The ICO at a Crossroads: What John Edwards's Resignation Means for Data Protection, AI Governance and the Future of UK Regulation
John Edwards’s resignation as UK Information Commissioner (ICO) on 19 June 2026 followed an independent workplace investigation that found Mr Edwards’s conduct fell short of the standard expected of a public official, including using language that the Secretary of State for Science, Innovation and Technology described as “vulgar and highly sexualised”.
It is the first resignation in the 42-year history of the office. While the circumstances of Mr Edwards’s departure have attracted significant press attention, the more material question for organisations subject to ICO oversight is what the leadership transition means for the office’s ongoing regulatory work–in particular, its developing approach to artificial intelligence and children’s online safety.
Governance Uncertainty During Transition
Mr Edwards’s departure creates uncertainty beyond the immediate leadership vacancy at a critical moment of transition for the ICO. Under the Data (Use and Access) Act 2025 (DUAA), the ICO is transitioning from a “corporation sole” model, where all of the statutory powers are vested in the Information Commissioner personally, to a board-governed Information Commission, comprising a chair, a separate chief executive, and non-executive directors. Mr Edwards was due to chair that new body. His resignation vacates both roles simultaneously, and the government has not yet confirmed a timeline for filling either role.
As at the date of this 4 August, the seven non-executive directors provided for under the new structure have not been named, and the board has not been constituted. Paul Arnold, the ICO’s Deputy Commissioner and Interim Chief Executive Designate, continues to lead day-to-day operations, but the strategic leadership functions – setting regulatory direction, representing the organisation publicly, and taking the most consequential enforcement decisions – remain without a confirmed office-holder pending the government’s next steps.
Enforcement Credibility Predates the Resignation
The leadership question sits alongside separate, longer-running criticism of the ICO’s enforcement record, and the challenges it faces run deeper than one commissioner’s conduct. While the ICO’s incoming caseload grew by just over a quarter between 2022 and 2025, its open caseload grew more than fourfold. Similarly, the number of data protection complaints which remained open increased by 70% across the last two reporting years, and those that received no response at all within the expected three months rose by 360% in the same period. Campaign groups including the Good Law Project and the Open Rights Group have threatened legal action over the backlog. The Open Rights Group’s executive director put it plainly on Mr Edwards’s departure: this is an opportunity to appoint a regulator with teeth.
Mr Edwards’s enforcement philosophy, under which the regulator reduced financial penalties for public sector bodies in favour of reprimands, has also generated debate. The rationale advanced by the ICO seems coherent – penalising public bodies with public money is arguably circular – but it created a two-tier enforcement reality. Of the 29 reprimands issued in 2023, for example, nine recipients were private companies. The resulting divergence in treatment is one that any new commissioner will likely be expected to address, whether by strengthening the practical consequences of a reprimand or by articulating a clearer, more principled framework for when financial penalties apply across the board.
Why Strong Regulatory Leadership Matters for Regulatory Effectiveness
Regulatory effectiveness is fundamentally a leadership question, and the ICO illustrates why more acutely than most. The office’s powers are only as meaningful as its willingness to use them. A regulator that has the tools to enforce but consistently chooses the softer option very quickly becomes one that sophisticated organisations learn to manage rather than genuinely respect. Once that perception takes hold, it is extremely difficult to reverse.
Strong regulatory leadership means several things simultaneously. It means enforcement credibility, consistency, and transparency, so that organisations can predict how the regulator will behave, trust that their concerns will be taken seriously within a reasonable timeframe, and plan accordingly. And finally, it means independence, being the ability to make difficult decisions against politically connected respondents without flinching.
The ICO’s unusual dual statutory mandate – oversight of data protection the on one hand and freedom of information on the other – can produce competing regulatory priorities. Clear leadership is relevant to how those priorities are balanced in practice, and organisations operating in sectors subject to both regimes should monitor how the incoming leadership approaches this balance.
AI and Children’s Online Safety: Current Enforcement Priorities
The incoming commissioner will face no shortage of immediate pressures, but the technology challenge is the one that will define their tenure. AI and children’s online safety are not future concerns – they are current enforcement priorities that already outpace the regulatory framework. The ICO’s investigation into TikTok’s use of the personal information of 13- to 17-year-olds in its recommender systems, opened in March 2025, remains ongoing more than a year later. As of its most recent public update, the ICO indicated that it is still developing its understanding of how the law applies to recommender systems of this algorithmic kind.
