A scandal that broke earlier this year over alleged misuse of a corporate credit card has come back to bite the Information Commissioner’s Office (ICO).
In February, 2021 the information rights watchdog said it was investigating itself over how one of its corporate credit cards was used to spend £6,248.40 with luxury chocolate specialist Hotel Chocolat.
The charge was disclosed via the ICO’s ‘Publication Scheme’, in the area of their website that covers recent spending over £500. It indicated that the purchase was made on 21st December, 2020 (read here).
It was spotted by a keen eyed reporter at the on-line news website, Insider, and they published the story exclusively (read here). Later picked up by other news outlets, including the BBC.
The ICO’s internal investigation was sparked by the Insider story, having not raised any eyebrows within their own accounts department at the time. This was their statement to the press at the time:
“This payment is currently subject to an internal investigation,”
“We believe that the transaction has been made contrary to ICO policies.
“The ICO is committed to upholding high standards in all aspects of our financial management and controls.
“Should a contravention of our finance policies be confirmed, we will take appropriate action, including ensuring the payment is reimbursed.”
The watchdog is funded via a fee imposed on public authorities, including Government departments and police forces, that process personal data. It also receives government grants.
A recent information request made by the author of this article, Neil Wilby, revealed that the ICO’s total payroll at the end of the last financial year was £53 million, an increase of £2 million over the previous year.
The response to the request also revealed that they employed 822 full time staff in that same period.
The ICO is best known as the statutory regulator with oversight of access requests made via the Freedom of Information Act, 2000. A role it performs, on any independent view, particularly badly. Applicants who appeal to the watchdog over the handling of a request can wait up to a year for a decision.
Very recently, more details have been prised from them over the Hotel Chocolat invoice, which dent their reputation even further. The public are indebted to applicant and information rights activist, Edward Williams, whose FOIA successes include defeating, as a lay litigant, the Driver and Vehicle Licensing Agency (DVLA) at the Upper Tier Tribunal.
A copy of the bill, running to seven pages, can be viewed here.
It has now transpired that 254 members of staff each received a gift of a box of chocolates delivered to their home address. The ICO has declined to name any of the staff, but, more particularly, are still refusing to the name of the officer who made the purchase.
The invoice reveals that 241 boxes of the ‘Everything Sleekster’ chocolates were ordered and paid for. 13 boxes of ‘The Unbelievably Vegan Sleekster’ were also part of the deal which suggests considerable pre-planning.
Of considerably more interest is the fact that the ICO claim that an investigation, into a single invoice from one supplier, that commenced in January was still ongoing, they say, in September, 2021. Moreover, they contended that whilst the internal investigation was ongoing, releasing a copy of the subject invoice would prejudice it.
This is what they said on 10th August, 2021 in what appears to be an attempt to stay the inevitable:
“We have sought the opinion of our qualified person – Elizabeth Denham, the
Information Commissioner. She has concluded that disclosure of the information you have requested would, likely, substantially prejudice the exercise by the ICO of its functions, in this instance our ability to conclude an internal investigation effectively and with due process.
“We must also consider the balance of the public interest. This means we have considered if the public interest in disclosing this information outweighs the public interest in applying the exemption.
“We have found that, on balance, the public interest lies in favour of withholding the information. It is recognised that there is some public interest in release as part of
the ICO’s commitment to openness, transparency, and accountability, particularly
where breaches of internal policy are under investigation. However, this is
outweighed by the strong public interest in allowing internal investigations to
occur and conclude in a way which does not pre-empt findings from the
investigation or deny any staff the right to due process”.
They claimed again, in writing, on 8th and 25th September, 2021 that their investigation was not complete and that an internal review of their freedom of information decision could not be provided, as a result.
Only on pain of issue of an information rights appeal to the General Regulatory Chamber (First Tier Tribunal) did they finally provide a response to the internal review request two days later. It was provided by Jessica Lawlor, Information Access Team Manager at the ICO:
“I am satisfied that at the time of the response [10th August, 2021], that the investigation was ongoing. However, we are able to confirm that the investigation has been finalised and, therefore, we are now in a position where we can provide information to you that was previously withheld.
“The invoice has been attached although you will note that some information has
been redacted as it is considered to be personal information, properly withheld
“I have attached the relevant policies which we consider to be:
(ii) Recognition at the ICO (ii) Procurement and Contract Management.
“The name and job title of the person who made the purchase remains withheld,
in reliance now upon s40(2) FOIA. More information about this exemption can be
found below. Further, the names of the 254 staff who received the chocolate,
which were thank you gifts, are withheld under the same exemption.
“In respect of the recovery of the sum, given that the transaction was not
challenged due to some failures in the oversight of our strict financial controls,
we have decided that it would not be appropriate to require any individual budget
holder to reimburse the funds. Information relating to disciplinary action is
withheld, again in reliance on s40(2) FOIA which relates to personal data.
“We do not consider that disclosing this information into the public domain is
necessary or justified. There is no strong legitimate interest that would override
the prejudice to the rights and freedoms of the relevant data subjects. We have
therefore taken the decision that disclosing this information would be unlawful,
triggering that exemption”..
On the same day, 27th September, 2021, the ICO made further disclosure to another FOIA applicant, Richard Taylor:
“The investigation was carried out by Forbes Solicitors, an independent law firm, and cost £23,027 exclusive of VAT.
“The investigation looked into both the specifics of the transaction and the associated financial controls as well as making any recommendations to avoid similar incidents in the future. We appreciate that the cost of the investigation was greater than the spend it was investigating, but it was important that any investigation was completely independent and was viewed as an investment in continuous improvement and the mitigation of future compliance risk”.
The sum of all of this now appears to be that a ‘budget holder’, presumably a very senior officer in the ICO, has spent over £6,000 of taxpayer funds, apparently in the knowledge that it breached organisational policy, and the public are not to be told who it is or what, if any, disciplinary sanction has been applied.
An eight month investigation, carried out by a firm of lawyers and costing four times the amount paid for the chocolates, has found that there were oversight failures, but the public are not to know by whom and how they came about.
Those same failures are relied upon for the money not being repaid by the budget holder, despite an unequivocal statement by the ICO in February, 2021 that in the event of wrongdoing being identified that they would ensure that reimbursement would be made. Whilst, throughout the process, the ICO claims a commitment to openness, transparency and accountability.
Both Forbes Solicitors and the ICO press office has been contacted with a request for statements.
Further freedom of information requests have also been made to the ICO. Read here and here. The strong suspicion is that this scandal has further to run. The access requests are expected to receive similar resistance to all the others that have been made to the watchdog concerning the same Hotel Chocolat scandal.
Page last updated at 0825hrs on Friday 30th September, 2021
Corrections: Please let me know if there is a mistake in this article. I will endeavour to correct it as soon as possible.
Right of reply: If you are mentioned in this article and disagree with it, please let me have your comments. Provided your response is not defamatory it will be added to the article.
Photo credit: Hotel Chocolat
© Neil Wilby 2015-2021. Unauthorised use, or reproduction, of the material contained in this article, without permission from the author, is strictly prohibited. Extracts from, and links to, the article (or blog) may be used, provided that credit is given to Neil Wilby, with appropriate and specific direction to the original content.