Insights

First, a hat tip to Jon Baines at Mishcon de Reya, whose latest heads-up on the ICO’s Complaints Framework prompted this piece. It set me thinking about how best to explain the Framework to some of our clients, and — with England and New Zealand having contested three Tests through June and my good friend Benjamin Chilcott being such a cricketing devotee — the analogy that settled it was a cricketing one. Anyone who watched will know the truth every seamer learns early: before a ball is bowled, the pitch has already had its say.

Since February, the ICO has quietly changed the odds. Under its new complaints Framework — and confirmed under a Freedom of Information request — it now triages out around one data-protection complaint in every two before an investigator so much as looks up.

For most organisations, that is a quieter life. For some, it is precisely the opposite.

The half that survives is not drawn at random. A complaint clears the bar where it risks serious harm, affects vulnerable people, or touches the ICO’s stated priorities — AI, biometrics, the tracking of individuals. If your work sits on any of those, the average offers no comfort at all: the door to investigation has, if anything, swung wider.

What decides your exposure is the pitch, not the bowler. The ICO — the bowler — can send down only so many investigations, so it saves them for surfaces that offer something. Mundane processing is a flat, lifeless track: you can leave the ball all day. Biometrics and criminal-offence data are a green top, seaming and uneven, where the same delivery on the same length does nothing on one surface and rattles the stumps on the other. It is the same regulator applying the same test to everyone; what differs is the ground beneath your feet.

Two kinds of organisation are batting on that green top right now. The first are operators deploying facial recognition and biometrics — self-exclusion, age assurance, the identification of “subjects of interest”. The second are the town-centre security teams and Business Improvement Districts handling criminal-offence and rough-sleeper data as they work to keep our streets safe. For both, a complaint need not be exceptional to be investigated; it need only touch a nerve the ICO has already said it will feel.

The answer is not to retire. Since 19 June, every organisation must run an internal complaints procedure. Done properly, it plays the ball safely back before it ever carries to the ICO — and keeps you clear of the twelve-complaints-in-a-month mark that attracts selector scrutiny.

If you suspect you are taking guard on that kind of surface, it is worth a candid read of the conditions before the covers come off. For half of all complaints, the ICO never runs in; the question is whether the very nature of your data makes an investigation the likely outcome, not the exception.