Elizabeth Denham CBE, LL.D. | |
---|---|
Fifth Information Commissioner | |
In office 18 July 2016 [1] [2] –30 November 2021 | |
Preceded by | Christopher Graham |
Succeeded by | John Edwards |
Personal details | |
Nationality | Canadian |
Residence | England |
Alma mater | University of British Columbia |
Elizabeth Denham CBE,LL. D. (hon.) was the UK Information Commissioner at the Information Commissioner's Office in Cheshire from July 2016,taking over the role from Christopher Graham,until November 2021. Denham previously held the title of Information and Privacy Commissioner for British Columbia,having been appointed to that role in May 2010. Prior to this she had been the Assistant Privacy Commissioner of Canada from 2007. [3]
Denham studied at the University of British Columbia from 1977 to 1984 and holds a bachelor's degree in history and a master's degree in archival studies from the university's iSchool (Library,Archival and Information Studies). [4]
During her time as Information and Privacy Commissioner for British Columbia,Denham called for the proactive disclosure of records [5] and published best practices for government ministries and public bodies. [6] She also co-authored a guidance document called Getting Accountability Right with a Privacy Management Program.
Denham was appointed UK Information Commissioner in July 2016. She and her office deal with the Data Protection Act 2018 and the General Data Protection Regulation,the Privacy and Electronic Communications (EC Directive) Regulations 2003 across the UK;and the Freedom of Information Act 2000 and the Environmental Information Regulations 2004 in England,Wales and Northern Ireland and,to a limited extent,in Scotland.
At the Information Commissioner's Office,she welcomed the introduction of the data protection laws that came into effect in May 2018,and focused on the role data protection must play in innovation,and the importance of organisations understanding the growing onus on companies to be accountable for what they do with personal data. She also called for the Freedom of Information Act to be extended to private bodies doing work on behalf of the public,and proposed a review of legislation around the duty to document information.
Denham has undertaken investigations into Equifax,WhatsApp,TalkTalk,Uber and Facebook,and oversaw the conclusion of the investigation of the Information Commissioner's Office into charities' fundraising activities. She issued a series of fines for companies behind nuisance marketing,and in December 2018 she welcomed the new law that enabled the Information Commissioner's Office to hold company bosses directly responsible and to fine them personally for breaches of the Privacy and Electronic Communications Regulations.
In May 2017,Denham decided to look into potential unlawful marketing involving repurposing of data during the 2016 United Kingdom European Union membership referendum. [7] When Denham produced her final report in November 2020,she announced that she had "found no further evidence to change [her] earlier view that SCL Group and Cambridge Analytica were not involved in the EU referendum campaign in the UK." [8] She also said she found no evidence of Russian involvement in the referendum. [9]
She launched the inaugural Data Protection Practitioner Award for Excellence in Data Protection at the 11th annual Information Commissioner's Office conference.
In January 2022,Denham started working at the London offices of global law firm Baker McKenzie [10] in a move criticised as "extraordinary" [11] in light of the firm having defended Facebook against regulatory action by the Information Commissioner's Office while Denham was in office,and the short timeframe between leaving office and the announcement being made by the firm.
