there was no policy, or none that he was aware of, of holding back from the prosecution of journalists. He was clear that he was not involved in the operational decision-making at all; however, if he had been asked, he would have considered that there was indeed a case for taking the involvement of journalists and newspapers in criminal behaviour further. Nor would he have thought resourcing problems a conclusive argument against doing so: he thought that it would have been possible to have discussed the possibility of supplementary funding with the sponsoring government department. But he did not apply his mind to such considerations at the time; it was not his place to do so. He was aware of a measure of frustration in the investigations team that no action had been taken in relation to the press, and of some discussion about the disappointing criminal process in the office, but could recall no detail.8
1.8 Mr Thomas also denied any positive policy decision or instruction being given not to proceed with criminal investigations into press conduct. This denial was emphatic and can be enumerated:
- “there was no such policy decision, certainly not at the early stage”;9
- “[it] is possible that Mr Owens has somehow confused or conflated all the dates and interpreted that [Mr Thomas going to the PCC] as some sort of policy or some sort of instruction, but that was not the case”;10
- “[if] there was a policy, it was not one which I had any hand in, one which I knew about, which I made or which I was told about”;11
- “as far as I’m aware, there was absolutely no such policy and I can’t think why there would have been such a policy”;12
- “what I’m trying to say – and I hope I’m coming across very clearly – is that there was no policy from the outset that we weren’t going to go against the press”;13
- “Q: Your evidence is that the policy steer didn’t come from you? A: Absolutely not”;14
- “there is clear evidence that there was not a policy conclusion even at that point [the approach to the PCC]”;15
- “I don’t accept that there was a policy decision. I don’t accept that we abandoned the possibility of prosecuting journalists.”16
1.9 Indeed, Mr Thomas was insistent in his evidence that there was no ‘conscious decision’ at all not to prosecute journalists.17 He explained that in two different ways although, on the face of it, these are not entirely straightforward to reconcile. He said both that he assumed that in fact the office was making progress with the prosecution of journalists as they would with any other criminal investigation,18 and also that there was an active plan to keep the option of prosecution alive but to wait and see first how the conspiracy prosecutions being undertaken by the CPS fared, and in due course, if all went well, to activate them.19
1.10 Taking the second of these first, the problem with any ‘wait and see’ strategy was articulated by Mr Owens. He described his response to the way in which the discontinuance of the criminal proceedings for conspiracy was described in What Price Privacy? in the following terms:20
“This was a great disappointment to the ICO, especially at it seemed to underplay the seriousness of section 55 offences. It also meant that it was not in the public interest to proceed with the ICO’s own prosecutions, nor could the Information Commissioner contemplate bringing prosecutions against the journalists or others to whom confidential information had been supplied.”
“It may be correct in relation to the others, you know, the blaggers and the thing, but you could never go back after three years and contemplate prosecuting journalists. They’d never even been investigated. And I – there’s enough legal people here to know if I – I kept evidence – you can’t put – if you have a conspiracy, you can’t put five people on the back-burner and wait and see how you got on with the same five people in the front that’s getting prosecuted, because you got a good result, right, we’ll go and prosecute them as well. Well, they’re all part of one conspiracy. You either investigate them all, or those five you have to say we’re not going to investigate them which means we’re not going to prosecute them. I don’t know whether that would be - is the correct word abuse of the justice system?”
1.12 In my judgment, as a matter of criminal process, the proposition that the journalists were not investigated because there was a deliberate strategy which had been thought through (in the light of evidence that was known about and understood) simply to see how the prosecutions against the ‘middle men’ went before proceeding against the press is neither credible nor sustainable. In any event, there is no contemporaneous evidence that this was indeed the strategy. This is very different from a decision not to proceed for good operational reasons, followed by a later re-evaluation.
1.13 The other argument advanced by Mr Thomas was that there was indeed an active policy to pursue criminal inquiries into the activities of the press, but that they ran their operational course to no effect. He suggested a number of operational reasons for the ICO not, in the end, proceeding with criminal proceedings in respect of the press. They included:
- the inevitability that severe and disproportionate logistical difficulties would be faced, including the commitment of significant resources;22
- legal uncertainty about the difficulty of proving ‘procuring’ of disclosure by the press (which would require establishing knowledge or recklessness about the lack of the individual’s consent) and about the possible deployment of public interest defences by journalists;23
- an understanding that Mr Owens’s extended sick leave and anxieties about his reliability as a witness, influencing legal advice to withdraw from prosecution action;24
- a strategic view that it would be preferable to defer conclusively to the CPS prosecution of the corruption cases, “giving precedence” to the corruption proceedings because they were “more serious” and carried higher sentence maxima than the cases which the ICO could prosecute;25
- a strategic preference for proceeding against the ‘middle-men’, at the heart of the organised trade in confidential personal information;26
- the ‘perversity’ of the outcome in the Whittamore prosecution: the conditional discharge was a reason any further prosecutions would not be in the public interest, and in particular “completely extinguished any possibility whatsoever of prosecuting journalists”;27 and
- a sense that “any formal action, particularly a prosecution, was likely to be, if you like, that much more difficult because there will be less sympathy for the celebrity.” This is a jury point, perhaps, about the unattractiveness of bringing cases in respect of celebrity victims who might, however unfairly, be considered to have compromised their own data protection entitlements.28
1.14 The difficulty with any or all of these explanations is that, on Mr Thomas’s own account, the Inquiry saw no evidence that at the time the ICO went through a strategic decision-making process which actively considered any of these points and reached a conclusion on them. There clearly would have been the need for major decisions to have been taken one way or the other about the allocation of resources, significant operational planning and close liaison with the police and the CPS. There is no evidence that any of this happened. On the contrary, the best evidence available to the Inquiry suggests that:
- there was prima facie evidence of criminal behaviour by journalists;
- this was investigated up to a point within the ICO by paper analysis and by interviewing a selected group of victims;
- external counsel encouraged the view that the evidence of criminal conduct by journalists was persuasive and that there were merits in taking the matter further; but
- the matter was not taken any further by the ICO in relation to data protection offences, not even to the stage of approaching a single journalist either to be interviewed or for a statement.
