SRA attempts to appease digital logo critics

The regulator’s digital logo is to be disconnected from Google analytics temporarily in a last-ditch effort to appease solicitors’ concerns about data protection and privacy laws.

There have been escalating concerns around the legality of the Solicitors Regulation Authority’s (SRA) digital logo but the regulator has insisted it complies with the law.

All SRA-regulated firms will be required to display the digital logo on their firms’ websites from 25 November, when the SRA’s new regulatory framework – the Standards and Regulations (STARS) - come into force.

But the "SRA digital badge", as it is formally called, has been described by one solicitor as “an illegal gimmick” and many have said personal data is being collected and processed without the required consent in breach of the General Data Protection Regulation (GDPR).

The logo relies on smart technology to confirm to visitors that the firm is regulated. It also gives a firm-specific link to information about the protection for potential customers.

The regulator said most firms are already using the clickable logo and confirms that its development partner, Yoshki, uses Google analytics to aid reporting.

The SRA conceded that some firms have queried how data linked to the logo is being recorded but said no identifiable data is collected, all IP addresses are automatically anonymised; and none are stored either by Yoshki or the regulator.

It said: “Our priority is making sure all regulated firms use it on their website, because this will help the public understand what regulated law firm is, and the extra protections this brings.”

The pause on tracking is only temporary and the regulator said it will update the profession “in due course on next steps”.

When the tracking is turned back on, the SRA could face further action. One solicitor has threatened to make a formal complaint to the Information Commissioner.

Meanwhile, a number of firms have created separate webpages to display the digital logo to satisfy both the regulator’s requirement and the consent requirements under the GDPR.