SRA Digital Badge: privacy concerns lead to complaint to ICO

The new Solicitors Regulation Authority’s (SRA) Standards and Regulations (STARS) are in force and every regulated firm is now obliged to display the regulator’s ‘digital badge’ on their website. But an official complaint against the SRA has now been lodged with the Information Commissioner’s Office alleging that the digital badge is “an illegal gimmick” breaching data protection laws.

The essence of the complaint made by technology and commercial lawyer George Gardiner, of Gardiner & Co, is that if website visitors cannot consent to processing of personal data then that processing is illegal. The SRA has always maintained that it (and Yoshki, its development partner) only has access to the data necessary to implement the digital badge service and does not have access, record or store any additional data such as IP addresses or page navigation behaviour.

The digital badge – also known as the clickable logo – is mandatory for all regulated firms. In practical terms, they must display it on their firm’s website (if they have one). A website visitor can click on the logo - which uses smart technology - to confirm the firm is a genuine, SRA-regulated firm; and gives the visitor access to information on the protection afforded by the firm’s regulated status.

If firms do not display the clickable logo, they risk enforcement action. However, those same firms (the majority of the UK’s regulated law firms) are said to be at risk of breaching privacy and data protection laws.

Privacy concerns
At the beginning of December 2019, Gardiner sent a formal complaint to the ICO saying the digital logo is unlawful. The lawyer who has refused to display the digital logo on his own firm’s website, has alleged that by mandating its implementation on every regulated law firm website, the SRA – and every law firm that does so – is in breach of the Data Protection Act and the General Data Protection Regulation (GDPR).

He says it is unlawful because it fails to ensure law firm website visitors can provide prior explicit informed consent to the processing of their personal data; and it also fails the privacy by design requirement.

His reasons for the complaint are that the digital badge:

  • "fails to ensure that website visitors can provide explicit informed consent prior to the processing of their personal data by each law firm, Yoshki Ltd, the SRA and Google,
  • fails to satisfy the “privacy by design” requirement,
  • subverts (via an effective “back door”) any encryption and therefore the assumed confidentiality of any website visitor relying on the https function, and
  • forces law firms to become joint data controllers with the SRA’s sub-contractor and third parties, including Google, without being in a position to understand what processing those joint data controllers are undertaking.”


Setting out his case to the ICO, Gardiner pointed out a number of related concerns including that:

  • 10,400 law firms are regulated by the SRA and assuming 80 per cent of them have a website, 8,320 would be in breach of the GDPR;
  • The digital badge is based on Google technology and implemented as a service by UK company Yoshki Ltd on behalf of the regulator (presumably as data processor) and the SRA has mandated its implementation;
  • There are significant confidentiality issues around tracking clients and potential clients’ visits to law firm websites;
  • The SRA refuses to assume responsibility for the digital badge scheme.


Gardiner’s view is that because firms are not providing information about personal data captured when someone clicks on the logo, or how it is processed and shared, “we cannot be said to provide any consent”. There are further implications when someone clicks on the logo because data is “immediately and automatically” harvested and given to Yoshki before a visitor can even agree to it.

Law firm failures
The ICO would, says Gardiner, be “entitled to commence an investigation of every law firm that failed to conduct a DPIA and therefore implemented the digital badge”. He said if firms had conducted an appropriate data protection impact assessment (DPIA) they would have raised the same concerns as his, and would have refused to implement the digital badge.

What’s next?
The ICO has been asked to rule on a number of issues, including that the digital badge as mandated is unlawful, and that firms who have implemented the digital badge must immediately stop doing so.

At the 11th hour before STARS came into force, the SRA temporarily suspended Google analytics (which aids reporting) because of wider concerns. We do not know when this suspension will be lifted but the regulator says it will update the profession in due course.

One solicitor who recently commented anonymously, on the Law Gazette website, on the potential implications of the digital logo said: “So will the SRA provide a full indemnity to solicitors against any costs and losses they incur including damage to their professional reputation caused by being sued by a website user or investigated by the ICO?