1.15 Mr Thomas was either unaware that the matter was not proceeding within his office, or aware of it without challenging that state of affairs. Either is problematic. The first suggests a disconnection from one of the biggest operational cases the ICO ever dealt with to a degree which is difficult to understand. After all, this was a case on which he himself spent many years pursuing at a strategic and political level. There was this exchange:29
“Q. When the prosecution started, there were no journalists there. Did you not think about that?
A. I wasn’t involved in these meetings.
Q. No … not the meetings, but you were alert as to what was going on with the prosecution process?
A. Only in very general terms and I have no recollection.”
At the very least, the second explanation raises questions about the extent of the interest that Mr Thomas had in this aspect of the enforcement of the data protection regime notwithstanding the extent of the abuse revealed by Operation Motorman.
“May I try and sum up the position in this way? Given two facts which we know, Mr Thomas – the first fact is that the journalists were never interviewed by your office and the second fact is that such an interview would be a sine qua non to a prosecution, out of fairness to the journalists on the one hand, in order to obtain further evidence - does it not follow that either there was a policy decision not to pursue that course or, alternatively, there were operational failures or decisions by the investigators not to carry out an elementary step, namely to interview?”
1.17 Mr Thomas challenged that dichotomy, but only by way of suggesting that an alternative was the ‘wait and see’ policy which is not, itself, obviously compatible with an omission to interview any journalist in a timely fashion. Mr Jay therefore put the analysis to him even more directly:31
Q. “So at the moment I am thrashing around mentally to see what other alternative there might be beyond a policy decision on the one hand or incompetence in your investigation officers on the other.”
A. “Well, if you want to put it in those terms, I have to put it to the latter, but I am absolutely – you know, absolutely clear because I wouldn’t have done any of the things I had done right through 2005, 2006, 2007 if I had thought at any time that I or anybody else had said: ‘Back off the journalists’.”
1.18 This is an answer which has difficulties at many levels and, in fairness to Mr Thomas, may not bear too close an analysis. As between a policy or an operational failure there are perhaps levels of intermediate gradation. It is, however, necessary to take stock of the issue of non- prosecution of journalists by the ICO.
1.19 In the first place, it does not seem that there need have been any reason from the outset for the ICO not to have proceeded down the path towards active pursuit of prosecution. Mr Jay put it this way:32
“But if all one needed to do: “Let’s cherry pick the best cases of illegality. The friends and family cases, the one or two police national computer cases. We’ll interview the journalists in those cases. We might interview the editors.” That is a fairly narrow exercise. You can then assess how strong the case is. After all, if the evidence is strong enough, you might even get guilty pleas. Who knows?”
1.20 Alotof evidence was available, and a good deal of work was done in the early stages. Mr Owens took the point that it might not have required a huge amount of delving and interrogation by him in relation to the relevant journalists to get the answers he needed to the questions in his mind (which principally concerned why they wanted the material). Some might have declined to answer; of those who answered, some answers might have incriminated journalists, others might have exonerated them.33 But the questions were never asked. It would not have been operationally impossible, and ought perhaps to have been operationally rather attractive, to have proceeded in the way Mr Jay hypothesised. But there was no indication that this was ever contemplated, far less attempted.
1.21 In the second place, although I recognise that the conditional discharge imposed on Mr Whittamore meant that there was little practical prospect of resuming criminal investigations in relation to the press for the reasons outlined above, such an outcome was hardly possible to foresee. The record that the ICO made of the hearing before His Honour Judge Samuels QC in the Crown Court at Blackfriars in April 2005 (including his sentencing remarks)34 does not on the face of it even support the proposition that the prosecution of journalists was out of the question following the conditional discharge of Mr Whittamore.
1.22 From this note, it is possible to derive the following propositions:
- The sentence in this case was clearly to a degree based on the particular position of a co-defendant (previously sentenced in ignorance of this prosecution) and the unchallenged personal circumstances of Mr Whittamore who was described as of previous good character; in a state of depression; ‘reclusive’; ‘probably a broken man’ of limited means, unemployed and effectively unemployable in his previous line of work.
- There were procedural considerations militating strongly in favour of a swift disposal of the case.
- There is no indication at all that the sentencing judge considered the offending behaviour not to be serious in nature; on the contrary, he observed: “The vice of the primary conspiracy was to make known to the press information which on any view ought to have been confidential … I refer to the vice and I do so again as a warning to others; others cannot expect leniency as seen today.”
1.23 To be fair to Mr Thomas and the ICO, it is right to record that there were some issues about the nature and extent of the co-operation between the ICO on the one hand and the police on the other. Mr Owens said of the prosecution:35
“We had never been advised that the matter was due before the courts. We were never given the opportunity to attend even though we had been the investigating officers and were never given any details of what had happened in relation to all the other defendants we had anticipated would be jointly charged with Whittamore for conspiracy… we did hear that there had been some conflict between the ICO legal team and the Crown Prosecution Service/Metropolitan Police…”
“I also understand that there was a feeling that the prosecutor had not accurately conveyed some of the material to the court vis-a-vis the journalistic aspect, and I can’t turn it up straight away now, but some of the notes you’ve had from the ICO’s legal file indicated that the barrister for the CPS had not perhaps conveyed the full picture. We’d sort of – if you like, were not actively engaged or involved in that.”
1.25 It is neither possible nor necessary to reach any conclusion about the extent to which a failure of liaison impacted on this prosecution, although a close and mutually supportive relationship between ICO, police and CPS in this type of case is clearly important.
1.26 Putting to one side the issues which flow from a consideration of the result of the prosecution, and reverting to the initial decisions, the conflict between the investigator, Mr Owens, and Mr Thomas remains real. Mr Owens bluntly put the matter in this way:37
In conclusion I would summarize by saying it is my opinion that:
- ICO’s decision not to investigate any journalist in relation to Operation Motorman was a wrong decision.
- This decision was certainly not based on any advice given by counsel or on any lack of evidence, as ICO would have everyone believe. The decision had been made long before the involvement of any Counsel or opinions being requested and there was overwhelming evidence that many of the journalists did know or at least should have known the information they were requesting could only be obtained illegally and what they were requesting was not for a purpose which would carry any form of ’public interest’ defence.
