Speeches by Darlington.

“I meant it has been forthcoming. It has not disputed that it has needed to provide this information.”

“Okay. We await the final outcome of the initial £12 million fine and the further investigation of TikTok. What is the timeline for that?”

“Has it been happy to give that to you?”

“Okay. You have investigations into TikTok, Imgur—I never know how to pronounce it—and Reddit in terms of their use of data and AI algorithmic targeting of children. Imgur, however you pronounce it, has pulled out of the UK. It has been clear that that is not necessarily as a result of this investigation. TikTok and Red…”

“What more could you do to increase confidence that, when people are proving they are over 18, that data is secure?”

“It will be quite quick. First, the Online Safety Act brought in age verification for access to over-18 material. Have you looked into the third-party providers and the safety of the data? That is what I get the most complaints about in terms of the Online Safety Act. It is not having to prove you are 18, but with whom …”

“This I do know, as opposed to the other statement: we are the second most cyber-attacked country in the world after the US. That can be for commercial purposes to get money. It is also being done by malign actors and state actors across the world to destabilise us as a country. Yes, it is about the safety of our public…”

“The fact that we don’t know definitively, and you don’t know definitively—because it is your role in that assurance—worries me. I would love for you to say, “Absolutely, this does not happen,” but you cannot say that today, and that is what worries me.”

“I am concerned that we don’t know. For me, the role of government and the role that we have is ensuring that our health data, benefits data, taxation data and any other bits of data that government rightly holds on us should be absolutely secure.”

“It is possible that I am asking you to prove proactiveness.”

“You can. Go ahead. I don’t know if I have the answer.”

“I am asking about public service data. We know that there is an over-reliance on non-sovereign companies. Let me put it this way: is the fact that there is an over-reliance on non-sovereign companies in terms of our data handling and use in the public sector of concern to you? Should there be prioritisation and moves w…”

“I am shocked.”

“Okay. That is something for us to note in our report—that there isn’t any regular checking of this.”

“Right. So are you reviewing if the adequate steps are being taken?”

“Who reviews if they are adequate steps? Is that not your office?”

“You don’t believe that, but what is your role as Information Commissioner to take that from, “you don’t believe,” to, “you are sure”?”

“That is not entirely reassuring. Do you have a role in monitoring or in the language used in those contracts to ensure that any use of it would be illegal?”

“To other people in other countries.”

“Public sector data is being held in many cases by non-sovereign third-party providers such as Palantir, AWS and Microsoft services. How do you, as Information Commissioner, ensure that that public sector data is secure, continues to be owned by and the property of Government and public services, and is not being exploi…”