Investigating the ICO: How the Information Commissioner’s Office Failed to Identify GDPR Non-Compliance by Burnetts Solicitors

Why this complaint matters

The Information Commissioner’s Office is not a private mediator between a complainant and an organisation. It is the UK’s data protection regulator. Its function in an individual complaint is not to provide a full civil remedy, award compensation or act as the complainant’s solicitor. But it is expected to assess information-rights concerns through the lens of the law and to explain, in practical terms, why it does or does not consider further regulatory action appropriate.

That makes the quality of reasoning critical. A complainant may have no internal access to an organisation’s records, systems, audit trails, breach logs, policies or risk assessments. The regulator may be the only body with enough institutional authority to ask targeted questions. Where the response is superficial, the complainant is left with a formal outcome but no meaningful answer.

This article considers a complaint made about Burnetts Solicitors. The complaint raised concerns about reliance on paper audit logs, alleged absence of digital records, subject access handling, data subject rights, record-keeping, breach procedures and the absence of clear evidence of data protection impact assessment where one was said to be necessary. The ICO’s response, according to the complainant, rejected the complaint without addressing the substance of those issues.

The public-interest point is not that every complaint should result in enforcement. It is that every serious complaint should be handled through a visible reasoning process. If the concern is wrong, the regulator can say why. If the evidence is incomplete, it can identify what is missing. If the organisation’s explanation is accepted, the regulator can explain the basis on which it is accepted. What undermines trust is a conclusion that appears to bypass the evidential questions that made the complaint serious in the first place.

The five questions the regulator had to ask

A data protection complaint of this kind is not properly assessed by asking a single broad question: did the organisation say it complied? The practical question is whether the organisation can demonstrate compliance in relation to the specific processing activities under challenge.

Those questions are not technical decoration. They go to the core of modern data protection law. The UK GDPR is built around principles, but those principles are made practical through systems, records, explanations and demonstrable governance. A controller that cannot show how it protects data, manages requests or records decisions may be compliant in language but weak in proof.

The Burnetts case study

The complaint described a set of linked concerns arising from the complainant’s dealings with Burnetts Solicitors and a subject access request connected to a landlord dispute. The complainant says that Burnetts relied heavily on paper audit logs which could not easily be redacted and that digital equivalents were absent or not disclosed. If accurate, that would create a practical difficulty: a firm cannot confidently assure a data subject that it can identify, retrieve, redact and explain processing activity if the underlying records are fragmented or inaccessible.

The complaint also raised concerns about data subject rights. The issue was not simply whether a policy existed. The issue was whether the policy could work in practice where the records needed to respond to access, rectification, erasure or restriction requests were said to be incomplete, paper-based or not capable of being interrogated in a reliable way.

There was also an accountability concern. The complainant says the absence of adequate digital logs made it difficult to understand who accessed data, when they accessed it, for what purpose and under what authority. In a regulated legal environment, those questions are not peripheral. Law firms handle client, opponent, witness, financial and sometimes highly sensitive information. A credible governance system should be capable of explaining how access and disclosure decisions are controlled.

A further concern concerned the handling of a subject access request. The complainant says a solicitor who was involved in the underlying dispute responded to a request in circumstances that appeared to create a conflict risk. The article does not assert that this was unlawful. The narrower point is that the complaint put the ICO on notice of a governance issue: whether the person handling information-rights correspondence was sufficiently independent from the dispute in which the data was being used.

Finally, the complainant says that Burnetts later introduced additional compliance resource, including a compliance coordinator and assistant. That fact, if accurately recorded, does not prove earlier non-compliance. Organisations can strengthen compliance for many reasons. But it may be relevant context where the earlier position presented to the regulator was that existing systems were already adequate.

Why the ICO response raises concern

The complainant’s central criticism is that the ICO took around eight months to respond and then concluded that Burnetts were compliant without addressing the main evidential points. The difficulty with that kind of response is not only delay. It is opacity.

If the ICO reviewed the paper audit logs issue, the response needed to explain what had been checked and why the paper-based system did not create a compliance problem. If it accepted Burnetts’ explanation, the response needed to identify the explanation and the reason it was sufficient. If the issue fell outside the ICO’s scope, the response needed to say so. A complainant cannot test the fairness of the regulatory outcome if the reasoning does not engage with the complaint actually made.

The same applies to data subject rights. If the complaint alleged that access and redaction could not be handled properly because of record-keeping limitations, the regulatory answer needed to go beyond a general statement that policies existed. A policy is relevant, but it is not the same as operational compliance. The practical question is whether the policy could be applied to the records, systems and processing activity under challenge.

There is also a wider public-confidence problem. Regulators risk losing legitimacy when their decisions appear to depend on institutional confidence rather than evidence. A complainant does not need every point upheld. But they are entitled to expect a route of analysis: allegation, evidence, organisation response, regulator assessment and reasoned conclusion.

What reform requires

The answer is not to require the ICO to enforce every complaint. That would be unrealistic and legally unsound. The answer is to require better issue discipline in complaint handling.

That approach would not prejudge organisations. It would protect them from vague allegations by requiring the complaint to be structured. It would also protect complainants from dismissive outcomes by requiring the regulator to answer the case actually put. Proper reasoning benefits both sides.

The broader lesson is simple. Data protection law depends on accountability. If a controller must be able to demonstrate compliance, a regulator assessing a complaint should be able to demonstrate how it assessed that compliance. Public confidence does not require perfect outcomes. It requires reasons that can be understood.