- The decision not to pursue any journalist was based solely on fear - fear of the power, wealth and influence of the Press and the fear of the backlash that could follow if the press turned against ICO.
- The publication in May 2006 of ’What price privacy’ was no more than an attempt to lock the stable door after the horse had bolted in an effort to cover up the fact that ICO had failed in its duty to conduct a full and proper investigation into the conduct of journalists at the time when they could and should have.
Throughout the whole of the time the Motorman investigation was ongoing there was never any mention or suggestion of any report being commissioned for Parliament. I feel it was no coincidence that this report was not published until May 2006, only a few weeks before the Mulcaire scandal broke. It is my belief that when ICO became aware that the Metropolitan Police were conducting yet another investigation involving more wrong doings by the Press, they decided to pre-empt and deflect any criticism which was bound to be directed towards them in relation to their lack of action against the Press in Operation Motorman.
All the evidence published in this report had been gathered and had been available since March 2003, so if as David Smith stated, again in the Panorama Report, ICO wanted to send “an effective and final warning” then why did it take over three years to prepare it, and not publish it until 13 months after the prosecution against Whittamore had concluded.
1.27 These are stark allegations, which Mr Thomas firmly invited the Inquiry to reject. One of his reasons was that Mr Owens’ evidence must be regarded as unreliable as he had parted from the ICO on unhappy terms and that must be taken to have clouded his judgment on this matter. However, insofar as this Report comes to any conclusions on these issues it does so on their own merits rather than on the basis of speculation by Mr Owens on matters not within his personal knowledge. On the other hand there is no reason to doubt that Mr Owens’ evidence was, at least, an authentic description of his own perspective. Furthermore, it cannot be overlooked that, by their own accounts, the senior management of the ICO had placed Mr Owens and his immediate superior in a position in which their perspectives were operationally determinative: it was a matter for them.
1.28 I start from this proposition. The evidential ‘treasure trove’ of the Motorman material, the questions of public interest and of the integrity of the data protection regime, the seriousness of the breaches of trust evidently involved and the potential harm occasioned to a very large number of individuals all make it very hard to reconcile the evident lack of analysis or a discernible action plan in the ICO for consideration of criminal investigations into press misconduct. Whether, in the end, the decision was taken to pursue those investigations or not, the matter should have been consciously and conscientiously considered and decided upon from an operational and strategic point of view. The decisions should have been reasoned and recorded. The evidence is that this did not happen. It is possible (although I do not say more) that a significant opportunity was thereby lost to challenge and check elements in the culture, practices and ethics of the press that were insufficiently mindful of the law, the rights and entitlements of individuals, the public interest and the obligations of good practice.
1.29 Before reaching any firm conclusions, however, it is also necessary to provide the context of the alternatives available to the ICO, the choices made and the outcomes in practice. Mr Thomas said:38
“it’s important to record that prosecution is not the only way to deal with a particular problem.”Operation Motorman was clear evidence of a problem in the culture, practices and ethics of the press. It was not dealt with by criminal investigation and prosecution. The ICO was, on its own account, not primarily a prosecuting authority; it was a statutory regulator, provided with a range of standard regulatory powers and had a range of other powers and operational choices available.
1.30 Mr Thomas shared with the Inquiry the thought that there might even have been a causative relationship between his understanding from his staff that the prosecution of journalists was not a plausible option, and his decision to take the matter to the PCC. He accepted that thought was to a degree ex post facto rationalisation, and it is not certain from the chronology that it can have been the case (he also said elsewhere that the reason he refused to go into operational detail with the PCC was that the prosecutions were still “under way.” )39 But, in the light of the eclipse of the prosecution option, the way he put the position of the ICO in relation to what the evidence discovered in Operation Motorman revealed about the culture, practices and ethics of the press must surely be regarded as authentic:40
“We can’t leave it there. We must do something.”The ‘something’ in Mr Thomas’s mind was his twin-track political strategy. But the question also has powerful operational resonance. If the ICO was not to tackle the press by the route of criminal investigation, the ‘something’ else must be considered.
2. The use of regulatory powers
2.1 One of the striking features of the narrative that started with Operation Motorman is that neither during the criminal investigation nor at any time thereafter does it appear that there was any evaluation of alternative operational steps which remained available. On the contrary, the ICO appears to have put faith only in prosecution and the twin track strategy championed personally by Mr Thomas. However, the ‘treasure trove’ of material gave rise to a number of important operational issues and permitted a variety of regulatory responses.
2.2 There was certainly the question of future deterrence, which featured so prominently in Mr Thomas’ campaign. There was also the wider operational question already noted: it was unlikely that Mr Whittamore was the sole operator in this evidently lucrative market, so how big, in fact, was the problem? This was something to which only the press, as drivers of the market as evidenced by the Motorman material, were likely to be able to provide a clear answer.
2.3 There were issues at a more specific level as well. The Motorman material suggested that the press was in possession of a quantity of material in breach of the data protection principles and of the rights of the individuals involved. If their acquisition of that material was unlawful, then their continuing holding and use of the material was likely to be unlawful and unfair also. Motorman raised questions not merely of past illegality (obtaining the information) but of present and continuing illegality.
2.4 That, indeed, was the distinguishing feature of the role of the press in the narrative. The blaggers and the corrupt officials and employees could be identified and their practices terminated. But, unless they had taken active steps (which might include destruction) in relation to the personal information, the press were likely to be persisting in conduct unlawful under the data protection regime on a daily basis. Even holding information unlawfully and unfairly is a potential breach, whether or not accompanied by further breaches, intended breaches, or indeed any further plans or actions at all. Every day which passed raised acute practical and operational issues in relation to the press. How much personal information were they holding unlawfully, and how should the situation be remedied and lawfulness assured? These issues were live and acute, and not even prosecution of the press would have been a complete answer to them. Although criminal investigation would have got to the bottom of the specimen cases pursued and no doubt would have had a salutary chilling effect of some sort on unlawful practice, it could never have been the thorough-going systemic look at the Motorman material in the hands of the press, nor the systemic rectification of any continuing unlawfulness, which the evidence required.
