agreement of the Information Commissioner but there is no mechanism that permits a fully independent review by a third party. 373. The government proposes to empower the DCMS Secretary of State to initiate an independent review of the ICO’s activities and performance. Such a step may be taken if, for example, the ICO's performance were to slip below a threshold determined with reference to the enhanced accountability mechanisms set out above, or after prior notifications about shortcomings in performance. This would be comparable to, for example, HM Treasury’s ability to instruct a review of the efficiency and effectiveness of the Financial Conduct Authority (FCA), as set out in the Financial Services Act 2012. 99 The government welcomes views on the following questions: Q5.4.6. To what extent do you agree with the proposal to empower the DCMS Secretary of State to initiate an independent review of the ICO’s activities and performance? ○ Strongly agree ○ Somewhat agree ○ Neither agree nor disagree ○ Somewhat disagree ○ Strongly disagree Please explain your answer, and provide supporting evidence where possible.
Q5.4.7. Please share your views on what, if any, criteria ought to be used to establish a threshold for the ICO's performance below which the government may initiate an independent review. 5.5 Codes of Practice and Guidance 374. Under the Data Protection Act 2018, the Information Commissioner is required to prepare codes of practice on four specified data processing activities in order to outline best-practice for organisations. The legislation also requires the Information Commissioner to consult the DCMS Secretary of State, and other parties considered appropriate, before preparing or amending three of the codes. 100 In addition, under its general functions, the Information Commissioner has powers to publish guidance on processing activities that relate to data protection. 375. The ICO now carries out impact assessments, and undertakes enhanced consultation with both government and other stakeholders when developing codes of practice, and complex or novel guidance. This approach is set out in the ICO’s Regulatory Policy Methodology Framework. 376. The government proposes to oblige the ICO to undertake and publish impact assessments, as well as conduct enhanced consultation, when developing codes of practice, and complex or novel guidance. This will give the current processes a statutory underpinning.
99
Financial Services Act 2012, 1S, c. 21, PART 2, ‘Financial Conduct Authority and Prudential Regulation Authority’. 100 The data-sharing, direct marketing, age-appropriate design code.
129
