Exposed: How ICO’s Secrecy Undermines Trust in GDPR Investigations – What You Need to Know!

The core point: transparency must be visible in the process

The ICO occupies a difficult position. It must handle large volumes of complaints, apply data-protection law, manage freedom-of-information requests, protect personal data, and explain decisions to people who may already feel that an organisation has failed to respect their rights.

The concern raised in the supplied draft is that an ICO complaint involving Burnetts Solicitors was, in the complainant’s view, investigated too narrowly and explained too thinly. The draft also raises concern about the ICO’s use of a Freedom of Information Act exemption for information intended for future publication.

The stronger public-interest argument is not that the ICO necessarily acted improperly. It is that a regulator’s reasoning must be sufficiently clear to let a complainant understand what was examined, what was not examined, what evidence mattered, what legal principles were applied, and why the outcome was reached.

The ICO’s role: regulator, complaint handler and information-rights body

The ICO is the UK’s information-rights regulator. Its work covers data protection, freedom of information, access to information, direct marketing and related areas. That makes transparency especially important. The body that promotes information rights must also show that its own complaint handling is intelligible and accountable.

In a data-protection complaint, the complainant may expect the ICO to consider the organisation’s processing, the evidence supplied, the relevant UK GDPR principles, and whether the controller’s explanation is adequate. The ICO does not act as the complainant’s solicitor, and it does not decide every civil dispute. But its conclusions should still make the reasoning path visible.

The case study: Burnetts, complaint handling and disputed investigation depth

The supplied draft refers to a complaint about Burnetts Solicitors and says the complainant raised concerns about GDPR compliance, audit logs, SAR handling, conflicts of interest, data minimisation, purpose limitation and record-keeping.

The complainant’s position is that the ICO investigation did not engage sufficiently with those concerns. The draft also refers to a named ICO investigator and questions the investigator’s training and suitability. For publication, that point is better framed as a systems issue: did the ICO’s process explain the competence, scope and reasoning behind its investigation, rather than focusing on personal criticism of an individual officer?

A clean article should separate three questions: first, what Burnetts was alleged to have done; second, what the ICO actually considered; and third, whether the ICO’s reasoning was clear enough to command confidence.

Investigation quality: what a reasoned assessment should show

A complainant may disagree with an outcome even after a fair investigation. Disagreement alone does not prove regulatory failure. The issue is whether the decision-maker has shown the work: the issue identified, the documents considered, the legal test applied and the reason for the conclusion.

The supplied draft raises concern that paper audit logs were accepted without enough scrutiny, that conflict points were not answered, that the distinction between different SARs became confused, and that the investigation did not engage with purpose limitation and data minimisation. Those are serious concerns, but they need to be tested against the actual ICO correspondence and any published decision or response.

FOI exemptions: Section 22 and future publication

The draft says the ICO relied on Section 22 of the Freedom of Information Act 2000, which concerns information intended for future publication. The point requires precision. A future-publication exemption is not automatically improper. The real question is whether the information fell within the exemption and whether the public-interest balance was explained in a way that could be understood.

Where the requester seeks information about complaint handling, investigation quality or regulator performance, delayed disclosure may feel like the opposite of transparency. That does not mean the exemption is unlawful. It means the decision should explain why regular publication, timing, operational planning or other factors outweighed earlier disclosure.

Data-protection principles: the complaint cannot be reduced to paperwork

The UK GDPR principles are not technical decoration. They are the framework through which controllers are expected to process personal data. The relevant principles in a complaint of this kind may include transparency, purpose limitation, data minimisation, accuracy, security and accountability.

That does not mean every complaint about audit logs or SAR handling proves a breach. It means a reasoned investigation should show whether the principle was considered, how the evidence was assessed and why the organisation’s practice did or did not raise a data-protection concern.

A practical reform test for ICO complaint handling

The reform argument does not depend on proving every allegation in this case study. It rests on a wider point: complaint handlers should make the investigation path clear enough for complainants to understand why their concern succeeded, failed or was treated as outside scope.