2.5 The seizure of the Motorman material was, in other words, a very major case of the sort which statutory regulators are created (and given practical powers) to deal with. The press were under continuing legal obligations to consider what steps were needed to clean up their own operations from the products of the unlawful trade in personal information. Even if defences may have been available in some cases to criminal charges, a significant number of questions would have been outstanding as to the extent to which the press had complied with their civil legal obligations and with standards of good practice under the data protection regime.
2.6 It is therefore significant that Mr Thomas confirmed that the ICO did not, at any point, come close to considering the use of the civil enforcement powers at their disposal either to seek further information from the press or to require them to comply with the data protection regime. Evidently, “some sort of passing thought was given to it but nothing materialised”. That was for two principal reasons. The first was that these powers were, in any event, rarely used. The second was that “everybody knew that to a very large extent the powers of the office were very constrained indeed when it came to dealing with the media”.41
2.7 It is evident, as considered at the outset of this Part of the Report, that there were questions about the operational experience in the ICO at the time of the deployment of its formal regulatory powers, and particularly so in relation to the press. That is further considered below, as is the question whether the investigative and enforcement powers of the ICO in relation to the press were, indeed, as a matter of law insufficient to allow the questions raised for the press by Motorman to be effectively tackled by the regulator.
2.8 At this stage, it is sufficient to articulate the following concerns:
- The Inquiry saw no evidence that any of these matters were the subject of serious consideration within the ICO.
- The Inquiry received a quantity of evidence as to how far the Motorman material could be considered prima facie evidence of criminality on the part of journalists (not least because of the question of intent), but it is not credible to argue otherwise than that it was prima facie evidence of extensive unlawful and unethical data protection practice.
- Whether the press would have had an answer to that prima facie unlawfulness certainly fell to be considered and, to such extent as it did, so the evidence is that the ICO was of the view that that was highly unlikely to be the case.42 The substantive exemptions from the principles and rights of the data protection regime in favour of the press may have been extensive, but they were not limitless. It was not open to the ICO on the evidence of the Motorman material to conclude with any confidence that the press had been acting within its rights so far as personal information privacy was concerned.
- The procedural hurdles standing in the way of formal proceedings by the ICO against the press may have been daunting – but it is not credible that Parliament intended them to be insuperable. If ever an operational data protection issue arose where active contemplation of regulatory action in respect of the press presented itself (I put it no higher), Motorman was surely that case.
- Not only was there no evidence that serious operational attention was given to these issues, either at the time or at any point since, it is noteworthy that at no stage since the Motorman material was found has the ICO raised as an issue the sufficiency of its powers to tackle breach of the data protection regime by the press.
2.9 In relation to this last point, at no point during his long campaign on custodial penalties did Mr Thomas seek reform of the provisions applying the civil law to the press. The present Information Commissioner, Christopher Graham, does not do so today. That left the Inquiry with the question of whether the powers available to the ICO were in fact adequate for the task of pursuing with the press the continuing operational issues raised by Motorman, but were neglected by the ICO; or whether they were inadequate, and the ICO has chosen, for whatever reason, not to draw attention to their inadequacy. Both Commissioners have strongly argued on these points that they have other priorities and that, whatever the legal position, it would not have been right for them to place the practices of the press among those priorities. I reflect on that in due course.
2.10 Not for the last time in this Report, a haunting question asked by Mr Owens arises. He described himself musing on the operational implications for the press of the Motorman material in this way:43
“It’s our job to take them or indeed anyone else on, that’s what we are paid to do. If we do not do it, then who does?”The question is even more pertinent in relation to civil law enforcement under the data protection regime than it was to the question of prosecution. The CPS can always take prosecution decisions (including in relation to s55) and consider the matter from the perspective of the totality of any apparent criminality. Only the ICO is able to take regulatory enforcement action. If anything, the pertinence of this question has only increased over time.
2.11 None of this is to suggest that the ICO should have had recourse to testing its formal investigatory and enforcement powers in practice in this case, but simply that it might have been expected to give the question urgent and detailed consideration. No regulator would expect as a matter of routine to make the formal assertion of its powers its first reaction, although in an egregious or systemic case (and Motorman was surely such a case) that may be appropriate. To the extent that criminal proceedings remained in active contemplation there would in any event have been a need for detailed consideration of the potential interactions between criminal and civil investigations. However, if not formal action, possibly as a prelude to the active consideration of formal action, the operational imperative to ‘do something’ about the Motorman problem with the press might at least have been expected to direct the mind of the ICO to the possible effectiveness of a range of informal steps.
3. Engagement with the industry: guidance and promoting good practice
“promote the following of good practice by data controllers and, in particular, so to perform his functions under this Act as to promote the observance of the requirements of this Act by data controllers”.The press organisations involved in the Motorman case were undoubtedly data controllers for these purposes and ‘good practice’ can refer to standards over and above the strict legal requirements of the data protection regime. Therefore, even assuming that the ICO had considered that, in the case of the press, its own powers were too restricted or restrictive for formal regulatory action to be the best way to proceed, its duty to promote good practice would still have been engaged. Mr Thomas described his entire twin-track strategy to have been undertaken in furtherance of his duty to promote good practice but the duty was also relevant to the operational imperative. That imperative was to tackle the questions raised by the fact that, so far as the ICO had reason to believe, the Motorman material remained in the hands of the press in circumstances which, at the very least, raised specific and systemic questions of good practice, standards and ethics.
3.2 The first recourse of a regulator is not usually to formal proceedings. In those circumstances, it is more usual to make informal contact in order to follow up an apparent problem (which is any practice falling short of desirable standards), hear the other side of the case, and seek to engage in a detailed dialogue about the nature and extent of the problem and the steps which might be taken to address it satisfactorily. At the very least, the Motorman material revealed to the ICO that the press had engaged in questionable practice in relation to individuals’ information, that it remained in possession of that information in circumstances which, again at the very least, raised questions about their conformity with good practice, and that good practice would require some contemplation from the individuals’ point of view as to whether steps were needed to improve the situation. But the Inquiry saw no evidence that any of these matters, any informal approach to the press data controllers or any assessment of the immediate practical steps suggested by good practice, were actively contemplated let alone put into effect.