The platforms operating in this space are sophisticated and well-advised. A purely complaint-driven enforcement model is structurally inadequate for addressing harms that are systemic and diffuse. The next commissioner will face pressure from civil society, from Parliament, and from the government’s own AI policy agenda to demonstrate that the ICO can get ahead of the curve.
On children’s online safety specifically, the ICO’s Age-Appropriate Design Code, introduced in 2020, was one of the first statutory codes of its kind internationally. While the ICO has been stepping up its investigatory activity in this area, there is an opportunity for a new commissioner seeking to establish an early regulatory direction to look at enforcement activity in this area as one way of doing so.
The Statutory AI Code of Practice: Strategic Stakes
Perhaps the most consequential piece of work now caught in the transition is the statutory AI Code of Practice, which the ICO is developing under the DUAA. This is not a peripheral document, but arguably the most significant regulatory output the ICO will produce in this parliament, and the leadership transition creates genuine risk around its delivery.
Major statutory codes of this kind reflect the commissioner’s regulatory philosophy, including their appetite for prescription versus principles-based guidance, and their view about where the boundaries of the ICO’s authority lie in relation to other regulators. A new commissioner with different instincts on any of those questions may reasonably want to review work already in progress before it is finalised. That is a legitimate exercise of leadership judgment, but it also creates a realistic possibility of delay, with corresponding consequences for organisations seeking regulatory certainty as they develop and deploy AI systems.
The ICO also does not operate in isolation in this area. It sits alongside the AI Security Institute, the Competition and Markets Authority, Ofcom, and the Financial Conduct Authority, all of whom have overlapping interests in AI governance. A prolonged leadership vacuum may weaken the ICO’s influence in those inter-agency conversations shaping the broader architecture of UK AI regulation.
What the Appointment Process Should Signal
The circumstances of Mr Edwards’s departure are relevant to how the appointment process is conducted, not merely to who is ultimately appointed. Given the severity of the findings of the workplace investigation, stakeholders will expect that the appointment process itself (including selection criteria, board compositions, and the mechanisms by which the new commissioner will be held to account) reflects the same standards the ICO expects of the organisations it regulates.
What Organisations Should Do Now
Businesses that are subject to ICO oversight should bear the following in mind as they navigate this leadership transition:
- Treat the transition as a period of continuity, not reduced risk. The ICO’s executive team continues to operate, existing enforcement activity has not paused, and the underlying legal framework has not changed.
- Review compliance programmes calibrated to recent enforcement patterns. Organisations whose data protection or AI governance practices have been shaped by the ICO’s comparatively restrained recent enforcement posture should consider whether that calibration remains appropriate under new leadership.
- Monitor the statutory AI Code of Practice closely. Given the code’s prospective legal weight, organisations developing or deploying AI systems that process personal data should track its progress and consider engaging with the ICO’s consultation process where relevant.
- Account for UK-EU regulatory divergence. Organisations operating across both jurisdictions should note that the UK’s post-Brexit data protection framework and the EU AI Act do not map onto one another in all respects, and should seek advice calibrated to both regimes rather than a single compliance checklist.
- Engage constructively and early. Organisations are encouraged to engage with ICO guidance processes ahead of enforcement action, particularly in developing areas such as AI governance.
The ICO’s new leadership, once appointed, will be operating under significant scrutiny and will likely be motivated to demonstrate early regulatory impact. Organisations that engage proactively with the developing framework – rather than waiting for enforcement activity to define their obligations – are likely to be better positioned as that framework takes shape.
Joanna Ludlam is a Partner and Co-Chair of Global Crisis Management and Strategic Risk at Jenner & Block. She advises boards, senior executives, and general counsel on regulatory defence, internal investigations, crisis management, and public law, with a particular focus on the intersection of law, regulation, and reputation. Elizabeth Barbeary is an associate at Jenner & Block specialising in public law and complex litigation and investigations.
Governance Uncertainty During Transition
Mr Edwards’s departure creates uncertainty beyond the immediate leadership vacancy at a critical moment of transition for the ICO. Under the Data (Use and Access) Act 2025 (DUAA), the ICO is transitioning from a “corporation sole” model, where all of the statutory powers are vested in the Information Commissioner personally, to a board-governed Information Commission, comprising a chair, a separate chief executive, and non-executive directors. Mr Edwards was due to chair that new body. His resignation vacates both roles simultaneously, and the government has not yet confirmed a timeline for filling either role.
