Commissioner Edwards resignation is an opportunity to reset the ICO

Following the news that Information Commissioner John Edwards has resigned, the Open Rights Group (ORG) has called on the government to appoint a successor who will uphold information rights and enforce UK data protection laws. Edwards announced his resignation in a LinkedIn post, following a workplace investigation into undisclosed allegations, which found there is a case to answer. 

The call comes after the ICO released a statement on Friday, 19 June 2026, confirming that Edwards had resigned. 

This was followed over the weekend by a statement on LinkedIn by Secretary of State for Science, Innovation and Technology, Liz Kendall, in which she claimed to have "seen evidence of the vulgar and highly sexualised language that was used in his interactions with his staff and am extremely concerned that he continues to describe these incidents as misplaced humour, including on his social media post announcing his resignation. Such conduct does not belong in the workplace, least of all exhibited by the leader of an organisation.

"Multiple women shared testimony to the investigator on feeling offended, shocked and uncomfortable following interactions with Mr Edwards. I am deeply grateful to all who came forward to share their experiences as part of this investigation."

Following Kendall's comments, in an update to its statement, the ICO added: "Mr Edwards' actions were completely at odds with our values. We do not accept sexual harassment, bullying or discrimination in any form and have clear policies in place to deal with issues such as these. We're committed to ensuring a safe culture where all staff are able to raise concerns, knowing they will be taken seriously and trusting that action will be taken where appropriate. This must include concerns raised about the behaviour of the holder of the important and privileged role of Information Commissioner.

"Our priority continues to be providing a safe and supportive environment for our staff. We have been unable to comment as the investigation was ongoing, but our utmost focus has always been on supporting those affected. We thank all ICO colleagues for their professionalism and especially those who courageously shared their experiences as part of the independent investigation."

Seperately, in comments given to the Daily Mail about the story, Fran Heathcote, General Secretary of the Public and Commercial Services Union (PCS) said: "While the former commissioner has sought to characterise the issues that led to his departure as a series of misjudged jokes, the allegations that prompted the investigation, including bullying and sexual harassment, are no laughing matter.

"They have had a profound impact on the victims involved and on the many dedicated professionals we represent across the ICO. PCS stands in solidarity with all those who showed immense courage in coming forward and speaking truth to power under exceptionally difficult circumstances. We hope today brings them a measure of vindication."

Heathcote added: 'At a time when AI is reshaping society and personal data has never been more valuable, the work carried out by ICO staff has never been more important."

Meanwhile on Monday, Mlex (£) reports that: "Despite the ICO’s relative silence, comments about the workplace culture at Britain’s privacy regulator have been increasingly common since the investigation started, even if most remarks were made privately...MLex understands Edwards was often described as “a bully” by current and former ICO employees. Beyond complaints of harassment and dismissive treatment of staff, a disproportionate growth in the numbers of staff at director and executive director levels while lower-grade staff were under extreme stress was also pointed out as a key factor contributing to a poor workplace environment."

Editors note: Time for a reset indeed. 

£ - This article requires a subscription. 

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.