Extant Intelligence joins the ICO Data Protection Essentials register: why the register is the easy bit

This week Extant Intelligence was added to the ICO's Data Protection Essentials public register. Here's why that matters less than what's behind it.

Extant Intelligence has completed the Information Commissioner's Office Data Protection Essentials programme and now appears on the ICO's Data Protection Essentials public register. It's a small thing to say and it took an afternoon of modules and a self-assessment to earn. We're pleased about it. But we want to be straight about what it is and isn't, because the point of our work, due diligence reports for solicitors and claims professionals, is that people can rely on what we say.

What the ICO Data Protection Essentials register is (and isn't)

The register isn't a certificate and it isn't the ICO's seal of approval; the ICO says so itself. It's a public list of small organisations that have done the training, looked honestly at how they handle personal information, and chosen to say so where anyone can check. That's all. The listing is the easy bit. The hard bit is what the training made us go and look at.

Data protection in an investigations business

When you run an investigations business, "data protection" isn't a policy in a drawer. It's the daily question of what you're allowed to look for, how you record what you find, and what happens to it afterwards. So over the past few weeks, alongside the course, we finished the pieces that answer those questions for Extant: a full data protection impact assessment, a written assessment of our legal basis for each type of work we take on, a retention rule that deletes case material automatically when its time is up while keeping an anonymised record of who did what, a privacy notice on this website that for the first time speaks to the people who might be the subject of one of our reports, and a rule, built into how our system is changed, that no new feature touching personal information gets built until seven questions about it have been answered in writing.

None of that is visible from a register entry. It's visible in the report.

A search is not a finding: the analyst's job

Here's the thing we keep coming back to. Anyone can put a name into a database. The results come back in seconds: a page of possible addresses, possible accounts, possible namesakes. That page is not a finding. Somewhere in it is your person, and next to them are three people who aren't, and a post that doesn't show what it first appears to. The skill, and the compliance, is in what happens next: a trained analyst doing a pre-litigation check deciding which of those results actually belong to the subject, writing down why, capturing each one as it stood on the day with its source and its date, and having a second person check the lot before it leaves the building. Then keeping it only as long as it's needed.

That's the work. The ICO's modules describe the principles; the analyst is the person who applies them to a real case on a Tuesday afternoon, with a solicitor waiting for an answer and the temptation to say more than the evidence supports. The process we've built exists to make the careful route the easy route: the system won't let a report go out unreviewed, won't let a face search run before the ordinary searches are exhausted, and won't let a finding exist without a source attached.

So if you're a firm deciding whether to instruct us, by all means look us up on the register. Then ask the better question, which is how a finding in one of our reports could be traced back, item by item, to where it came from. We'll show you. That's the bit we're proud of.