The recent case highlighted in the Law Society Gazette, which saw a family solicitor fined £17,500 in connection with their engagement of a private investigator, serves as a timely reminder for the legal profession.
It should be said at the outset that the investigator in this case was not at fault. The regulatory finding, and the financial and reputational consequences, fell squarely on the solicitor.
That is precisely why the case matters: it underscores the importance, when outsourcing sensitive services, of choosing a provider with expertise not only in the task itself but in the compliance landscape that surrounds it.
The core issue we face is a structural gap in the UK's investigative sector.
The domain remains entirely unregulated by statute, meaning there is no licensing regime, no minimum standard of competence, and no compulsory training for those who present themselves as investigative service providers.
This lack of regulation poses a considerable risk to solicitors, who themselves operate within a comprehensive regulatory framework.
When solicitors instruct investigators who sit outside any meaningful oversight, the legal and reputational risks fall disproportionately on the solicitor.
What the Solicitors Regulation Authority expects
The Solicitors Regulation Authority (SRA) expects solicitors to exercise due diligence when selecting service providers.
That means satisfying themselves that any investigator instructed is properly insured, ethically grounded, and possessed of a competent working knowledge of the lawful methodologies available and the compliance obligations attached to them.
To repeat the point, no fault attached to the investigator in the reported case. They were not the regulated party, and on the facts they did not breach data protection law.
Even so, a properly trained investigator would have recognised that the trace enquiry carried a high risk of harm to the data subject and would have been equipped to challenge the solicitor, politely, on the wisdom of sharing the findings.
The value of ABI accreditation
This is where the Association of British Investigators (ABI) and its voluntary self-regulatory regime offer real value.
The ABI’s Code of Ethics and Professional Standards binds members to principles of honesty, integrity, and respect for information, and requires that all investigations be conducted lawfully and ethically.
Sitting alongside it, the ABI UK GDPR Code of Conduct for Investigative and Litigation Support Services, approved by the Information Commissioner’s Office (ICO), provides sector-specific guidance on lawful data processing, legitimate interests assessments and the proper limits of data sharing.
The ABI is uniquely positioned within the industry, working with the Law Society to give solicitors access to vetted service providers who meet a recognised standard.
In a sector still devoid of state regulation, the prudent course is to engage only those accredited to that standard.
The reputational cost of getting it wrong
The repercussions of the reported case extend well beyond the financial penalty.
The reputational harm to the solicitor involved is profound, and a solicitor's standing is directly tied to the choices they make about who acts on their behalf.
The selection of an investigator is one of those critical choices. The decision in this instance led to a breach of professional duty, potentially a breach of the UK GDPR, and inadvertently placed an individual in jeopardy.
Had the solicitor instructed an investigator trained under the ABI UK GDPR Code of Conduct, the lawfulness of those instructions would in all likelihood have been raised, and the situation might well have been averted.
For solicitors currently working with investigative suppliers who are not ABI members, it is worth asking the simple question: why not?
If a satisfactory answer is not forthcoming, the implications are clear.
Data controller versus data processor
The ABI’s Code of Conduct recognises that investigators may assume the role of data controller in certain circumstances, where they determine the purpose and means of processing.
In the case under discussion, however, the investigator likely retained the status of data processor, acting solely on the solicitor's instructions.
The ABI framework nonetheless empowers investigators to engage proactively with their instructing solicitors and to raise the legality of an instruction where appropriate. This does not transfer liability from the solicitor to the investigator, but it fosters a culture of mutual awareness and diligence that benefits both.
In an increasingly complex legal landscape, solicitors must prioritise risk management when instructing investigative services.
The ABI Members’ Directory, freely accessible on the ABI’s website, is a low-cost, high-value first step in safeguarding against the pitfalls that the reported case has laid bare.
The choice of investigator is not merely a procurement decision. It is a fundamental aspect of a solicitor’s professional responsibility.
By instructing recognised, accredited professionals, solicitors protect their practice and uphold the integrity of the profession they serve.
