A short follow-up investigation by Neil Wilby Media has raised renewed concerns over the Information Commissioner’s Office (ICO) and its fitness for purpose as the UK’s statutory regulator for information rights.
At the heart of this scrutiny lies a troubling admission: The ICO, which holds public authorities to account for transparency and disclosure under the Freedom of Information Act 2000 (FOIA), and the Data Protection Act, 2018 appears unable to reliably monitor the performance of its own complaint-handling system.
The issue arose following a FOIA request submitted by journalist and transparency advocate, Neil Wilby, who asked for average response times to complaints made under section 50 of the Act—commonly known as complaint referrals. The ICO refused the request, citing section 12 (excessive cost). It claimed that extracting the information would involve manually examining over 6,000 case files.
Surprisingly, the ICO confirmed that its Case Management System (CMS) does not store the date of the first letter sent to complainants in a retrievable format. It further disclosed that most case data is routinely deleted two years after closure unless the matter proceeds to the First-tier Tribunal.
A formal internal review of the refusal Wilby has since submitted to the ICO, challenging both the legal basis of the exemption and the broader governance failures it implies. In the review request, concerns were raised over transparency, record-keeping, and potential bias against applicants using FOIA to scrutinise the regulator itself.
But the implications go far beyond a single request: Guidance from the National Audit Office (NAO), the UK’s independent public spending watchdog, makes clear that regulators must be able to measure and report on key operational metrics—such as the time taken to allocate, progress, and resolve complaints. These are not bureaucratic luxuries; they are essential tools for public accountability.
A comparative analysis prepared by Neil Wilby Media paints a stark picture:
| Criteria | NAO Guidance | ICO Practice |
|---|---|---|
| Operational Metrics | Track time to respond, allocate, and resolve cases as core performance indicators. | ICO claims it cannot retrieve average response times without manual review of 6,000+ cases. |
| Automated Systems | Use automated, auditable systems for efficiency and accountability. | ICO admits its CMS does not record key timestamps (e.g. date of first letter). |
| Outcome Attribution | Assess impact of regulatory actions on societal outcomes and risk mitigation. | ICO offers no evidence of tracking complaint handling impact or public trust. |
| Stakeholder Accountability | Ensure accessible and meaningful performance data for Parliament and the public. | ICO’s refusal and lack of retrievable data suggest poor alignment with accountability. |
| Advice and Assistance | Provide constructive support to refine FOI requests and offer partial data. | ICO gave no meaningful help under section 16 FOIA, despite acknowledging gaps. |
In short, the ICO’s disclosure response suggests its own internal data handling does not meet the standards it enforces across the public sector.
Whilst the ICO’s role as regulator is vital—particularly in a digital age rife with privacy risks and data misuse—its credibility rests on operational integrity. A watchdog that cannot account for how long it takes to respond to complaints is poorly positioned to compel best practice from others.
As one data rights campaigner noted privately, “If a council or police force told the ICO it couldn’t provide average complaint response times because its IT system was too basic, they’d be on the wrong end of an enforcement notice.”
For a body whose very function is to uphold transparency and fair access to public information, this raises an unavoidable question: Who regulates the regulator?
The ICO has acknowledged receipt of the internal review request. A response is expected by 18th August 2025. If the refusal is upheld, the matter is likely to be escalated to the Information Commissioner’s Office itself, under section 50 of the FOIA.
______________________________________________________________________________
Neil Wilby is a journalist, court reporter and transparency campaigner who has reported on police misconduct, regulatory failures, and criminal and civil justice since 2009. He is the founder and editor of Neil Wilby Media, launched in 2015.
Page last updated: Wednesday 23rd July, 2025 at 15h50
Corrections: Please let me know if there is a mistake in this article. I will endeavour to correct it as soon as possible.
Right of reply: If you are mentioned in this article and disagree with it, please let me have your comments. Provided your response is not defamatory, it will be added to the article.
Image Credits: ICO
© Neil Wilby 2015–2025. Unauthorised use, or reproduction, of the material contained in this article, without permission from the author, is strictly prohibited. Extracts from, and links to, the article (or blog) may be used, provided that credit is given to Neil Wilby, with appropriate and specific direction to the original content.
Neil Wilby Media 
Leave a comment