ICO Apologizes After Data Protection Response Snafu

The UK’s data protection regulator has said it is committed to getting back on track after complaint response times plummeted in the past quarter.

The Information Commissioner’s Office (ICO) admitted staff have been overwhelmed by a surge in data protection complaints from the public. It claimed to have received 746 more of these between October and December 2024 than in the same period a year previously.

“Anyone who has felt the need to make a complaint to us deserves a timely response. Our current response times are not where we want them to be, and we know how frustrating this is for people who are asking for our help,” it said in a statement yesterday.

“We are committed to getting back to meeting our target of responding to 80% of complaints within 90 days and are introducing several initiatives over the coming months that we believe will help us to achieve this. This includes recruiting 19 staff to help us deal with the ongoing increase in complaints that we are seeing each month.”

Read more on data protection regulation: ICO Set to Scale Back Public Sector Fines

According to the ICO’s own figures, it responded to just 12% of complaints within 90 days in the last three months of 2024, way short of its 80% commitment. The figure has dropped each quarter since Q4 2023. At the start of 2024 it was 65%.

The surge in complaints could be viewed optimistically as a success, in that more data subjects are aware of their rights under the GDPR/Data Protection Act 2018. However, it may also highlight that corporate data protection failings are on the rise.

The ICO said it received over 10,000 complaints in the final quarter of 2024 – an 8% annual increase.

“We expect performance against this measure will continue to slide until we are in a position to roll out significant digital and process changes,” it admitted.

“Plans to transform the way we deal with customer complaints are in train with a staged roll-out planned once we have consulted on them. Work has begun on automating our case creation process and we anticipate delivery in March 2025.”

The regulator said that it is triaging cases and will prioritize those “that urgently need attention.”