Written by The Information Commissioner’s Office describes itself as the UK’s authority for information rights. But where complaint volumes are high and formal enforcement remains rare, a harder question follows: whether the regulator’s emphasis on guidance, proportionality and persuasion is delivering enough visible accountability for the public.
Publication snapshot
- The article argues that the ICO’s public confidence problem is rooted in the gap between complaint volumes and visible formal enforcement.
- The figures discussed in the article suggest that only a small proportion of complaints and reports lead to formal regulatory action.
- The criticism is directed at regulatory strategy and public accountability, not at any finding of personal misconduct or bad faith.
- The article accepts that fines are not the only measure of impact, but argues that guidance alone cannot sustain confidence where non-compliance persists.
- The reform question is whether the ICO can show measurable deterrence, transparent escalation and practical outcomes for individuals.
The ICO’s performance gap
The ICO presents itself as a regulator built around information rights, public trust and responsible data use. That role matters. Data protection, freedom of information and direct-marketing rules are not abstract regulatory concerns. They affect people trying to access records, challenge public bodies, protect privacy, understand decisions and prevent misuse of personal data.
The difficulty is the apparent gap between the ICO’s public language and the practical visibility of enforcement. A regulator can publish guidance, issue statements and encourage compliance, but the public ultimately asks a simpler question: what happens when organisations do not comply?
The numbers raise a serious question
The performance figures used in this analysis point to a striking imbalance between the scale of public complaints and the number of formal enforcement outcomes. The source figures state that the ICO completed 36,049 data protection complaints while issuing 12 reprimands, and handled 7,448 FOI complaints while issuing 10 enforcement notices.
The same figures state that 44,400 nuisance-call reports led to £1.27 million in fines, while 28,969 spam-email reports led to no enforcement action. They also state that 179 investigations were completed from more than 36,000 data protection complaints, alongside 41 audits.
Statistics do not answer every question. Not every complaint merits enforcement. Some complaints will be resolved informally, some will be outside scope, and some may identify poor service rather than unlawful conduct. But the overall pattern still requires scrutiny. If formal action remains rare, the regulator must explain why its wider approach is producing equivalent or better deterrence.
The regulator processes, assesses and closes individual complaints or reports, often through correspondence and informal resolution.
The regulator uses visible powers, published outcomes and escalation to change organisational behaviour and deter future breach.
When words are not enough
John Edwards has repeatedly defended a regulatory approach that gives weight to proportionality, practical outcomes and engagement. There is a serious argument for that approach. Large fines are not always the best measure of regulatory success, and a regulator should not treat punishment as an end in itself.
But the opposite risk is also real. If advice and persuasion become the default answer even where organisations repeatedly fall short, the regulator’s authority weakens. The public does not experience data rights through policy speeches. It experiences them through subject access delays, unanswered complaints, nuisance calls, spam, misuse of personal data and weak remedies.
The question is not whether the ICO should advise organisations. It should. The question is whether it can show that advice is backed by a credible escalation route when organisations fail to act.
How a regulatory gap can develop
-
1
The public submits complaints or reports because information rights are not being respected.
-
2
The regulator closes many matters without visible formal action.
-
3
Organisations learn that poor compliance may produce limited practical consequence.
-
4
Public confidence falls because the right exists on paper but feels weak in practice.
The vulnerable are affected first
Weak enforcement does not affect everyone equally. People with money, advice and institutional confidence can push harder when their data rights are ignored. Vulnerable people, litigants in person, whistleblowers, disabled people, migrants, care users, tenants and complainants against public bodies may not have that capacity.
This is why equity in service delivery must mean more than accessible language and general engagement. If data rights are part of access to justice, then a regulator must be able to identify cases where non-compliance has serious consequences for the individual.
A subject access failure can leave someone without evidence. An FOI failure can keep public decision-making opaque. Direct-marketing misuse can expose elderly or vulnerable people to persistent intrusion. These are not merely administrative irritations.
Innovation cannot become an excuse for weak rights
The ICO is operating in a difficult environment. Artificial intelligence, children’s online safety, automated decision-making, political data use, direct marketing and large-scale data brokerage all place pressure on a regulator with a wide remit.
Engagement with industry is necessary. Modern regulation cannot work only by punishment after harm occurs. But innovation policy should not dilute the underlying rights. If businesses are encouraged to innovate while individuals struggle to obtain enforcement, the balance has moved too far away from the citizen.
The ICO therefore needs to show not only that it can influence high-profile sectors, but that it can deliver practical outcomes across ordinary complaints. A handful of prominent interventions cannot substitute for public confidence in everyday enforcement.
What credible regulatory performance should show
A stronger ICO does not need to fine every organisation or turn every complaint into an enforcement case. It does need to show a clear relationship between complaint intelligence, investigation, escalation, published outcomes and changed behaviour.
Performance tests
- Clear publication of how complaints become investigations or enforcement action.
- Transparent reasons where formal action is not taken in high-impact cases.
- Stronger escalation for repeat non-compliance and systemic failure.
- Evidence that guidance changes organisational behaviour in practice.
Public confidence tests
- Faster outcomes for individuals facing serious practical harm.
- Greater visibility of enforcement across public and private sectors.
- Clearer reporting on direct-marketing, FOI and data-protection outcomes.
- Accessible explanations for complainants about what standard was applied.
The ICO’s credibility does not depend on headline fines alone. It depends on whether organisations believe non-compliance will be detected, escalated and met with a response that matters.
Practical conclusion
The ICO’s challenge is not branding. It is confidence. If its own performance data shows large complaint volumes and limited formal enforcement, the regulator must explain how its approach is delivering compliance, deterrence and public protection.
Advice, guidance and proportionality all have a place. But they cannot become a substitute for visible accountability. The public does not need a regulator that merely processes complaints. It needs one that can show organisations that information rights have consequences.