The Emotional Side of Data Protection Complaints

This is about the human reality behind the complaints paperwork. This post talks about the times when data protection isn’t the real issue, so someone has to face misplaced expectations and show empathy while staying within the law.

I have dealt with hundreds of requests and questions from people about their data rights and what the UK GDPR means for them in practice. I have seen way too many times that for some unhappy complainants, the data protection issue they raise:

• is only part of their worries;

• is the only issue they can get attention for;

• has made matters worse and they want it fixed.

What exacerbates the situation is that someone in a data protection role like me will have to ultimately disappoint them because the answer isn’t the UK GDPR (although I’d like it to be, for their sake).

@intricateexplorer on Unsplash

Complaints Actually About Employment

A classic example is a data subject access request (DSAR) sent by a frustrated current or previous employee who wants to find a smoking gun in their colleagues’ emails or documents. The goal of this exercise is to help them in a disciplinary or their employment tribunal case.

I get it. You have a dispute at work and want to know who has said what about you, so everyone can see who is right (or wrong). I have dealt with many of these DSARs, searching again and again for something that the requester believed existed, but the smoking gun would never turn up.

I feel for those employees. Unfortunately, there comes a time when data protection law has served its purpose for them. Colleagues would often want witness statements, investigation and 121 notes, but there are exemptions that usually cover these and can’t be provided as part of the DSAR. I am aware it angers requesters when I tell them this, and I agree it would be useful to know what was said; sadly, however, the law doesn’t care about feelings.

The UK GDPR as a Last Resort

There are some complaints that are made only because the person has felt powerless and they think the UK GDPR can help. It rarely does when:

• the problem is rooted in an area outside of the UK GDPR’s scope;

• they received bad advice; or

• the extent to which the regulator can help them is limited or they won’t be able to help at all.

I personally feel frustrated both as a professional dealing with them and on their behalf – things are already going south and then someone tells you that the one straw you were clutching to for a resolution is of no use. I don’t want to be that someone but in reality, I am. There is some sadness in saying: “This isn’t something I / data protection can help with” because I do want to help, but it’s not possible to marry up what people want and what the law allows.

Data Protection Made It Worse

The biggest challenge for me has been to listen to people in distress. For better or worse, I don’t just hear the complaint; I can also feel the pain or anger underneath. While you can balance that with professional detachment and clear communication, to the person on the other side, you might appear cold or even useless.

For the situations where a data protection issue has made everything worse, fixing it is a small win for me, but just a drop in the ocean for the complainant. If they struggle with mental health, that little thing might have broken the camel’s back and the resolution won’t do much to improve the bigger picture. If it can’t be resolved, it’s just another thing to for them to pine over.

Lessons in Empathy

In November 2024 I spoke at Privacy Space about looking after your data protection team’s mental health when they are dealing with sensitive or contentious complaints. A lot of attendees had thought about the same. It’s not widely spoken that DPOs and their colleagues bring a lot of empathy to work and that sometimes they also need help to deal with it all.

To give good advice, you do need a cool head and to remain human. It is not easy. The job sometimes brings moral dilemmas. Grayness in the law calls for hard decisions that you still must evidence as lawful. You have to manage expectations with clear communication while you also almost assume a counselling position.

• You don’t have to do it alone. Ask a colleague to help, even if their role isn’t data-protection related.

• Be clear that if the UK GDPR can’t help, there may be other avenues for the complainant.

• Make them feel heard and they might just be that much more receptive to your advice and less likely to escalate.

Data protection complaints are an emotional area because, at their core, they are about people. People come with feelings, and so do you. Remember that an angry complainant isn’t angry at you; you are just there at that heated moment. And also keep in mind that you have take care of yourself to be able to help anyone, even if it wasn’t in the way they expected.