As at the date of this 4 August, the seven non-executive directors provided for under the new structure have not been named, and the board has not been constituted. Paul Arnold, the ICO’s Deputy Commissioner and Interim Chief Executive Designate, continues to lead day-to-day operations, but the strategic leadership functions – setting regulatory direction, representing the organisation publicly, and taking the most consequential enforcement decisions – remain without a confirmed office-holder pending the government’s next steps.
Enforcement Credibility Predates the Resignation
The leadership question sits alongside separate, longer-running criticism of the ICO’s enforcement record, and the challenges it faces run deeper than one commissioner’s conduct. While the ICO’s incoming caseload grew by just over a quarter between 2022 and 2025, its open caseload grew more than fourfold. Similarly, the number of data protection complaints which remained open increased by 70% across the last two reporting years, and those that received no response at all within the expected three months rose by 360% in the same period. Campaign groups including the Good Law Project and the Open Rights Group have threatened legal action over the backlog. The Open Rights Group’s executive director put it plainly on Mr Edwards’s departure: this is an opportunity to appoint a regulator with teeth.
Mr Edwards’s enforcement philosophy, under which the regulator reduced financial penalties for public sector bodies in favour of reprimands, has also generated debate. The rationale advanced by the ICO seems coherent – penalising public bodies with public money is arguably circular – but it created a two-tier enforcement reality. Of the 29 reprimands issued in 2023, for example, nine recipients were private companies. The resulting divergence in treatment is one that any new commissioner will likely be expected to address, whether by strengthening the practical consequences of a reprimand or by articulating a clearer, more principled framework for when financial penalties apply across the board.
Why Strong Regulatory Leadership Matters for Regulatory Effectiveness
Regulatory effectiveness is fundamentally a leadership question, and the ICO illustrates why more acutely than most. The office’s powers are only as meaningful as its willingness to use them. A regulator that has the tools to enforce but consistently chooses the softer option very quickly becomes one that sophisticated organisations learn to manage rather than genuinely respect. Once that perception takes hold, it is extremely difficult to reverse.
Strong regulatory leadership means several things simultaneously. It means enforcement credibility, consistency, and transparency, so that organisations can predict how the regulator will behave, trust that their concerns will be taken seriously within a reasonable timeframe, and plan accordingly. And finally, it means independence, being the ability to make difficult decisions against politically connected respondents without flinching.
The ICO’s unusual dual statutory mandate – oversight of data protection the on one hand and freedom of information on the other – can produce competing regulatory priorities. Clear leadership is relevant to how those priorities are balanced in practice, and organisations operating in sectors subject to both regimes should monitor how the incoming leadership approaches this balance.
AI and Children’s Online Safety: Current Enforcement Priorities
The incoming commissioner will face no shortage of immediate pressures, but the technology challenge is the one that will define their tenure. AI and children’s online safety are not future concerns – they are current enforcement priorities that already outpace the regulatory framework. The ICO’s investigation into TikTok’s use of the personal information of 13- to 17-year-olds in its recommender systems, opened in March 2025, remains ongoing more than a year later. As of its most recent public update, the ICO indicated that it is still developing its understanding of how the law applies to recommender systems of this algorithmic kind.
The platforms operating in this space are sophisticated and well-advised. A purely complaint-driven enforcement model is structurally inadequate for addressing harms that are systemic and diffuse. The next commissioner will face pressure from civil society, from Parliament, and from the government’s own AI policy agenda to demonstrate that the ICO can get ahead of the curve.
On children’s online safety specifically, the ICO’s Age-Appropriate Design Code, introduced in 2020, was one of the first statutory codes of its kind internationally. While the ICO has been stepping up its investigatory activity in this area, there is an opportunity for a new commissioner seeking to establish an early regulatory direction to look at enforcement activity in this area as one way of doing so.
The Statutory AI Code of Practice: Strategic Stakes
Perhaps the most consequential piece of work now caught in the transition is the statutory AI Code of Practice, which the ICO is developing under the DUAA. This is not a peripheral document, but arguably the most significant regulatory output the ICO will produce in this parliament, and the leadership transition creates genuine risk around its delivery.
Major statutory codes of this kind reflect the commissioner’s regulatory philosophy, including their appetite for prescription versus principles-based guidance, and their view about where the boundaries of the ICO’s authority lie in relation to other regulators. A new commissioner with different instincts on any of those questions may reasonably want to review work already in progress before it is finalised. That is a legitimate exercise of leadership judgment, but it also creates a realistic possibility of delay, with corresponding consequences for organisations seeking regulatory certainty as they develop and deploy AI systems.