“I put [the clickable logo] on my website last November as I thought it was compulsory and now wish I had not. I always do not opt into things and I always turn off trackers. I don't use Facebook or things like that. If the SRA has put me in breach of the law for the first time in a 30-year professional career that is absolutely disgusting. They should be apologising to the public as well as getting rid of their logo which I doubt anyone wants to display anyway.”

How the ICO will respond to the complaint remains to be seen, but we will be watching developments. For now, law firms may wish to revisit the issue in light of the complaint - and consider undertaking their own privacy impact assessment, then consider their next steps.

 

 

Back to the SOLICITORS group News

Media Centre

“The Solicitors Group online directory is an established and respected channel for legal professionals, meaning I can talk to my existing and future customers about products and services both quickly and easily.”

Carole Hatton
Marketing Manager
Landmark Information Group

“Reaching our niche market can sometimes be challenging, however we find promoting our legal training courses on www.thesolicitorsgroup.co.uk an excellent way of contacting both existing and new customers. The service we receive from The Solicitors Group is both professional and relevant to our core activities and we would recommend their services to others.”

Euromoney

“I must say that to date we have been very pleased with the referrals we are getting from your site.”

Paul West
Orchid Cellmark

“The Newsdesk feature on www.thesolicitorsgroup.co.uk is ideal for us. Its prominent location on the site provides a great platform to communicate key messages to existing and potential clients.”

Neil Phillips
Marketing Manager
Countrywide Legal Indemnities

"We are very happy with the referrals we are getting from The Solicitors Group web-site."

C.A. Bishop
Technical Director
Wickham Laboratories Ltd

“We received 419 click-throughs to our site from advertising with www.thesolicitorsgroup.co.uk”

Legal Prospects

“Putting myself in my potential client's shoes, I consider www.thesolicitorsgroup.co.uk to offer perhaps the clearest and most user-friendly listing of expert witnesses, especially in its choice of index terms.”

Ivan Vince
ASK Consultants

“The banner ad looks great”

Samantha Dawson
Director
The Bundle Business Limited

“The Solicitors Group has been fantastic in helping us to raise awareness about bowel cancer, which kills 16,000 people every year in the UK. Bowel Cancer UK aims to save lives by raising awareness of bowel cancer, campaigning for best treatment and care and providing practical support and advice. Without the support of organisations such as the Solicitors Group we would be unable to carry out this vital work. We are very grateful to the team at the Solicitors Group for their support and assistance.”

Tamara Matthews
Legacy Officer
Bowel Cancer UK

“As a result of Law London, we have registered 208 new companies/firms to the website, generating £20,797 GWP to date, as well as reinforcing our presence in this very profitable marketplace.”

Aviva

“The event was well put together and executed, and the traffic of potential customers for us was high. We had a number of enquiries regarding our services after the event and we feel our attendance there was important to our overall brand exposure. We feel a Law event of this size without Euromoney Legal Training present could potentially be hurtful to us as a business. We would recommend you to attend and shall ourselves be there again in 2008.”

Euromoney

“Many thanks for the prompt service.”

Martin Gibbs MBE
Director / Investigator
Griffin Forensics Ltd

“A targeted email to key customers is an invaluable method of communication, endorse this with the Solicitors Group branding, relevant editorial content and you have created a winning combination! We look forward to reading the next edition.”

Carole Hatton
Marketing Manager
Landmark Information Group

“Talking directly to Property Lawyers is critical to us as they are key customers or potentially could be for all of our products, The Solicitors Group offer a perfect solution to get our messages right to the right people”

Carole Hatton
Marketing Manager
Landmark Information Group

“Thank you for having a useful and informative site, it is good to see a comprehensive and friendly portal.”

Stefan Fann
UK Probate Services

“Cadogans aims to keep its brand image in front of lawyers who may be looking for engineering experts. A check on Google analytics showed that referrals to our website from The Solicitors Group website were above average.”

Daphne Wassermann
Technical Director
Cadogans