Yesterday, the ICO said: “The investigation has found there is a case to answer. The commissioner will now be temporarily unable to act in fulfilling his responsibilities for the remainder of the process.”
‘Step back from all contact with staff’
During his voluntary step-down, Edwards had continued to receive updates and could “contribute as required”.
Now he has been totally cut off, with deputy commissioner and chief executive Paul Arnold temporarily assuming his responsibilities.
UK publication ComputerWeekly says it understands Arnold has also been designated as temporary acting accounting officer for the ICO, as well.
Edwards has “agreed to step back from all contact with ICO staff, with the exception of myself and his private office; will not enter ICO offices”, Arnold said.
“As the Information Commissioner is accountable to Parliament, and not employed by the ICO, the next steps will be determined by the Department for Science, Innovation and Technology,” the ICO said in a statement. Those steps have yet to be outlined.
“Throughout this complex and unprecedented situation, our priority has been to provide a safe and supportive environment for our staff that enables them to carry out their important regulatory work,” Arnold said.
Edwards: ‘Premature’
“There is an ongoing process which I have engaged with in good faith from the outset,” Edwards told the Herald via GRC Partners, an Auckland and Wellington communications firm that specialises in government affairs.
“The statement from the interim chief executive is premature and it is not appropriate for me, nor anyone, to comment further at this stage as the process has not yet concluded,” Edwards said.
Acting ICO head Arnold has himself copped flak from Politico, with the publication questioning why he did not inform Parliament of the investigation until April (when the publication broke the story), given the investigation had begun on February 16 (with Edwards voluntarily stepping aside on February 26).
Back in NZ?
Edwards declined follow-up questions, including whether he has returned home.
On June 2, Politico reported: “The head of the UK’s data protection watchdog has continued to draw his £200,000 annual salary despite not working since February and returning to his native New Zealand.”
Politico said it had sighted emails in which, “Arnold reassured Edwards that he would continue to be paid his salary – which is higher than the British prime minister’s – in full and accrue other workplace benefits throughout the investigation”.
Edwards’ term is due to expire in January 2027.
Whatever happens with this investigation, there will not be another “privacy czar” as Edwards’ role was popularly known at the time of his appointment.
A restructure will see the Information Commissioner position replaced by a group of commissioners.
Front-foot
In his public-facing roles, Edwards has often adopted a front-foot approach, particularly with his criticism of Big Tech firms.
Edwards also lobbied, unsuccessfully, for the ability to fine firms up to $1 million for Privacy Act breaches when the legislation was updated in 2020. While Australia introduced A$50m fines, his office had to settle for a strongly worded letter.
In a 2019 tweet – which he subsequently deleted – Edwards said: “Facebook cannot be trusted. They are morally bankrupt pathological liars who enable genocide [Myanmar], facilitate foreign undermining of democratic institutions.”
His comments were made in the wake of the Christchurch mosque massacres.
Edwards also posted that Facebook’s initial silence about the shootings was “an insult to our grief”.
The Herald understands the Ardern-led Government asked him to dial down his rhetoric.
Others liked that he turned up the volume. His style turned heads in the UK.
“John Edwards is outspoken. This is not a bad thing. We want and need privacy regulators who are not afraid to call out bad privacy practices, take a stand in the name of the consumer, and keep government agencies and corporations operating within privacy and ethical guardrails,” the International Association of Privacy Professionals’ Daimhin Warner wrote at the time.
Edwards hit the ground running in the UK. In April 2023, his office fined TikTok £12.7m for collecting data on children, in contravention of UK privacy rules.
More recently under Edwards, the ICO fined password manager LastPass UK £1.23m after “a significant data breach” and DNA firm 23andMe £2.31m for “security failings”. And in February this year, his office fined Reddit £14.47m for infringements of data processing laws for minors.
Chris Keall is an Auckland-based member of the Herald’s business team. He joined the Herald in 2018 and is the technology editor and a senior business writer.