3.3 Mr Thomas said that he did, indeed, have it in mind to write to the various journalists and editors involved, drawing attention to the fact that they were ‘incredibly lucky’ not to have been prosecuted (or, it might have been added, not to have been made the subject of formal investigatory or regulatory action).45 Pressed as to why no attempt was in fact ever made to engage with the individual newspapers, his answer was that, in going to the PCC, he had “dealt with them all collectively”.46 Apart from the identified concern that this suggests a lack of understanding of the role and responsibilities of the PCC, it implies that these were mutually exclusive approaches. It also suggests that there was no imperative to deal with the problem in the short term and in a practical way: that is to say, to address the issue not just of the press ceasing to commission further unlawful trade in personal information but also of what it was doing with the information already in its possession as a result of that trade. As noted above, the PCC itself urged Mr Thomas to engage directly with the industry and, in any event, showed little appetite to take the responsibility that Mr Thomas wished to pass on.
3.4 It is also significant that there seems to have been no attempt to engage directly with the press (even indirectly, through the PCC) in the run up to the publication of What Price Privacy?47 That report was of course conceived principally from the perspective of a policy decision to the effect that the introduction of custodial penalties for s55 was to be the principal means of impacting on the unlawful trade in personal data. Considered, however, from an operational point of view, the lack of engagement with the press or any part of it on either the text or the data tables is both striking and surprising. It afforded the industry no possibility of verifying the data (the consequences of which, in at least one case, are considered further below). It also missed what might very well have been the prime opportunity to discuss with the industry what practical lessons could be learned and what steps they ought to have taken or be taking not only to remedy any persistent problems, but also to secure good practice for the future. A not insignificant ‘carrot’ might have been a willingness to include an account on that exchange in the report to Parliament, thereby demonstrating that the press were taking the issue seriously.
3.5 Mr Thomas, however, said that he simply relied on the publications of his reports to Parliament to engender awareness amongst proprietors and editors at the national level of the ICO’s concerns.48 In relation to What Price Privacy? he reported:49
“I would say that was promoting good practice, and sending it to a hundred organisations with specific personalised letters saying ‘this is not acceptable’ … I would say this is very much promoting good practice.”
3.6 In reality, however, this was all rather late. It was three years after the event by which time the audit trail in relation to the Motorman material in the hands of the press was likely to have gone very cold indeed. Three aspects of the conduct of the ICO are difficult to understand. The first is that if it was possible to prepare a large individual awareness exercise, complete with personalised letters in order to draw attention to What Price Privacy?, and if that was seen as an effective way to discharge the duty of the ICO to promote good practice, there is no reason why similar attempts could not have been made at the time to contact the industry directly. Second, while making every allowance for the decision to approach the PCC as a form of collective engagement with the press, the ICO did not recommend specific good practice steps to be promulgated to the industry as well as ‘general condemnation’. Third, when it was becoming increasingly clear that the PCC was not going to act as an effective interlocutor with the industry on behalf of the ICO’s operational concerns, even then, the ICO did not seek to communicate directly with the industry itself.
3.7 Even after the publication of What Price Privacy? the process of preparing and issuing effective good practice guidance to the press was faltering and inconclusive. Of the document eventually produced, Mr Thomas said:50
“It was a useful guidance note but I suppose I was a little concerned that it buried the section 55 warnings into a wider context of talking about the Data Protection Act and its application to the media more generally, and I think even now I would say that it was a shame it didn’t just focus on section 55 in the way that our own note, which we produced, I think, in 2006 or 2007, what we call a good practice note, that was a very, very clear one and a half pager as to how the press should take seriously section 55.”
3.8 In reality, the ICO did not direct the press towards the practical steps it needed to take, not least in the maintenance of proper audit trails in relation to its handling of personal information (especially, as Mr Thomas had noted, in the event of an intention to rely on the public interest as a defence to s55). Rather, the process had become absorbed into managing the defensive stance of the press in response to the s55 campaign. A part of that response was the alleged discomfort of the press with applying legal public interest tests, notwithstanding the obvious centrality of judgments on the public interest to the routine standards and ethics issues with which the press is inevitably concerned on a day to day basis. Public interest judgements were also the daily bread and butter of the FOI regime which also fell within the ICO’s regulatory remit and on which extensive and detailed guidance has been published. Rather than pursuing the idea that the PCC would guide the press on this matter operationally, along with the other possible lines of approach, it was eminently feasible for the ICO simply to grip the issue both efficiently and expeditiously.
3.9 Furthermore, the ICO was under a continuing legal obligation to promote good practice, including by considering the issue of guidance, either specific or general. It is not easy to understand why the ICO persisted for years in trying to force the hand of the PCC to issue guidance when it had statutory powers of its own to do so; moreover, these were statutory powers which it was under a legal obligation to keep under constant review. Having diagnosed a need for guidance, and in the absence of a satisfactory and timely response from the PCC, it could have propelled the process forward with a comprehensive draft of its own, if necessary in direct consultation with the industry. There is no evidence that it contemplated doing so.
3.10 As noted above, one of the issues of contention between the ICO and the PCC over the course of its dialogue was the demand of the PCC for access to the detail of the Motorman material before it would consider itself able to take direct action on any matter with the press (this was Sir Christopher Meyer’s request for ‘beef’). The DPA includes a number of provisions inhibiting disclosure by the ICO of confidential material it has acquired in the exercise of its functions;51 this is a very standard feature of regulatory regimes. Those provisions would have inhibited the public disclosure of the Motorman material, and were an operative reason for the presentation of the material in the What Price Privacy? reports in summarised form only. Those provisions might also have rightly restrained the ICO from detailed disclosure to the PCC. But they would not have restrained discussion by the ICO of the relevant parts of the Motorman material with the individual press organisations (data controllers) concerned for the purposes of furthering their compliance with the legal or good practice requirements of the regime. At the point at which Mr Thomas declined to share the detail of the Motorman material with the PCC, he effectively acknowledged that detailed and specific discussions could only ever have taken place directly between the ICO and the individual press organisations.