She currently serves on the Advisory Boards or Boards of Director for Pacific Opera in Victoria,Canada; [12] for 5Rights,a charity committed to children’s health and safety; [13] for Oxford University’s Internet Institute; [14] and for the International Association of Privacy Professionals. [15]
Denham has also authored or co-authored a spate of opinions and articles in 2022:including the essay “Citizens first”for the academic journal Information Polity; [16] a call for increasing collaboration among Canada’s digital regulators,posted to the C. D. Howe Institute’s website; [17] and an opinion in Canada's Globe and Mail newspaper that argued for coordinated,global efforts to create harmonized,comprehensive legal protections for children’s online safety. [18]
In 2011,Denham received the distinguished alumna award from UBC iSchool (Library,Archival and Information Studies) for her work in archives and the field of access and privacy. [19]
In 2013,she received the Queen Elizabeth II Diamond Jubilee Medal for her service as an officer of the legislature of British Columbia,Canada. [20]
In 2016,Denham was awarded the Grace-Pépin Access to Information Award for having been "a staunch advocate for access to information rights." [21]
In 2018,she was placed first in the DataIQ 100 Top 10. [22]
She was appointed Commander of the Order of the British Empire (CBE) in the 2019 New Years Honours for services to protecting information. [23]
In 2020 she was announced as the winner of BCS,The Chartered Institute for IT’s Society Medal as a result of her office's investigation into unlawful data collection practices by political campaigns. [24]
Denham served as Chair of the International Conference of Data Protection and Privacy Commissioners,later the Global Privacy Assembly,from 2018 until 2021. [25] [26]
Denham received an honorary doctorate of laws in 2022 from the University of Victoria,in British Columbia,for recognition of her international contributions to privacy and access over decades. [27]
The role of information commissioner differs from nation to nation. Most commonly it is a title given to a government regulator in the fields of freedom of information and the protection of personal data in the widest sense. The office often functions as a specialist ombudsman service.
The Data Protection Act 1998 was an Act of Parliament of the United Kingdom designed to protect personal data stored on computers or in an organised paper filing system. It enacted provisions from the European Union (EU) Data Protection Directive 1995 on the protection,processing,and movement of data.
The Information Commissioner's Office (ICO) is a non-departmental public body which reports directly to the Parliament of the United Kingdom and is sponsored by the Department for Science,Innovation and Technology. It is the independent regulatory office dealing with the Data Protection Act 2018 and the General Data Protection Regulation,the Privacy and Electronic Communications Regulations 2003 across the UK;and the Freedom of Information Act 2000 and the Environmental Information Regulations 2004 in England,Wales and Northern Ireland and,to a limited extent,in Scotland. When they audit an organisation they use Symbiant's audit software.
Privacy International (PI) is a UK-based registered charity that defends and promotes the right to privacy across the world. First formed in 1990,registered as a non-profit company in 2002 and as a charity in 2012,PI is based in London. Its current executive director,since 2012,is Dr Gus Hosein.
The Personal Information Protection and Electronic Documents Act is a Canadian law relating to data privacy. It governs how private sector organizations collect,use and disclose personal information in the course of commercial business. In addition,the Act contains various provisions to facilitate the use of electronic documents. PIPEDA became law on 13 April 2000 to promote consumer trust in electronic commerce. The act was also intended to reassure the European Union that the Canadian privacy law was adequate to protect the personal information of European citizens. In accordance with section 29 of PIPEDA,Part I of the Act must be reviewed by Parliament every five years. The first Parliamentary review occurred in 2007.
Ann Cavoukian is the former Information and Privacy Commissioner for the Canadian province of Ontario. Her concept of privacy by design,which takes privacy into account throughout the system engineering process,was expanded on,as part of a joint Canadian-Dutch team,both before and during her tenure as commissioner of Ontario.
Information privacy,data privacy or data protection laws provide a legal framework on how to obtain,use and store data of natural persons. The various laws around the world describe the rights of natural persons to control who is using its data. This includes usually the right to get details on which data is stored,for what purpose and to request the deletion in case the purpose is not given anymore.
The Telephone Preference Service (TPS) is the United Kingdom's official do not call list. It allows businesses and individuals to opt out of unsolicited marketing calls.
The Privacy and Electronic Communications Regulations 2003 is a law in the United Kingdom which made it unlawful to,amongst other things,transmit an automated recorded message for direct marketing purposes via a telephone,without prior consent of the subscriber. The law implements an EU directive,the Privacy and Electronic Communications Directive 2002.
Beeban Tania Kidron,Baroness Kidron,is an advocate for children's rights in the digital world. She has played a determinative role in establishing standards for online safety and privacy across the world.
The Register of data controllers was a United Kingdom database under the control of the UK Information Commissioner's Office mandated by the Data Protection Act 1998.