The ICO also does not operate in isolation in this area. It sits alongside the AI Security Institute, the Competition and Markets Authority, Ofcom, and the Financial Conduct Authority, all of whom have overlapping interests in AI governance. A prolonged leadership vacuum may weaken the ICO’s influence in those inter-agency conversations shaping the broader architecture of UK AI regulation.
What the Appointment Process Should Signal
The circumstances of Mr Edwards’s departure are relevant to how the appointment process is conducted, not merely to who is ultimately appointed. Given the severity of the findings of the workplace investigation, stakeholders will expect that the appointment process itself (including selection criteria, board compositions, and the mechanisms by which the new commissioner will be held to account) reflects the same standards the ICO expects of the organisations it regulates.
What Organisations Should Do Now
Businesses that are subject to ICO oversight should bear the following in mind as they navigate this leadership transition:
- Treat the transition as a period of continuity, not reduced risk. The ICO’s executive team continues to operate, existing enforcement activity has not paused, and the underlying legal framework has not changed.
- Review compliance programmes calibrated to recent enforcement patterns. Organisations whose data protection or AI governance practices have been shaped by the ICO’s comparatively restrained recent enforcement posture should consider whether that calibration remains appropriate under new leadership.
- Monitor the statutory AI Code of Practice closely. Given the code’s prospective legal weight, organisations developing or deploying AI systems that process personal data should track its progress and consider engaging with the ICO’s consultation process where relevant.
- Account for UK-EU regulatory divergence. Organisations operating across both jurisdictions should note that the UK’s post-Brexit data protection framework and the EU AI Act do not map onto one another in all respects, and should seek advice calibrated to both regimes rather than a single compliance checklist.
- Engage constructively and early. Organisations are encouraged to engage with ICO guidance processes ahead of enforcement action, particularly in developing areas such as AI governance.
The ICO’s new leadership, once appointed, will be operating under significant scrutiny and will likely be motivated to demonstrate early regulatory impact. Organisations that engage proactively with the developing framework – rather than waiting for enforcement activity to define their obligations – are likely to be better positioned as that framework takes shape.
Joanna Ludlam is a Partner and Co-Chair of Global Crisis Management and Strategic Risk at Jenner & Block. She advises boards, senior executives, and general counsel on regulatory defence, internal investigations, crisis management, and public law, with a particular focus on the intersection of law, regulation, and reputation. Elizabeth Barbeary is an associate at Jenner & Block specialising in public law and complex litigation and investigations.
Related Attorneys
© 2026 Jenner & Block LLP. Attorney Advertising. Jenner & Block LLP is an Illinois Limited Liability Partnership including professional corporations. This publication, presentation, or event is not intended to provide legal advice but to provide information on legal matters and/or firm news of interest to our clients and colleagues. Readers or attendees should seek specific legal advice before taking any action with respect to matters mentioned in this publication or at this event. The attorney responsible for this communication is Brent E. Kidwell, Jenner & Block LLP, 353 N. Clark Street, Chicago, IL 60654-3456. Prior results do not guarantee a similar outcome. Jenner & Block London LLP, an affiliate of Jenner & Block LLP, is a limited liability partnership established under the laws of the State of Delaware, USA and is authorised and regulated by the Solicitors Regulation Authority with SRA number 615729. Information regarding the data we collect and the rights you have over your data can be found in our Privacy Notice. For further inquiries, please contact dataprotection@jenner.com.
John Edwards’s resignation as UK Information Commissioner (ICO) on 19 June 2026 followed an independent workplace investigation that found Mr Edwards’s conduct fell short of the standard expected of a public official, including using language that the Secretary of State for Science, Innovation and Technology described as “vulgar and highly sexualised”.
It is the first resignation in the 42-year history of the office. While the circumstances of Mr Edwards’s departure have attracted significant press attention, the more material question for organisations subject to ICO oversight is what the leadership transition means for the office’s ongoing regulatory work–in particular, its developing approach to artificial intelligence and children’s online safety.
