UK—ICO audits private-sector businesses

The Information Commissioner’s Office (ICO) has recently published the results of its audits of the Nationwide Building Society, Google and GE Money Home Lending. These audits are three of the first consensual audits of private-sector companies conducted by the ICO.

Although the scope of consensual audits are agreed with the ICO, the audits conducted by the ICO in this instance covered a wide range of subjects including internal data protection governance, training, the concept of privacy by design, data security and records management. Nationwide Building Society and GE Money Home Lending both received “high assurance” from the ICO that data protection processes and procedures were in place and being adhered to. The ICO likewise found “reasonable assurance” that Google had met the requirements of its undertaking signed in November last year, which required it to improve certain data protection practices following its inadvertent collection of WiFi “payload” data by Street View vehicles.