What are the ICO’s priorities?

Children and AI are set to be at the heart of the ICO’s priorities for the forthcoming years. This is the clear message from a draft strategy published ahead of the transition to a new board-led Commission this Autumn.

The strategy sets out four proposed priorities:

1. Personal data which helps and does not harm children. The ICO plans to work to make sure digital and EdTech sectors embed data protection by design and default.
2. Promoting trust and transparency in AI with a continued drive to provide clarity to businesses on the responsible use of personal data in AI;
3. Public services using people’s data responsibly. The ICO will pick up on survey findings that fewer than half of people trust the Government to keep their data safe; and
4. Building cyber resilience as the UK becomes one of the most targeted countries in Europe for cyber-attacks.

The ICO says it needs to focus its efforts on areas of highest risk and systemic importance. As a result, there will be less time invested in more routine or lower-risk work.

The strategy coincides with the appointment of seven non-executive directors to the Information Commission’s Board and nominations recently closing for the Board Chair. The timing of publication of the draft strategy may seem a bit off, as it’s not been approved by the new board.

Children’s Code Update

Protecting children online is a key topic of public debate. A clear priority for the government and the ICO, as regulators consider how best to balance children’s safety, privacy and participation in digital services.

The ICO has recently issued a progress update on their ground-breaking Children’s Code (Age-Appropriate Design Code – AADC) which claims improvements introduced over the past two years have had a positive impact on close to five million child users across several platforms. The report’s key findings include:

• Significant fines issued; £14.47m fine to Reddit and £247,590 to MediaLab for using children’s personal information unlawfully;
• Securing commitments from Snapchat to strengthen age assurance measures along with an open letter to social media and video sharing platforms setting out age assurance expectations;
• Improving Snapchat and Instagram’s interactive map features;
• Commencing a review of children’s privacy in mobile gaming;
• Launching a programme of risk reviews with 14 age assurance providers.
• Reaching 30% of UK parents with children aged four to 11 years old with their ‘Switched on to privacy’ campaign.

Commenting on the report Katie Searle, ICO Director of Children’s Strategy, says: “Children today are growing up in an extraordinary digital world, and it’s completely understandable that many parents feel like they’re one step behind. The findings are clear: children who discuss online privacy with their parents on a weekly basis are more likely to feel that privacy settings keep them safe. Frequent, open conversation works. Our Switched on to privacy campaign is here to help families find their footing – not by switching everything off, but by staying curious, staying connected, and checking in regularly.”

Alongside this update, the ICO has published the findings of new research studies, including a survey of over 4,000 children aged eight to seventeen and their parents. These reveal a significant gap between parental confidence and children’s actual digital lives:

• Over a third of children talk or play online with people they have never met
• 91% of parents use monitoring tools but 41% of children have tried to get around them

The ICO’s direction of travel is clear; protecting children online, encouraging responsible innovation and strengthening public trust. For organisations handling children’s data, deploying AI and providing digital services more broadly, the message is that data protection, safety and transparency must be built into products, services and governance from the outset.