Governance Uncertainty During Transition
Mr Edwards’s departure creates uncertainty beyond the immediate leadership vacancy at a critical moment of transition for the ICO. Under the Data (Use and Access) Act 2025 (DUAA), the ICO is transitioning from a “corporation sole” model, where all of the statutory powers are vested in the Information Commissioner personally, to a board-governed Information Commission, comprising a chair, a separate chief executive, and non-executive directors. Mr Edwards was due to chair that new body. His resignation vacates both roles simultaneously, and the government has not yet confirmed a timeline for filling either role.
As at the date of this 4 August, the seven non-executive directors provided for under the new structure have not been named, and the board has not been constituted. Paul Arnold, the ICO’s Deputy Commissioner and Interim Chief Executive Designate, continues to lead day-to-day operations, but the strategic leadership functions – setting regulatory direction, representing the organisation publicly, and taking the most consequential enforcement decisions – remain without a confirmed office-holder pending the government’s next steps.
Enforcement Credibility Predates the Resignation
The leadership question sits alongside separate, longer-running criticism of the ICO’s enforcement record, and the challenges it faces run deeper than one commissioner’s conduct. While the ICO’s incoming caseload grew by just over a quarter between 2022 and 2025, its open caseload grew more than fourfold. Similarly, the number of data protection complaints which remained open increased by 70% across the last two reporting years, and those that received no response at all within the expected three months rose by 360% in the same period. Campaign groups including the Good Law Project and the Open Rights Group have threatened legal action over the backlog. The Open Rights Group’s executive director put it plainly on Mr Edwards’s departure: this is an opportunity to appoint a regulator with teeth.
Mr Edwards’s enforcement philosophy, under which the regulator reduced financial penalties for public sector bodies in favour of reprimands, has also generated debate. The rationale advanced by the ICO seems coherent – penalising public bodies with public money is arguably circular – but it created a two-tier enforcement reality. Of the 29 reprimands issued in 2023, for example, nine recipients were private companies. The resulting divergence in treatment is one that any new commissioner will likely be expected to address, whether by strengthening the practical consequences of a reprimand or by articulating a clearer, more principled framework for when financial penalties apply across the board.
Why Strong Regulatory Leadership Matters for Regulatory Effectiveness
Regulatory effectiveness is fundamentally a leadership question, and the ICO illustrates why more acutely than most. The office’s powers are only as meaningful as its willingness to use them. A regulator that has the tools to enforce but consistently chooses the softer option very quickly becomes one that sophisticated organisations learn to manage rather than genuinely respect. Once that perception takes hold, it is extremely difficult to reverse.
Strong regulatory leadership means several things simultaneously. It means enforcement credibility, consistency, and transparency, so that organisations can predict how the regulator will behave, trust that their concerns will be taken seriously within a reasonable timeframe, and plan accordingly. And finally, it means independence, being the ability to make difficult decisions against politically connected respondents without flinching.
The ICO’s unusual dual statutory mandate – oversight of data protection the on one hand and freedom of information on the other – can produce competing regulatory priorities. Clear leadership is relevant to how those priorities are balanced in practice, and organisations operating in sectors subject to both regimes should monitor how the incoming leadership approaches this balance.
AI and Children’s Online Safety: Current Enforcement Priorities
The incoming commissioner will face no shortage of immediate pressures, but the technology challenge is the one that will define their tenure. AI and children’s online safety are not future concerns – they are current enforcement priorities that already outpace the regulatory framework. The ICO’s investigation into TikTok’s use of the personal information of 13- to 17-year-olds in its recommender systems, opened in March 2025, remains ongoing more than a year later. As of its most recent public update, the ICO indicated that it is still developing its understanding of how the law applies to recommender systems of this algorithmic kind.
The platforms operating in this space are sophisticated and well-advised. A purely complaint-driven enforcement model is structurally inadequate for addressing harms that are systemic and diffuse. The next commissioner will face pressure from civil society, from Parliament, and from the government’s own AI policy agenda to demonstrate that the ICO can get ahead of the curve.
On children’s online safety specifically, the ICO’s Age-Appropriate Design Code, introduced in 2020, was one of the first statutory codes of its kind internationally. While the ICO has been stepping up its investigatory activity in this area, there is an opportunity for a new commissioner seeking to establish an early regulatory direction to look at enforcement activity in this area as one way of doing so.
The Statutory AI Code of Practice: Strategic Stakes
Perhaps the most consequential piece of work now caught in the transition is the statutory AI Code of Practice, which the ICO is developing under the DUAA. This is not a peripheral document, but arguably the most significant regulatory output the ICO will produce in this parliament, and the leadership transition creates genuine risk around its delivery.
