Commissioner Edwards delivers final keynote address at IAPP DPI UK conference

Information Commissioner John Edwards delivered his final keynote address at the IAPP Data Protection Intensive conference in London on Wednesday, marking a period of "extraordinary challenges and change" ranging from the pandemic to rapid technological shifts and legislative uncertainty, culminating in the passing of the Data (Use and Access) Act 2025 (DUA Act) and a new governance structure for the Information Commissioner's Office (ICO). Reflecting on this, Edwards noted that his appearance was also the first and last as the Chair of this new Board.

One of the key themes of Edwards' address was the necessity of strategic prioritisation amidst finite resources. To illustrate the point, Edwards cited the increase in data protection complaints from 40,000 in 2024/25 to a projected 75,000 by the end of the 2025/26 financial year, arguing that it would not "be sustainable or responsible to increase our allocation of resources at the same rate at which those complaints numbers are growing."

On the ICO's recent enforcement strategy, Edwards noted that his office has focused on three core areas: AI and biometrics, children's privacy, and online tracking. Notable actions include a £14.47 million fine issued to Reddit, and the strategic importance of winning its Upper Tribunal appeal against the First-Tier Tribunal decision on Clearview AI Inc., which he claimed is a vital tool for establishing jurisdictional authority over foreign companies.

Looking ahead, Edwards urged organisations to focus on proactive risk management and utilise ICO resources, whether it's to secure cyber defences, adopt a new AI product safely, or improve SAR response time.

Training Announcement: Find out more about our range of independent accredited data protection and AI governance qualifications from IAPP and BCS.