3.11 On his own account, Mr Thomas was emphatic about the lack of engagement directly by the ICO with the press. When giving evidence, he told the Inquiry that “I don’t think I’ve ever had a conversation to this day with an editor”52 (although when prompted he recalled that he had, of course, spoken to editors, including Mr Dacre, in the context of his interactions with the Editors’ Code Committee). But again, it was only the ICO that could have conversations with individual press organisations about their continued retention of the Motorman material; there was nobody else.
4. Engagement with victims
4.1 The Motorman material was evidence in the hands of the ICO that a very large number of people appeared tohavebeen the victims of unlawful use of theirpersonal information. Those individuals had rights and entitlements under the DPA, and in the civil law more generally, including rights in relation to confidence and privacy. The data protection regime, in common with very many other regulatory regimes, provides for two routes of law enforcement. These are the exercise of investigatory and enforcement powers by the regulator and the availability of rights of action by individuals for the enforcement of the law in their own cases.
4.2 One of the defining features of contravention of information privacy law is that, characteristically, the victim may not be aware that it has happened or, if aware, may have no means to find out how it happened, who was responsible, or indeed to move beyond the realms of speculation.53 This feature was both obvious and commonplace when consideration was directed to the Motorman material, and was equally a very real concern which was underlined in the evidence of a number of Core Participants who complain about press intrusion.54 The ignorance of victims of the nature, or even existence, of the wrong done to them is, indeed, a principal reason for the existence of a regulatory authority with investigative legal powers.
4.3 The two approaches to law enforcement are not, of course, mutually exclusive. Christopher Graham expressed the connection by describing what he saw as a core element of the ICO’s job: ‘to arm the consumer, to educate and empower the consumer to exercise their information rights and to help them to assert them .’55 That role operates at both the general, educative level, and at the level of assisting individuals who have concerns, including for example by helping them to make subject access requests.56 Where the ICO comes upon evidence of unlawful activity of which the victim is not aware, it has some important operational choices to make. Matters to be taken into account will include the quality of the evidence, the nature and extent of the apparent breach, whether or not it is continuing, the practicalities of contacting victims, and so on. These were considerations which were brought to bear, for example, in the operation the ICO undertook in the wake of the loss by HMRC in late 2007 of discs containing large quantities of personal information relating to the recipients of child benefit. In part, at least, that was for the purposes of alerting the victims to the potential need to take security measures against the possibility of the information falling into the wrong hands and being used for fraudulent or other unlawful purposes in the future.
4.4 No such exercise appears to have been contemplated in the Motorman case, a matter which was directly raised in the Inquiry by potentially affected Core Participants. As noted above, Mr Owens’ team did approach some 30 to 40 victims for the purposes of their criminal investigation, and obtained witness statements. But engaging victims on the footing of a criminal investigation is a specific and limited kind of exercise and there is no evidence that the ICO engaged even those victims it approached for any broader purpose.
4.5 Aside from the primacy given to the criminal investigation at the time, Mr Thomas suggested that there were two principal reasons for failing to engage with the victims. The first was logistics, given the large number involved. The second was considerations of privacy, on the basis that alerting victims could raise questions about possible further invasions of their privacy, as might occur, for example, if third parties (including the victims’ family members) came to be aware of information about them which the victim had been at pains to conceal.57
4.6 Neither of these explanations fully accounts for the failure to take any operational hold of the situation affecting the Motorman victims, although both concerns are certainly important and relevant. The former is a strategic challenge of a sort which the ICO has addressed on other occasions. The latter is a matter of process, and of a nature which the ICO was well- placed to address. Neither points to complete inaction; neither would be insuperable given case by case consideration.
4.7 The consequences of the failure to alert the victims were much debated before the Inquiry. The ICO had placed considerable faith in the success of the political measures they took in response to Motorman to ensure that there was an effective stop to further victimisation for the future. It is, however, hard to avoid the conclusion that the position from the point of view of the victims was insufficiently taken into account, not merely operationally for the ICO, but also as a matter of respect for their rights and entitlements and so that they could properly consider their own law enforcement options, and take measures to deal with the risks of further victimisation to which they could be subjected. That conclusion was also part of Mr Owens’ reflections:58
“We also had the unanswered outstanding question relating to the remaining thousands of people who had never been told they had been a victim of crime having had their car checked, their ex directory telephone number unlawfully obtained, their private lists of family and friends sold to the Press and so on…. I also felt very strongly that the thousands of victims identified in Operation Motorman also had a right to know they had been victims.”
4.8 The extent to which the perspective of the victims was overlooked may be connected with the fact that the seriousness of the wrongdoing suggested by the Motorman material led the ICO in two directions (prosecution and the campaign on s55) which were both in the criminal domain. Exclusive focus on the criminal aspects of what had been discovered, without consideration of the wider regulatory context, carried a potential (if not an inevitable) risk that the victims would be left out of the picture. That risk is evident in both the operational and political reaction of the ICO to Motorman.
4.9 The obvious question arising from the failure to alert the victims has come to the fore in relation to all of the paths not taken by the ICO in response to Motorman: why, given the obvious operational magnitude and seriousness of this case, was action evidently given such a low priority? This is not a theoretical or historical question. The position of the victims was a contemporary issue for the Inquiry. While the prospects, in practical reality, of the ICO taking criminal or regulatory action in relation to Motorman may be regarded (absent further, fresher, evidence) as long since extinguished, individual victims expressed their concerns in terms of whether their involvement in Motorman might not have been part of a much wider context of their treatment at the hands of the press. There remained alive in their minds that question which Mr Owens said he had wanted to pursue: why did the press want their information? And the follow-up questions also arose, including what did they do with it and where was it now? This was the subject of a further ruling.59
4.10 Of all of the questions which arose before the Inquiry about the operational steps which the ICO could have taken in response to the Motorman material, this question of alerting the victims has clearly remained the most acute, notwithstanding the intervening years. For individuals, the question of what information a business holds about them, and what that business is doing with that information, is one of the core entitlements afforded by the data protection regime. The affected Core Participants indeed felt sufficiently strongly about this issue that they pressed the Inquiry itself to undertake a disclosure exercise in relation to the Motorman material. For reasons set out in a further ruling the Inquiry concluded that that was not an appropriate focus of its own attention.60 But it clearly remains a live issue for at least some of the victims; and of course in referring to victims, only a very small proportion of those who were the subjects of material acquired by the press via Mr Whittamore, have had that fact confirmed to them to this day.
