Leadership Crisis at the ICO
In 2025, the UK's data protection regulator faced a leadership crisis when Information Commissioner John Edwards resigned in June after an independent workplace investigation into his conduct. Edwards admitted his position had become "untenable" after the investigation found his behavior, intended as humor, was inappropriate and offensive.
The ICO had already removed Edwards from his duties in April, before the investigation concluded. Paul Arnold took over Edwards' responsibilities during this period. This transition occurred as the Data (Use and Access) Act 2025 received Royal Assent in June, setting the stage for a new governance structure to replace the "corporation sole" model with a board-governed body by September 30, 2025.
Timeline of Events
April 2025: Edwards is removed from his duties as the investigation begins.
June 2025: Edwards resigns, acknowledging inappropriate conduct. The Data (Use and Access) Act 2025 receives Royal Assent.
September 30, 2025: The Information Commission replaces the Information Commissioner, transferring powers to a corporate body with a board.
Post-transition: Paul Arnold serves as interim chief executive. Seven non-executive members join the board, with Maggie Carver as deputy chair. Permanent chair recruitment will conclude by spring 2027.
Governance Failures Exposed
The corporation sole structure concentrated all statutory powers in one person, creating a single point of failure without accountability. When Edwards' conduct was investigated, the ICO lacked a governance framework to ensure operational continuity.
Lack of Segregation of Duties: The Information Commissioner held both executive and regulatory powers. No board oversight existed to review conduct or performance until a crisis emerged.
Absence of Succession Planning: There was no formal deputy commissioner role. When Edwards stepped back, the ICO had to improvise by assigning his responsibilities to Arnold.
No Independent Oversight: The corporation sole model meant the person enforcing workplace standards operated without scrutiny of their own conduct.
Reactive Governance: The investigation that led to Edwards' departure indicates the ICO lacked proactive mechanisms to address conduct issues before they escalated.
New Governance Standards
The Data (Use and Access) Act 2025 mandates a corporate governance structure distributing statutory powers across a board. This aligns with broader governance principles applicable to organizations the ICO regulates.
GDPR Article 5(2) requires controllers to demonstrate accountability, implementing measures to ensure compliance. For a regulatory body, this means enforcing standards it meets internally.
UK Corporate Governance Code suggests boards should balance executive and non-executive directors, with clear responsibility divisions. The new ICO structure incorporates these elements.
ISO/IEC 29134 guidance emphasizes governance structures should identify and mitigate risks before they materialize. The corporation sole model failed by concentrating power.
Actionable Insights for Your Team
If you're a privacy officer or compliance lead, this incident highlights structural vulnerabilities you might replicate.
Audit Your Governance Model: Do you report to a single executive controlling budget, staffing, and audit scope? Document reporting lines and escalation paths for compliance concerns. If they all terminate at one person, you've got a structural problem.
Build Deputy Roles: Your Data Protection Officer shouldn't be the only one fulfilling statutory obligations. Identify a formal deputy with authority to act when needed. Update your GDPR Article 37 notification if you change DPO arrangements.
Separate Oversight from Execution: If your privacy function creates policies and audits compliance, you're missing independent review. Ensure your governance committee includes non-executive members who can challenge decisions without career risk.
Document Conduct Expectations: The ICO incident involved workplace behavior, not technical compliance failures. Your code of conduct should address how compliance personnel interact with staff. A privacy officer creating a hostile environment fails the accountability test.
Test Your Succession Plan: Don't wait for an unplanned departure to discover you can't transfer responsibilities. Run a tabletop exercise: if your DPO resigned today, who'd handle tomorrow's data breach notification? If you can't answer immediately, you're not prepared.
Review Investigation Protocols: If investigating a senior compliance officer, who conducts it? The ICO used an independent investigator. Your HR may not be independent if the compliance officer influences HR policies. Establish clear protocols now.
The ICO's governance overhaul wasn't optional; it became mandatory when the old structure failed. Implement equivalent changes before your structure fails, not after.
