‘I was failed by the ICO’: Data Bill Amendment Could Help Survivors of Abuse
- Survivors of modern slavery, domestic abuse and gender-based violence need the data regulator to help protect them from abusers and stalkers.
- Open Rights Group calls for change in law to help vulnerable people preserve their privacy and safety.
- Siân Berry MP tables amendment to DUA Bill to introduce a statutory complaints procedure for people in vulnerable situations, along with a right of appeal to the Information Tribunal.
Open Rights Group is calling for a change to the law to protect the privacy and safety of survivors of modern slavery and gender-based violence. Data protection violations can have a devastating impact on anyone who has experienced violence or abuse. Any information that can reveal their habits and whereabouts, putting them and their children at risk of harm.
The Information Commissioner’s Office currently faces a serious backlog in handling complaints. ORG wants it be easier for people who are vulnerable to bring complaints to the Information Commissioner’s Office (ICO) if companies and organisations have failed to protect their data adequately.
The digital rights organisation is supporting an amendment to the Data Use and Access (DUA) Bill put forward by Siân Berry MP that would ensure that the ICO has an appropriate complaint-handling procedures for surviors of modern slavery, domestic abuse, gender-based violence, or people who are otherwise vulnerable.
Proper redress
Berry’s amendment would also enable vulnerable people to be able to appeal to the Information Tribunal if they believe the ICO has failed to address their complaint properly. The ICO has a long track record of refusing to act upon complaints: a recent Freedom of Information (FOI) disclosure revealed that the ICO took “regulatory action” in just 1 (0.00%) case out of the 25,582 complaints lodged with them in 2024. Currently, members of the public have no recourse if the ICO decide not to act on their complaints. The amendment would ensure that at the very least vulnerable people have recourse to challenge ICO inaction.
Sarah’s story*
In late 2022, Sarah – a survivor of sexual assault and domestic abuse – discovered that a private document containing her traceable personal information, including her legal and nick names, multiple inclusions of her property’s address (not her current home), identifiable photograph, email address, and other personal details, were mishandled by a London councillor and uploaded to a public website.
The confidential file included enough information to trace Sarah to her current home – a place she had considered her “Safe Space.” Sarah is extremely vigilant about her privacy particularly online, as she is acutely aware of the risks if her data were to be harvested or accessed by her abusers.
This marked the beginning of a gruelling ordeal with the Council to have the information removed. During this time, highly sensitive and intimate details of the abuse Sarah had experienced were also shared without her consent with council staff and an external organisation.
Sarah is now a legally registered Anonymous Voter, a special status meant to shield survivors from being located by former abusers, but incredibly she recently made the discovery that the private data remains online. Despite multiple erasure requests (including one from her elderly mother) the information is still live online – a devastating reliving of the sense of violation and fear all over again.
Sarah has ADHD, complex PTSD, and other hidden disabilities. She says the emotional toll of trying to get help from both the Council and the Information Commissioner’s Office (ICO) pushed her into dissociation – a protective but disabling response to overwhelming trauma. She felt gaslit, unheard, and unsupported, which pushed her to crisis.
“After being failed by the Council, I was failed by the ICO. This has been an absolutely horrific experience, and yet I still don’t believe the ICO truly understands how much this has shattered my sense of safety – even though they knew I was vulnerable, and that I have a disability that affects how I process distress.
It’s hard enough for anyone to take on a public institution – let alone a survivor with a disability. I had to fight for the right to be taken seriously, and it wasn’t until my MP intervened that the ICO even began to officially open a case with what I thought was a historic breach, but turned out to be an ongoing live breach.
I am retraumatised every day knowing this information is still online. We urgently need a change in the law and more robust protections, so no other survivor has to go through this hell.”
*Name changed to protect identity
James Baker, Platform Power Programme Manager said:
“For survivors of domestic abuse, data privacy can be a matter of life or death. It’s vital that anyone who is in a position of vulnerability has recourse to protect their personal information and prevent it from being exploited by abusers.
“Right now vulnerable people who have experienced data protection violations have more chance of winning the lottery than finding meaningful redress by complaining to the ICO.
“We urge MPs to change the law and protect the people who need privacy to stay safe.”
Siân Berry MP for Brighton Pavilion said:
“Data breaches are risking the lives of vulnerable individuals, especially victims of domestic abuse. My amendment to the Data (Use and Access) Bill would offer these individuals a protected complaints procedure, and the ability to hold to account the companies and organisations whose reckless data mishandling exposes them further harm.”