4.11 In the circumstances, the Inquiry considered it appropriate to seek the views of the current Information Commissioner, Mr Graham, on the position of the Motorman victims from the perspective of the present day. The relevant Core Participants are also understood to have approached him with a general inquiry. In his oral evidence, Mr Graham responded in this way:61
“I had a letter last night, and no doubt this will be coming up later in the evidence, saying why have I not made contact with every individual whose name is mentioned in the Motorman file? And part of the answer to that is going to be I would have to take on a veritable army of extra people. I’m also going to say I don’t think it’s necessary, but this isn’t practical. All regulators have to pick their battles, prioritise their resources, and I just need some evidence of there being a problem before I divert resources to do it.”
4.12 Mr Graham was not here necessarily disputing that there was evidence of a problem at the time of the discovery of the Motorman material, but was questioning whether there was still a problem today. That line in his thinking, and the question of the prioritisation of operational resources, are considered more fully below. But Mr Graham also suggested that there were two further practical problems.
“I think Richard Thomas put the point very well in his response to you on this matter, when he said: if, having established the identity of the individual and their address, we wrote to them to say simply, “Your details appear in the Motorman file, we can’t tell you why”, that might be an even greater breach of privacy than the original offence, because there would be a suggestion that there’s no smoke without fire. Other members of the family might see the letter and say, “Hey, what’s going on?”and I couldn’t tell them any more than a name appears in a file.” The Inquiry is not persuaded that what is a perfectly fair concern about further invasions of privacy provides a reason for declining to contemplate alerting victims, nor that the risk of alerting third parties is one which could not, and cannot, reasonably be managed both through the means of communication and through the content.
“The difficulty about simply contacting everybody lies in the nature of the dossiers themselves. Mr Jay, you’ve seen them. I don’t know whether all the core participants are in that position, but these are notebooks, and sometimes the information contained in them is deeply obscure. I said in my witness statement that the individual who made the notes must have had a perfect understanding of what he was intending, but it isn’t always clear. That partly explains why there’s sometimes a discrepancy between the spreadsheets that we’ve compiled and the notebooks. If you said to me, “You ought to notify everybody whose name appears in the Motorman files”, I’d be hard pressed to do that. It isn’t just a question of resources, it’s it isn’t immediately clear who is being referred to, because it isn’t just celebrities, it’s all sorts of people who may or may not be part of a story concerning a celebrity or whatever it is; it’s just a name. Sometimes it’s just a surname….It would be a phenomenal undertaking. Just because there’s a name, John Smith, I would then have to work out which John Smith. The example I gave to the Select Committee was iggy Stardust, that’s a bit easier to do, but there are an awful lot of very anonymous names and it simply isn’t practical.”That may be a convincing explanation for the impossibility of contacting everyone involved in the Motorman material. It is not a convincing explanation for not contacting anyone.
4.15 There can be no doubt that a serious piece of work would be required for the ICO to undertake a wholesale review of the Motorman victims, and legitimate questions do arise about resources and priority. Mr Graham had his own suggestion about the way ahead:64
“So far as the individuals are concerned, I’m still very ready for subject access requests by those who may be concerned….if Hacked Off and their lawyers are representing particular individuals, then that’s what we’re here for; subject access requests, off we go.”Subject access requests allow individuals to exercise their entitlement under the data protection regime to know from any business whether it holds information about them and, if so, what. They are not a straightforward answer to the problem. Unless individuals are already aware that a given title holds their information, the right could be exercised only by a speculative correspondence across a range of newspapers and periodicals, at some inconvenience and expense to both the person requesting and the subject of the request. This therefore appears to be a paradigm case in which a statutory regulator could be expected actively to consider providing assistance.
4.16 There is, no doubt, a range of practical solutions to this issue which both the ICO and the industry could have offered to the Motorman victims at any point up to and including the present. One possible way forward would be for concerned individuals to be able to apply to the ICO seeking to obtain confirmation (in so far as the ICO is able to offer it) as to whether they can be identified among the Motorman victims and, if so, information as to the title or titles concerned and assistance, if necessary, in making a suitable request to those titles.
4.17 If interest in exercising that right reached proportions beyond the capability of the ICO, then perhaps the press organisations could be directed or encouraged each to undertake its own victim contact exercise under the ICO’s supervision.65 So far as the ICO is concerned, at any rate, this suggests a course of action within its easily accessible knowledge and, subject to reasonable prioritisation, within its capability. This could have discharged its general functions to satisfactory effect. There is no evidence that it was willing to turn its mind to any such possibility, either at the time or since.
5. Conclusions and the questions raised by Operation Motorman
5.1 Operation Motorman was prima facie evidence of systemic and serious malpractice by the press in relation to the acquisition and use of personal information. It was also one of the biggest cases of deliberate and systemic data abuse of any sort to come to the attention of the ICO. In the view of the ICO itself the journalistic practices it disclosed on the face of it:
- were widespread and systemic;
- were probably criminal;
- suggested extensive and continuing breaches of the data protection principles;
- suggested large-scale and continuing breach of individual rights;
- at the least raised serious questions about standards and proper practices by the press;
- were unlikely to be an isolated example; and
- had implications for the integrity of personal information, a number of public and private databases, and the data protection regime as a whole. Additionally, it was apparent to the ICO that the industry was not (at any rate at the time) denying that there was a problem.66
5.2 This called for a commensurate response from the ICO which dealt with all aspects of the problem and included challenging the practices and safeguarding both the information and the position of the victims involved. It also presented a clear opportunity for a regulatory body to demonstrate publicly the importance and effectiveness of the data protection regime in safeguarding the public interest in information privacy. The ICO was the best-placed organisation to grasp the implications of the Motorman material as a whole and to take a decisive lead, working with other public authorities including the police and with the industry itself, to ensure that a comprehensive and effective response was made to the evidence that it disclosed of problems in the culture, practices and ethics of the press.
