The ICO launches its Data Analytics Toolkit

Why the ICO is talking about Data Analytics and what affect will their new Toolkit have on your business?

Since the start of 2020, many of us have been tuning in to the 5pm government update briefings hoping for news on the return to normality. Some of us have been searching google for "how at risk is my area?", "what is the current R number?", "are COVID cases decreasing yet?". In response we are shown charts of how many cases there have been in the preceding week, graphs showing the UK compared to other European countries, heatmaps showing how 'at risk' your area is.

Each of these answers relies on one core process: Data Analytics. COVID and the experiences of the last year have only emphasised the significance of such technology, which explains why it is one of the Information Commissioner's Office's (ICO) current areas of focus. The ICO has begun publishing an increasing volume of materials aimed at encouraging and supporting innovation and the UK Government has announced its new approach to data, one that "no longer sees data as a threat, but as the great opportunity of our time". The ICO's new data analytics toolkit furthers the ICO's ongoing engagement with emergent technologies.  

What is 'data analytics'?

The ICO defines it as: "the use of software to automatically discover patterns in data sets (where those data sets contain personal data) and use them to make predictions, classifications, or risk scores". Put more simply, it's the process of collecting and examining datasets to draw conclusions about the information they contain.

Data analytics relies on a set of mathematical instructions or rules that are given to computer systems to complete tasks. It can be conducted on data sets of varying size. On the one hand you have data being analysed by the government over the last 12 months to prepare a Covid response plan, whilst on the other, organisations may want to use data analytics to map how their 250 customers use their smart scooters in London.

At both ends of the scale the chances are that the data analytics program involves the processing of personal data. This is the focus of the ICO's toolkit, which seeks to educate organisations on how to use data analytics in compliance with UK data protection laws.

Who is the target audience?

According to the ICO, the target audience is organisations who are new to data analytics, at the start of their journey. However, it also serves as a helpful reminder to more experienced users.

How does the toolkit work?

How can the toolbox help your organisation?

The toolkit encourages organisations to embed data protection principles into their data analytics projects from the outset and recognise the risks to user privacy. The hope is that the toolkit will help organisations - particularly those with more limited resources - recognise the risks of processing large quantities of personal data and reduce the risk of non-compliance.

It is also hoped that by focusing its attention on data analytics and publishing guidance on how to ensure compliance, the ICO will encourage the general public to learn to trust organisations with their data.

This may mean that the ICO will expect more from organisations who have made the decision to run a data analytics project. It will be interesting to see whether organisations, including the government, the NHS and the vast number of organisations which have shifted to remote working, will come under scrutiny over the collection of data en mass over the last year. In our 2021 Investigations Outlook we've predicted a marked uptick in data privacy enforcement and a 70% increase in the total value of monetary fines issued by the ICO. This is certainly an area where we may see more ICO activity in the future.

The ICO toolkit is supplemented by the ICO's 'Guidance on AI and data protection', and the co-badged guidance by the ICO and The Alan Turing Institute, 'Explaining decisions made with AI'. We have summarised the ICO's AI and data protection guidance here.

You may also find our Artificial Intelligence (AI) healthcheck and compliance framework service helpful. The framework and advisory service aims to assist businesses to ensure their use of AI is in compliance with applicable regulations and ethical best practice.

If you found this interesting, there's a lot more comment you may find helpful on UpData, which provides regular updates on contentious, criminal and insurance risks relating to data, from cyber-attacks to regulatory enforcement.