Privacy advocates have objected to the Google Street View feature,pointing to photographs that show people leaving strip clubs,protesters at an abortion clinic,sunbathers in bikinis,cottagers at public parks,people picking up prostitutes,and people engaging in activities visible from public property which they do not wish to be photographed and have published online. Google maintains that the photos were taken from public property. However,this does not take into account that the Street View cameras take pictures from an elevated position,enabling them to look over hedges and walls designed to prevent some areas from being open to public view. Before launching the service,Google removed photos of domestic violence shelters,and additionally allows users to flag inappropriate or sensitive imagery for Google to review and remove. When the service was first launched,the process for requesting that an image be removed was not trivial. Google changed its policy to make removal more straightforward,but has since removed the option to request removal of an image,replacing it by an option to request blurring of an image. Images of potential break-ins,sunbathers,and individuals entering adult bookstores have,however,remained active and these images have been widely republished.
Privacy by design is an approach to systems engineering initially developed by Ann Cavoukian and formalized in a joint report on privacy-enhancing technologies by a joint team of the Information and Privacy Commissioner of Ontario (Canada),the Dutch Data Protection Authority,and the Netherlands Organisation for Applied Scientific Research in 1995. The privacy by design framework was published in 2009 and adopted by the International Assembly of Privacy Commissioners and Data Protection Authorities in 2010. Privacy by design calls for privacy to be taken into account throughout the whole engineering process. The concept is an example of value sensitive design,i.e.,taking human values into account in a well-defined manner throughout the process.
Elizabeth Irene France is the former chair of the Office for Legal Complaints. She was appointed in February 2009 and was chair until 2014 when Steve Green became the Chair. From 1994 to 2002 she was the Data Protection Registrar / Information Commissioner and from 2002 to 2009 Chief Ombudsman and Chief Executive of Ombudsman Services Ltd.
The General Data Protection Regulation is a European Union regulation on information privacy in the European Union (EU) and the European Economic Area (EEA). The GDPR is an important component of EU privacy law and human rights law,in particular Article 8(1) of the Charter of Fundamental Rights of the European Union. It also governs the transfer of personal data outside the EU and EEA. The GDPR's goals are to enhance individuals' control and rights over their personal information and to simplify the regulations for international business. It supersedes the Data Protection Directive 95/46/EC and,among other things,simplifies the terminology.
AggregateIQ (AIQ) previously known as SCL Canada is a Canadian political consultancy and technology company,based in Victoria,British Columbia.
The Data Protection Act 2018 is a United Kingdom Act of Parliament which updates data protection laws in the UK. It is a national law which complements the European Union's General Data Protection Regulation (GDPR) and replaces the Data Protection Act 1998.
Several allegations of unlawful campaigning in the 2016 EU referendum have been made. Some allegations were dismissed by the investigating bodies,but in other cases wrongdoing was established,leading to the imposition of penalties. Sanctions have included the levying of the maximum fine possible on Facebook for breaches of data privacy.
The Freedom of Information and Protection of Privacy Act is an Act of the Legislative Assembly of British Columbia governing the public sector. It is commonly abbreviated "FIPPA" or "FOIPPA",though other Canadian provinces such as Alberta,and Ontario,use similar FIPPA acronyms for their public sector privacy law. "BC FIPPA" can be used as an acronym for further differentiation. FIPPA holds public bodies "accountable for their information practices". The legislation defines public sector requirements for collection,use,disclosure and safeguarding of individuals' personal information,decrees individuals' right to access public sector records,including access to an individual's "own 'personal information' as well as records in the custody or control of a 'public body' "—subject to specific exemptions. FIPPA requires public bodies to "take reasonable steps to protect the privacy of personal information they hold". Independent oversight and enforcement for FIPPA rests with the Office of the Information and Privacy Commissioner for British Columbia.
Michael Veale is a technology policy academic who focuses on information technology and the law. He is currently associate professor in the Faculty of Laws at University College London (UCL).