Tim Turner has a somewhat scathing – but seemingly appropriate – commentary on the use of “undertakings” by the Information Commissioner’s Office. It begins:
The Information Commissioner has published the latest in a long line of undertakings, this time involving Northumbria NHS Trust. As always, the ICO’s press release is very misleading about what has really happened. This time, the notice has been ‘issued’, a word clearly intended to imply that the Trust had no choice in the matter. Recent undertakings have also purported to be “rulings“. However, the Information Commissioner has two powers to enforce the Data Protection Act, and the undertaking isn’t one of them.
Read more on 2040 Information Law Blog.