Changes to the ICO Under the Data (Use and Access) Act

On 30 June, the ICO announced the appointment of Paul Arnold MBE as the first CEO of the forthcoming Information Commission. Under the recently passed Data (Use and Access) Act (DUAA), the governance structure of the ICO will be revised, ultimately becoming the future Information Commission.  

Arnold has an extensive background in regulation, having received an MBE in the 2024 King’s New Year Honours for his services to Regulation, and Equality, Diversity and Inclusion. He first joined the ICO in July 2010, then working as Director and Head of Customer and Business Services, before being promoted to Deputy Chief Executive and Chief Operating Officer in October 2016; a tenure which also included a brief stint in 2021 as an Accounting Officer. Arnold’s institutional knowledge of the ICO is indisputable and techUK offers profuse congratulations on his well-deserved appointment. 

John Edwards will retain his role of Information Commissioner, and he will chair a newly established board, consisting of Arnold and several Non-Executive Directors. It is intended that these organisational changes will bring the ICO in line with their fellow UK regulators, bolstering their resilience and modernising their structure.  

Part 6 of the Act pertains to the Information Commission. Within this Part, the role of the Office of the Information Commissioner is abolished, with its functions transferred to the Information Commission. Beyond this, the Act is due to embolden the ICO’s ability to investigate through providing new powers, as well as enforcing new reporting requirements to deliver a greater degree of transparency and accountability.  

Whilst Arnold’s appointment is currently on an interim basis, techUK looks forward to engaging with him and his team as the ICO navigates its evolving role and governance under the DUAA.