The UK Information Commissioner's Office (ICO) recently concluded a short consultation period which called for views on proposals to extend its enforcement powers. This included allowing the recovery of profits from the criminal misuse of data under the Proceeds of Crime Act (2002) (POCA), which can be seen here. The proposed extension of the regulators that can investigate and enforce powers under POCA is likely to be of interest to many organisations that hold large volumes of data, such as those in the banking industry. 

Proposed Extension of POCA

These proposals envisage that an Accredited Financial Investigator (AFI) within the ICO will consider means for asset recovery in all cases where offenders have benefited from criminal conduct, including the use of:

• Restraint orders
• Confiscation orders
• Investigatory action, such as obtaining disclosure and information.

Working with Partner Agencies

Usually, the ICO might be expected to work alongside traditional law enforcement agencies that currently possess these POCA powers, such as the SFO, NCA and FCA, and have experience of using them.

The ICO has acknowledged that it had previously worked with other agencies to recover the proceeds of crime but stated that ?these partner agencies are no longer able to provide assistance?. There is currently no proposed guidance, (such as agreements or memorandums of understanding)on how the ICO will work with other agencies in the future.  

Concerns for the Banking and Finance Industry

Tackling economic crime in partnership with public agencies is a top priority for the banking and finance sector. For example, the Economic Crime Plan illustrates the commitment of UK Finance, as a representative of the industry, to develop public-private partnerships to combat money laundering. 

The development is a further example of wider trends of regulators extending their enforcement powers, using dual-track criminal and regulatory investigations (for example, see FCA's comments), and seeking parallel redress from individuals and corporates. 

However, in this case the ICO has not explained why it is unable to work with other agencies and why it needs these new powers. It is also unclear how the ICO intends to use these powers in practice or how it intends to cooperate in the future with other agencies such as the FCA (with which the ICO has a Memorandum of Understanding). Financial services firms no doubt hope that the proposals do not lead to situations where multiple regulators end up using the same (extensive) powers under POCA to investigate the same incidents.

In parallel, financial institutions will be monitoring with interest the consultations announced on 5 December 2019 by the FCA and PRA with regard to operational resilience and outsourcing.