Major statutory codes of this kind reflect the commissioner’s regulatory philosophy, including their appetite for prescription versus principles-based guidance, and their view about where the boundaries of the ICO’s authority lie in relation to other regulators. A new commissioner with different instincts on any of those questions may reasonably want to review work already in progress before it is finalised. That is a legitimate exercise of leadership judgment, but it also creates a realistic possibility of delay, with corresponding consequences for organisations seeking regulatory certainty as they develop and deploy AI systems.
The ICO also does not operate in isolation in this area. It sits alongside the AI Security Institute, the Competition and Markets Authority, Ofcom, and the Financial Conduct Authority, all of whom have overlapping interests in AI governance. A prolonged leadership vacuum may weaken the ICO’s influence in those inter-agency conversations shaping the broader architecture of UK AI regulation.
What the Appointment Process Should Signal
The circumstances of Mr Edwards’s departure are relevant to how the appointment process is conducted, not merely to who is ultimately appointed. Given the severity of the findings of the workplace investigation, stakeholders will expect that the appointment process itself (including selection criteria, board compositions, and the mechanisms by which the new commissioner will be held to account) reflects the same standards the ICO expects of the organisations it regulates.
What Organisations Should Do Now
Businesses that are subject to ICO oversight should bear the following in mind as they navigate this leadership transition:
- Treat the transition as a period of continuity, not reduced risk. The ICO’s executive team continues to operate, existing enforcement activity has not paused, and the underlying legal framework has not changed.
- Review compliance programmes calibrated to recent enforcement patterns. Organisations whose data protection or AI governance practices have been shaped by the ICO’s comparatively restrained recent enforcement posture should consider whether that calibration remains appropriate under new leadership.
- Monitor the statutory AI Code of Practice closely. Given the code’s prospective legal weight, organisations developing or deploying AI systems that process personal data should track its progress and consider engaging with the ICO’s consultation process where relevant.
- Account for UK-EU regulatory divergence. Organisations operating across both jurisdictions should note that the UK’s post-Brexit data protection framework and the EU AI Act do not map onto one another in all respects, and should seek advice calibrated to both regimes rather than a single compliance checklist.
- Engage constructively and early. Organisations are encouraged to engage with ICO guidance processes ahead of enforcement action, particularly in developing areas such as AI governance.
The ICO’s new leadership, once appointed, will be operating under significant scrutiny and will likely be motivated to demonstrate early regulatory impact. Organisations that engage proactively with the developing framework – rather than waiting for enforcement activity to define their obligations – are likely to be better positioned as that framework takes shape.
Joanna Ludlam is a Partner and Co-Chair of Global Crisis Management and Strategic Risk at Jenner & Block. She advises boards, senior executives, and general counsel on regulatory defence, internal investigations, crisis management, and public law, with a particular focus on the intersection of law, regulation, and reputation. Elizabeth Barbeary is an associate at Jenner & Block specialising in public law and complex litigation and investigations.
Governance Uncertainty During Transition
Mr Edwards’s departure creates uncertainty beyond the immediate leadership vacancy at a critical moment of transition for the ICO. Under the Data (Use and Access) Act 2025 (DUAA), the ICO is transitioning from a “corporation sole” model, where all of the statutory powers are vested in the Information Commissioner personally, to a board-governed Information Commission, comprising a chair, a separate chief executive, and non-executive directors. Mr Edwards was due to chair that new body. His resignation vacates both roles simultaneously, and the government has not yet confirmed a timeline for filling either role.
As at the date of this 4 August, the seven non-executive directors provided for under the new structure have not been named, and the board has not been constituted. Paul Arnold, the ICO’s Deputy Commissioner and Interim Chief Executive Designate, continues to lead day-to-day operations, but the strategic leadership functions – setting regulatory direction, representing the organisation publicly, and taking the most consequential enforcement decisions – remain without a confirmed office-holder pending the government’s next steps.
Enforcement Credibility Predates the Resignation
The leadership question sits alongside separate, longer-running criticism of the ICO’s enforcement record, and the challenges it faces run deeper than one commissioner’s conduct. While the ICO’s incoming caseload grew by just over a quarter between 2022 and 2025, its open caseload grew more than fourfold. Similarly, the number of data protection complaints which remained open increased by 70% across the last two reporting years, and those that received no response at all within the expected three months rose by 360% in the same period. Campaign groups including the Good Law Project and the Open Rights Group have threatened legal action over the backlog. The Open Rights Group’s executive director put it plainly on Mr Edwards’s departure: this is an opportunity to appoint a regulator with teeth.
