A Continuation of My Struggle with the ICO’s Reactive Stance on Subject Access Requests

Why this matters

On 14 August 2024, I reached a further stage in my dispute with the Information Commissioner’s Office over the handling of my Subject Access Request to Balliol Property Services. The concern is straightforward: the SAR process should give an individual access to their personal data, but the process becomes strained when the response is handled through a party that is also involved in wider legal conflict with the requester.

In my case, the ICO had already accepted that there had been a failure by BPS to respond to the SAR. That should have been a moment for clear correction. Instead, the next stage created a deeper concern: BPS’s response route involved Burnetts Solicitors, a firm acting for BPS in disputes involving me.

The issue is not simply whether a solicitor or representative can ever assist a controller with a SAR. Organisations often use staff, external advisers, processors or lawyers to help manage data-protection requests. The real issue is whether the controller can still demonstrate fair, transparent and accountable handling where the person reviewing or controlling the process has an apparent litigation interest in the requester’s data.

What is established

The right of access is a core data-protection right. It allows an individual to ask whether an organisation is processing their personal data and to receive access to that data, subject to limits and exemptions. The ICO’s own guidance treats the right of access as a detailed compliance obligation for organisations, not a discretionary courtesy.

The ordinary SAR timeframe is also important. Organisations must respond without undue delay and at the latest within one month, subject to the rules on identity verification, authorised third parties, limited fee situations, clarification and extensions for complexity or multiple requests.

That framework means the key questions in this case are practical and evidential. When did the clock start? Was ID verification genuinely required? Was the request for identification reasonable and proportionate? Did the controller or its representative respond to the identification issue? Was any delay justified? And did the ICO review those matters with enough attention to the apparent conflict created by the wider dispute?

The conflict question

The central concern is perceived conflict. If BPS instructed Burnetts Solicitors to handle the SAR while Burnetts also represented BPS in disputes involving me, the process required careful safeguards. The question is not whether the involvement of a solicitor automatically invalidated the SAR process. It is whether BPS and the ICO properly addressed the risk that the SAR might be handled through a litigation lens rather than a data-protection compliance lens.

A SAR is not supposed to become a tactical extension of a legal dispute. A controller remains responsible for complying with data-protection law even if a representative assists with correspondence. If a solicitor is involved, the controller should still be able to show what searches were undertaken, what data was considered, what exemptions were relied on, and why the requester was treated fairly.

That distinction matters. It keeps the criticism focused on process integrity rather than unsupported findings of motive.

The ICO review request

On my account, I contacted the ICO again on 14 August 2024 and asked for the case to be reviewed. The request raised three practical points: the current deadline for BPS to comply with the SAR; what the ICO would do if BPS missed that deadline; and whether the ICO had properly noted my response to the ID-verification issue raised through Burnetts.

Those are the right questions. They move the complaint away from general dissatisfaction and towards reviewable process points. A strong ICO review request should identify what was missed, what evidence supports the concern, why the issue matters, and what action is being requested.

The ICO’s response that a review would be conducted within a month is useful, but it does not resolve the underlying concern. A review is only meaningful if it addresses the evidence, not merely repeats the earlier conclusion.

Legal route if the SAR remains unresolved

If the SAR remains unresolved, there are several possible routes. They should not be blurred together.

The first route is continued ICO review and complaint handling. That may be useful where the issue is missed evidence, delay, lack of explanation, or failure to press the controller to resolve the complaint.

The second route is direct legal action against the controller. The ICO cannot award compensation. Where an organisation has broken data-protection law and caused material loss or distress, a compensation claim may be considered against the organisation responsible for the breach. If the issue is access to data rather than compensation alone, the court route may need to be framed carefully around the specific remedy sought.

The third route is public-law scrutiny of the ICO. Judicial review is a specialist and high-risk route. It is not a general appeal from a disappointing ICO outcome. It requires a public-law error, prompt action, careful pre-action correspondence and assessment of alternative remedies.

A Letter Before Action or claim form should not be treated as a campaigning device. It must identify the legal basis, the breach, the remedy sought, the evidence relied upon and the correct defendant.

Closing point

Data protection rights are weakened when individuals are left to chase basic compliance through delay, unclear deadlines, unexplained representative involvement and limited regulatory intervention. The right of access depends on more than a formal entitlement. It depends on a process that the requester can trust.

In this case, the central issue is whether the ICO’s review will grapple with the real concern: not simply whether BPS eventually responds, but whether the SAR has been handled fairly, transparently and with proper accountability in circumstances where the chosen response route creates a perceived conflict.

The message is clear. A SAR should not become a side-channel of litigation strategy. Where that risk arises, the controller and the regulator should be able to show exactly how fairness was protected.