ICO has pumped almost £2.5m and 36 staff into its political data probe – but only 2 are techies

The UK Information Commissioner's Office has spent almost £2.5m on its probe into the use of data analytics for political purposes – but has just two staff from its tech division working on the case.

Figures released under the Freedom of Information Act show the monetary and staff resources the data protection watchdog has put into its investigation into the use of data analytics for political purposes.

The probe was launched before the Facebook and Cambridge Analytica data scandal hit the headlines, but has become inextricably linked with the saga, especially as the commissioner, Elizabeth Denham, has made multiple public pronouncements about the data harvesting scandal.

Beyond this, the work aims to assess the tangled web of data used by various political campaigns and parties, and the role universities have played in the mass slurping and profiling.

The sheer scale of the project has forced the ICO to divert a number of its case workers full-time to the probe, as well as hire in external help.

The cost of the work, to 29 October 2018, stood at £2.44m, according to a response to an FoI request from The Register.

The figure equates to roughly 12 per cent of the body's total costs in the first six months of the 2018-19 financial year, according to the most recent management document (PDF) available on the ICO's website. That document lists the full-year forecast costs at £40.6m and the 2017-18 annual cost as £26.8m.

The ICO's FoI response said that, from April 2018, some 30 staff were working full-time and six part-time on the project. The ICO said it didn't hold data on staffing prior to April 2018, when the Facebook claims broke.

However, the equivalent of just two staff, working on a part-time basis, were from the body's technology and innovation directorate, the FoI said.

Throughout the investigation, the ICO's technical knowledge has been questioned. Cambridge Analytica whistleblower Chris Wylie said that one of the regulator's weak points "is the lack of technical people".

He said that, even up to the point of the much-publicised raid on Cambridge Analytica's offices, the team asked "fairly basic questions" about databases.

"They are in charge of regulating data, so they should have a lot of people who understand how databases work," he told MPs.

The ICO has itself acknowledged that it needs to boost its tech expertise, naming a new lead for technology policy and innovation and an in-house expert on the impact of AI on data privacy, as well as promising more staff training.

However, in order to deal with the current investigation, it has had to fork out for external expertise.

It emphasised in its FoI response that the work was "of unprecedented size and complexity for the ICO", and that the "scale and breadth" of the project meant contracting in other firms.

That includes two external digital forensics firms and five different external law firms and five individuals for legal counsel "to obtain legal support and to assist with separate and specific aspects of the investigation".

It had spent some £717,710 on legal and professional services up to 29 October – which is included in the overall £2.44m figure.

However, the ICO noted these figures will increase, as the investigation is not yet complete and some of the contractors haven't invoiced for all the work.

The Register asked how much the ICO had spent on its IT and technology systems as part of the investigation, but the ICO said it didn't hold any information in scope of the request. ®