5.3 From an operational point of view, the ICO’s response to the Motorman material was not commensurate with the scale of the problem disclosed. The Information Commissioner ultimately considered that the problem was big enough for it to trouble Parliament and Government at the highest levels, including the Prime Minister. The contrast with the insufficiency of its operational response is all the more obvious. The ICO is principally an operational regulator, endowed with legal powers and functions to be exercised in the public interest. Its principal role is not to act as a political campaigning body but to discharge its regulatory functions at a practical level.
5.4 In particular, from an operational perspective, it appears that:
- there was an insufficiently strategic grasp of the operational issues and options facing the organisation as a result of the material for fully informed decisions to be taken, or for the results to be followed through;
- the senior management of the ICO in practice gave insufficient priority to the operational dimension of the Motorman material;
- the course of conduct of the criminal investigations was unsatisfactorily managed, with the result that opportunities were missed to address potential criminality in the culture, practices and ethics of the press;
- insufficient consideration was given to alternative operational strategies, both formal and informal, for addressing the matter;
- in particular, the failure to give serious contemplation to engaging directly with either the data controllers in the press or the data subject victims is difficult to reconcile with the general duties of the ICO or with a recognisably considered approach to weighing up its operational priorities.
5.5 It also appears that there was insufficient connection between the operational work of the ICO on the Motorman case and the strategic or political choices made by the Information Commissioner to respond to the issue at a higher level, that is to say, by engaging in dialogue with the PCC and campaigning on s55. As a result, those choices were insufficiently well- informed and effective, and not appropriately targeted at the issues about the culture, practices and ethics of the press disclosed by the Motorman material.
5.6 In particular, while it was not unreasonable to think it worth exploring the contribution the PCC could make to addressing the problem presented by the Motorman material, the strategy lacked from the outset:
- clearly-defined objectives and outcomes; putting a stop to the practice, condemnation and Code changes were propositions at too high a level of generality to be capable of generating a timetable or plan of action measurable in terms of identifiable changes in the culture, practices and ethics of the press;
- a clear, informed and realistic apprehension of the nature, role and functions of the PCC and the contribution it might be expected to make (which is a point that Mr Thomas accepted); it was not satisfactory for the ICO to seek to discharge its own functions to any extent through an organisation such as the PCC without being very clear about its ability to take on and deliver that charge satisfactorily, and there is insufficient evidence that this was properly researched;
- a detailed plan for how the ICO’s own functions would have to be brought to bear to ensure that the two organisations’ contributions would work together to produce the desired regulatory outcome;
- a thought-through analysis of how the strategy of trying to engage the PCC on the one hand, and the political campaign on s55 on the other were likely to interact, particularly given the personalities involved, and plans for dealing with the potential (which might be thought obvious) for the objectives of each to conflict.
5.7 These problems were compounded by persistence in the dialogue with the PCC in a way which failed to be sufficiently focused and realistic, proportionate to its likely effect and effectiveness, failed to keep in view the ICO’s own role and responsibilities. In particular, as it became apparent that the response of the PCC was falling short of what ICO hoped, opportunities were missed to reappraise the strategy which could have been replaced or supplemented by the direct exercise of its own powers and functions, including by way of issuing good practice guidance or otherwise engaging directly with the industry.
5.8 Both Mr Thomas and, latterly, Mr Graham are to be commended for the extent to which they have robustly sought, in the face of sustained hostility and lobbying from the press, to make the case publicly for better standards and to encourage rational consideration of the merits of the argument for increasing the sentencing maxima for s55 offences. To the extent that the s55 campaign can be regarded as a response to the Motorman case (and I recognise that it had other motivations also), it is arguable that it was problematic in:
- the extent to which it drew the ICO into the contested political arena and away from its primary regulatory obligations under the DPA;
- the extent to which it focused exclusively on the criminal law as a potential solution, and its lack of practical engagement with the limitations on the effectiveness of such solutions; and
- not identifying the context, either within the wider role and functions of the ICO or in any plan for realising any benefits that it might have been capable of yielding.
5.9 In the light of the analysis of the response to the Motorman material, it is appropriate to conclude that ICO did not effectively grasp the full implications, and indeed opportunities, of the case. As a result:
- previous misconduct was inadequately brought to justice and was not otherwise addressed as a matter of law enforcement;
- the risk of continuing breaches of law and standards was not effectively addressed;
- the interests of the victims were inadequately protected; and
- an important opportunity was missed to address problems in the culture, practices and ethics of the press in relation to the acquisition and use of personal information, which could have had an impact beyond the facts of the Motorman case. In the circumstances, a real question must remain as to whether these missed opportunities contributed, either at a general or a specific level, to later manifestations of disregard for the rights of others in relation to information privacy which were subsequently exhibited by certain parts of the press, of which phone hacking was the most serious.
5.10 I should make very clear that there is no evidence to suggest, as Mr Owens invited the Inquiry to do, that the political campaign and the publication of the What Price Privacy? reports were a deliberate attempt to deflect attention from the ICO’s operational inactivity. To the extent that they drew public and political attention to the problem, they did themselves perform a function of acting as a warning to others in positions of authority to take action. To that extent, Mr Graham’s description of the role of the ICO in the Motorman story ( “we are the good guys” ) may fairly be endorsed.
5.11 The principal outstanding questions, therefore, to which the remainder of this Part of the Report is addressed, are these:
- Is there any reason to think that there are still causes for concern about the culture, practices and ethics of the press in relation to personal information, whether as a matter of law or as a matter of good practice?
- To what extent do issues persist about the perception of the ICO that its role and powers are inadequate or inappropriate to address evidence of any such problems?
- To what extent, on an objective analysis, are there genuine shortcomings in the legal framework, and are there any changes which could be made to improve the situation?
- Are there any other impediments to the ICO making a more effective contribution to supporting law enforcement and good practice in relation to the press which it is necessary or desirable to remove?