Mr Edwards’s enforcement philosophy, under which the regulator reduced financial penalties for public sector bodies in favour of reprimands, has also generated debate. The rationale advanced by the ICO seems coherent – penalising public bodies with public money is arguably circular – but it created a two-tier enforcement reality. Of the 29 reprimands issued in 2023, for example, nine recipients were private companies. The resulting divergence in treatment is one that any new commissioner will likely be expected to address, whether by strengthening the practical consequences of a reprimand or by articulating a clearer, more principled framework for when financial penalties apply across the board.
Why Strong Regulatory Leadership Matters for Regulatory Effectiveness
Regulatory effectiveness is fundamentally a leadership question, and the ICO illustrates why more acutely than most. The office’s powers are only as meaningful as its willingness to use them. A regulator that has the tools to enforce but consistently chooses the softer option very quickly becomes one that sophisticated organisations learn to manage rather than genuinely respect. Once that perception takes hold, it is extremely difficult to reverse.
Strong regulatory leadership means several things simultaneously. It means enforcement credibility, consistency, and transparency, so that organisations can predict how the regulator will behave, trust that their concerns will be taken seriously within a reasonable timeframe, and plan accordingly. And finally, it means independence, being the ability to make difficult decisions against politically connected respondents without flinching.
The ICO’s unusual dual statutory mandate – oversight of data protection the on one hand and freedom of information on the other – can produce competing regulatory priorities. Clear leadership is relevant to how those priorities are balanced in practice, and organisations operating in sectors subject to both regimes should monitor how the incoming leadership approaches this balance.
AI and Children’s Online Safety: Current Enforcement Priorities
The incoming commissioner will face no shortage of immediate pressures, but the technology challenge is the one that will define their tenure. AI and children’s online safety are not future concerns – they are current enforcement priorities that already outpace the regulatory framework. The ICO’s investigation into TikTok’s use of the personal information of 13- to 17-year-olds in its recommender systems, opened in March 2025, remains ongoing more than a year later. As of its most recent public update, the ICO indicated that it is still developing its understanding of how the law applies to recommender systems of this algorithmic kind.
The platforms operating in this space are sophisticated and well-advised. A purely complaint-driven enforcement model is structurally inadequate for addressing harms that are systemic and diffuse. The next commissioner will face pressure from civil society, from Parliament, and from the government’s own AI policy agenda to demonstrate that the ICO can get ahead of the curve.
On children’s online safety specifically, the ICO’s Age-Appropriate Design Code, introduced in 2020, was one of the first statutory codes of its kind internationally. While the ICO has been stepping up its investigatory activity in this area, there is an opportunity for a new commissioner seeking to establish an early regulatory direction to look at enforcement activity in this area as one way of doing so.
The Statutory AI Code of Practice: Strategic Stakes
Perhaps the most consequential piece of work now caught in the transition is the statutory AI Code of Practice, which the ICO is developing under the DUAA. This is not a peripheral document, but arguably the most significant regulatory output the ICO will produce in this parliament, and the leadership transition creates genuine risk around its delivery.
Major statutory codes of this kind reflect the commissioner’s regulatory philosophy, including their appetite for prescription versus principles-based guidance, and their view about where the boundaries of the ICO’s authority lie in relation to other regulators. A new commissioner with different instincts on any of those questions may reasonably want to review work already in progress before it is finalised. That is a legitimate exercise of leadership judgment, but it also creates a realistic possibility of delay, with corresponding consequences for organisations seeking regulatory certainty as they develop and deploy AI systems.
The ICO also does not operate in isolation in this area. It sits alongside the AI Security Institute, the Competition and Markets Authority, Ofcom, and the Financial Conduct Authority, all of whom have overlapping interests in AI governance. A prolonged leadership vacuum may weaken the ICO’s influence in those inter-agency conversations shaping the broader architecture of UK AI regulation.
What the Appointment Process Should Signal
The circumstances of Mr Edwards’s departure are relevant to how the appointment process is conducted, not merely to who is ultimately appointed. Given the severity of the findings of the workplace investigation, stakeholders will expect that the appointment process itself (including selection criteria, board compositions, and the mechanisms by which the new commissioner will be held to account) reflects the same standards the ICO expects of the organisations it regulates.
