Like many other individuals who've brought complaints to the ICO against public authorities, we've been similarly disappointed with the ICO responses. Our common experience is that case officers usually ignore the evidence you raise and just ask the organisations standard questions relating to the nature of the complaint, but they don't evaluate the response and are willing to accept an organisations revised explanation (lies) even if this contradicts the evidence the complainant has supplied. Similarly, raising the poor case handling with a reviewer is fruitless - evidence is ignored and salient points are not addressed or countered - the case officer's decision is always upheld. One imagines them with their fingers in their ears singing "Lalalalala... case closed!"If you suspect that an organisation has given a false account to the ICO case officer and wish to see the interaction between the case officer and the offending organisation then you are only able to see the organisation's input if they agree to it. It's pointless submitting a subject access request to discover what the ICO have discussed about you - they claim this is exempt from the DPA law and if you wish to challenge it then you can complain to the ICO. Having placed several complaints about organisations to the ICO, we have found the ICO are more willing to brush aside complaints about subject access requests (SAR) than complaints about freedom of information requests (FOI). We suspect the reason is that with FOI complaints you can approach the Tribunals Service for redress, but with SAR complaints you have to plod through the government your MP to the Ombudsman. Alas, people have reported it is rare for the Ombudsman to hold the ICO accountable. One of the most disappointing aspects of raising a complaint with the ICO is that so many of their staff are willing to turn a blind eye to obvious breaches of the data laws. Very occasionally you will encounter an ICO staff member on the helplines who acknowledges there may be a general problem, but question the ICO handling of a specific case and you will swiftly find the majority of them become uncommunicative and aggressively repeat the 'defence' mantras they've been coached to spout. They don't record their telephone service so if they give you incorrect advice or advice which conflicts with the case officer they can easily deny it. Dealing with ICO staff makes you realise that many people will accept a salary and not question the morality of their actions and what effect these have on their fellow citizens. Anecdotal evidence suggests the same organisations who are not held accountable by the ICO go on to breach the data laws again with the same individuals or others. Sadly, there must be hundreds of people who fall into depression (or worse) when they realise the ICO has not upheld a clear data breach. The ICO will tell you that if you are not satisfied with their decision that you can take legal proceedings against an offending organisation. In practice this is not a realistic prospect because if you try 'no win no fee' paralegals they will usually want the comfort blanket to the ICO deciding in your favour. And, if you can afford legal fees your solicitor will tell you that for minor breaches the cost of your legal fees will outweigh the amount you can claim, so advise you not to pursue the matter. This means if an organisation have breached the data laws and the ICO have turned a blind eye to it, then there is little an individual can do about the matter - as such justice is routinely non-existent for minor GDPR matters.Trust Pilot provide a tick box to allow them to send your review to the ICO. One wonders whether the ICO records these reviews of their 'broken' service???
