UK privacy watchdog starts over with new board and Manchester HQ

Bri­tain's data pro­tec­tion watch­dog has ac­qui­red a new legal iden­tity and go­ver­nan­ce struc­tu­re, although the fa­mi­liar ICO initials are sta­ying put. On Sep­tem­ber 30, the In­for­ma­tion Com­mis­sion re­pla­ced the In­for­ma­tion Com­mis­sio­ner as the sta­tu­tory re­gu­la­tor. The or­ga­ni­za­tion itself will be known as the In­for­ma­tion Com­mis­sion's Of­fi­ce and will con­ti­nue using the ICO name. The chan­ge is more than a bu­reau­cra­tic re­brand. The for­mer re­gu­la­tor was a "cor­po­ra­tion sole," mea­ning its sta­tu­tory po­wers and res­pon­si­bi­li­ties were ves­ted in one per­son: the In­for­ma­tion Com­mis­sio­ner. Those fun­ctions have now trans­fe­rred to a cor­po­ra­te body over­seen by execu­ti­ve and non-execu­ti­ve board mem­bers. The new struc­tu­re was crea­ted by the Data (Use and Ac­cess) Act 2025, which re­cei­ved Royal As­sent in June 2025. The go­vern­ment says it will mo­der­ni­ze the watch­dog's go­ver­nan­ce without chan­ging its exis­ting re­gu­la­tory fun­ctions. The transition fo­llows an awk­ward final few months under the old struc­tu­re. In­for­ma­tion Com­mis­sio­ner John Ed­wards re­sig­ned in June after an in­de­pen­dent work­pla­ce in­ves­ti­ga­tion into his con­duct, ad­mit­ting that his po­si­tion had be­co­me "un­te­na­ble" and that at­tem­pts at humor had been "inap­pro­pria­te and cau­sed of­fen­se." Ed­wards had step­ped back from his du­ties in April, and the ICO re­mo­ved his re­mai­ning res­pon­si­bi­li­ties after the in­ves­ti­ga­tion con­clu­ded there was "a case to ans­wer." Paul Ar­nold, who as­su­med Ed­wards' sta­tu­tory res­pon­si­bi­li­ties be­fo­re his re­sig­na­tion, is ser­ving as in­te­rim chief execu­ti­ve of the In­for­ma­tion Com­mis­sion. Seven non-execu­ti­ve mem­bers have joi­ned the new board. They ap­poin­ted Mag­gie Car­ver de­puty chair, and she will per­form the chair's du­ties while the go­vern­ment sear­ches for so­me­body to fill the job per­ma­nently. That re­cruit­ment pro­cess isn't ex­pec­ted to wrap up until spring 2027. The re­gu­la­tor has also pac­ked its boxes and moved its head­quar­ters from Wilms­low to Ox­ford Road in Man­ches­ter, which it says will give it ac­cess to a "di­ver­se ta­lent pool" and strengthen links with bu­si­nes­ses and com­mu­ni­ties across the UK. For an­yo­ne dea­ling with the watch­dog, little should chan­ge day to day. The In­for­ma­tion Com­mis­sion re­tains res­pon­si­bi­lity for data pro­tec­tion and free­dom of in­for­ma­tion re­gu­la­tion, along with the ICO's exis­ting po­wers, gui­dan­ce, and pu­blic ser­vi­ces. A new cor­po­ra­te stra­tegy is also on the way, with AI, cyber re­si­lien­ce, chil­dren's pri­vacy, and pu­blic ser­vi­ces among the areas sin­gled out for at­ten­tion. An­yo­ne at­ta­ched to the old initials can relax: des­pi­te the legal and go­ver­nan­ce overhaul, even the In­for­ma­tion Com­mis­sion's Of­fi­ce in­tends to keep ca­lling itself the ICO. ®…