What Organisations Should Do Now
Businesses that are subject to ICO oversight should bear the following in mind as they navigate this leadership transition:
- Treat the transition as a period of continuity, not reduced risk. The ICO’s executive team continues to operate, existing enforcement activity has not paused, and the underlying legal framework has not changed.
- Review compliance programmes calibrated to recent enforcement patterns. Organisations whose data protection or AI governance practices have been shaped by the ICO’s comparatively restrained recent enforcement posture should consider whether that calibration remains appropriate under new leadership.
- Monitor the statutory AI Code of Practice closely. Given the code’s prospective legal weight, organisations developing or deploying AI systems that process personal data should track its progress and consider engaging with the ICO’s consultation process where relevant.
- Account for UK-EU regulatory divergence. Organisations operating across both jurisdictions should note that the UK’s post-Brexit data protection framework and the EU AI Act do not map onto one another in all respects, and should seek advice calibrated to both regimes rather than a single compliance checklist.
- Engage constructively and early. Organisations are encouraged to engage with ICO guidance processes ahead of enforcement action, particularly in developing areas such as AI governance.
The ICO’s new leadership, once appointed, will be operating under significant scrutiny and will likely be motivated to demonstrate early regulatory impact. Organisations that engage proactively with the developing framework – rather than waiting for enforcement activity to define their obligations – are likely to be better positioned as that framework takes shape.
Joanna Ludlam is a Partner and Co-Chair of Global Crisis Management and Strategic Risk at Jenner & Block. She advises boards, senior executives, and general counsel on regulatory defence, internal investigations, crisis management, and public law, with a particular focus on the intersection of law, regulation, and reputation. Elizabeth Barbeary is an associate at Jenner & Block specialising in public law and complex litigation and investigations.
Related Attorneys
© 2026 Jenner & Block LLP. Attorney Advertising. Jenner & Block LLP is an Illinois Limited Liability Partnership including professional corporations. This publication, presentation, or event is not intended to provide legal advice but to provide information on legal matters and/or firm news of interest to our clients and colleagues. Readers or attendees should seek specific legal advice before taking any action with respect to matters mentioned in this publication or at this event. The attorney responsible for this communication is Brent E. Kidwell, Jenner & Block LLP, 353 N. Clark Street, Chicago, IL 60654-3456. Prior results do not guarantee a similar outcome. Jenner & Block London LLP, an affiliate of Jenner & Block LLP, is a limited liability partnership established under the laws of the State of Delaware, USA and is authorised and regulated by the Solicitors Regulation Authority with SRA number 615729. Information regarding the data we collect and the rights you have over your data can be found in our Privacy Notice. For further inquiries, please contact dataprotection@jenner.com.
News and Insights
Publications
"DC Circuit Undercuts Congress's Subpoena Power: Important New Authority for Targets of Congressional Investigations," National Law Journal
In the National Law Journal, Congressional Investigations Co-Chair Emily Loeb, Special Counsel David Manners-Weber, and Associate Kate Mather examine a recent DC Circuit decision that gives fresh weight to 2020 Supreme Court dicta on common-law privileges in congressional investigations.
July 30, 2026
Publications
Meghan Greenfield Discusses Top Environmental Policies to Watch in Law360
Partner Meghan Greenfield spoke to for an article highlighting the key environmental regulatory developments expected in the second half of 2026. Meghan discussed the legal reasoning the agency may rely on as it considers further rulemaking addressing greenhouse gas pollution, and hurdles the agency may face.
July 22, 2026
Publications
Partner Meghan Greenfield Quoted in The Associated Press on Offshore Wind and National Security
Partner Meghan Greenfield spoke with The Associated Press for an article examining the Trump Administration's use of national security justifications to halt offshore wind development.
July 21, 2026
Podcasts
Partner Laurel Loomis Rimon Discusses Fintech Enforcement, Debanking, and Regulatory Risk on Fintech Layer Cake Podcast
Partner Laurel Loomis Rimon was featured on the Fintech Layer Cake podcast, where she discussed how fintech enforcement and prosecution actually work in practice, and what exposes fintechs and banks to regulatory risk.
July 15, 2026
Event
Partner Suedeen Kelly to Speak at ABA SEER's 34th Fall Conference
On Thursday, October 15, Partner Suedeen Kelly will speak on a panel at the American Bar Association's Section of Environment, Energy, and Resources (ABA SEER) 34th Fall Conference in Albuquerque, New Mexico.
October 15, 2026