Information Commissioner’s Office (ICO)

Data protection laws in the UK are enforced by the Information Commissioner, whose role is set out in Part 5 and Schedule 12 of the DPA 18 (which implements Articles 57 and 58 of the UK GDPR). Their duties are delegated to the Information Commissioner’s Office (ICO), an independent body with a head office in England and offices in Scotland, Wales and Northern Ireland.

In 2023, the ICO brought out online guidance on individual topics in its Employment practices and data protection series: Monitoring at work (October 2023) and Information about workers’ health (August 2023). Its Guidance on AI and data protection was updated in March 2023. Draft guidance on Keeping employment records and Recruitment and selection is also available on the ICO website. The guidance is updated on an ongoing basis. The earlier Employment Practices Code and supplementary guidance was removed in December 2023.

The ICO’s Video surveillance guidance covers the use of CCTV, body worn video and facial recognition technology and includes guidance for employers who use such monitoring techniques. Local authorities in England and Wales who operate surveillance cameras in a public place must also comply with the Protection of Freedoms Act 2012. There are separate laws and guidance for the use of surveillance in connection with law enforcement.