The ICO’s Latest Blunder: Allowing Conflicted Parties to Process SARs

Why this matters

On 13 August 2024, I reached another stage in my dispute with the Information Commissioner’s Office over the handling of my Subject Access Request to Balliol Property Services. The ICO had recognised that BPS had failed to respond to the SAR within the required timeframe. That should have been a meaningful step towards resolution.

The difficulty arose when I raised a further concern: Burnetts Solicitors, who were acting for BPS in legal matters involving me, appeared to be involved in the processing or handling of the SAR. From my perspective, that created an obvious fairness problem. A SAR is supposed to give access to personal data. It should not become entangled with litigation strategy or adversarial positioning.

The question is not whether a solicitor can ever assist a controller with a SAR. In many situations, organisations use legal advisers, data-protection officers, processors, administrators or external support when dealing with access requests. The real question is whether, in a disputed relationship, the controller can still show that the SAR was handled fairly, transparently and independently enough to protect the requester’s rights.

What happened

According to my account, the ICO accepted that BPS had failed to respond to the SAR within the required timeframe. I then raised the concern that Burnetts’ involvement created a perceived conflict because of its role in legal matters involving BPS and me.

The ICO did not treat that concern as requiring the kind of intervention I had hoped for. That response is the focus of this article. It raises a practical regulatory question: when a complainant identifies an apparent conflict in the handling of a SAR, how far should the ICO go in asking the controller to explain its process?

That question matters because SARs often arise in difficult relationships: employment disputes, housing disputes, professional complaints, litigation, safeguarding disagreements, family conflict, debt disputes or disputes with public bodies. In those situations, personal data may be highly sensitive and strategically important. The fairness of the process is therefore central to public confidence.

The fairness question

The UK GDPR does not create a simple rule that a solicitor involved in a dispute can never assist with a SAR. That would overstate the position. The better criticism is narrower and stronger: where the chosen SAR handler is connected to an adversarial dispute, the controller should be able to show why the arrangement does not compromise fairness, transparency or accountability.

A SAR is not a tactical favour. It is a statutory right. If the response route makes the requester reasonably concerned that data may be withheld, filtered or approached through a litigation lens, the controller should explain the safeguards. That might include who is making disclosure decisions, who is conducting searches, whether the controller remains responsible, how exemptions are being assessed, and whether the requester’s personal data is being handled only for proper purposes.

That distinction is important. It avoids making unsupported findings about motive while keeping the pressure on the real issue: process integrity.

UK GDPR principles

The UK GDPR framework is built around principles including lawfulness, fairness, transparency and accountability. In a SAR dispute, those principles are not abstract. They shape how the controller should handle the request, communicate with the requester, justify delay, explain any identity checks, and remain responsible for compliance.

Fairness means the requester should not be left with a process that appears weighted against them. Transparency means the controller should explain what is happening and why. Accountability means the controller should be able to demonstrate compliance, not simply assert it.

Those principles become particularly important where the SAR is connected to a wider legal dispute. A controller may be entitled to take advice, but it should not allow the access process to be perceived as controlled by litigation interests. The ICO’s role is not to micromanage every SAR, but it should be willing to ask focused questions where the facts suggest that fairness or accountability may be at risk.

What the ICO route can do

The ICO complaint route is important, but it has limits. The ICO can review complaint material, ask for more information, tell an organisation to do more work to resolve a complaint or explain its position more clearly, recommend improvements and, in some cases, take regulatory action. It cannot award compensation.

That means a complainant should frame the issue precisely. The question for the ICO is not simply whether the complainant distrusts the organisation. The question is whether the available material shows a data-protection issue requiring closer scrutiny: missed deadline, inadequate response, unreasonable ID request, lack of transparency, failure to search, improper reliance on exemptions, or a process that does not demonstrate fairness and accountability.

Next steps

The immediate next step is to keep the challenge focused. A general allegation that the ICO has failed is less effective than a structured request asking the ICO to address specific points: deadline, ID verification, the role of Burnetts, BPS’s continuing responsibility, and the steps needed to complete the SAR fairly.

If the ICO maintains its position, the next options should be separated carefully. An ICO review may be appropriate if the complaint outcome failed to address material evidence. A direct claim against the controller may be relevant where data-protection breaches have caused loss or distress. Judicial review of the ICO is a specialist public-law route and should not be treated as a general appeal from a disappointing outcome.

The strongest position is an evidence-led one. The issue is not simply that the process felt unfair. The issue is whether the controller and regulator can show, through documents and reasons, that the SAR was handled in a way that met the standards of fairness, transparency and accountability required by data-protection law.

Closing point

The ICO’s response to this type of complaint matters because SARs are often made by people already in a vulnerable or unequal position. A requester may be trying to understand decisions made about them, prepare a complaint, challenge a process, or protect themselves in a dispute.

Where a SAR response route appears connected to an adversarial legal relationship, the answer cannot simply be that the controller may choose who assists it. The controller should be able to show how fairness was protected. The ICO should be willing to test that explanation where the concern is properly raised.

The right of access is too important to become a procedural afterthought. It depends on visible fairness, clear deadlines, transparent handling and accountability that can be checked when something goes wrong.