Court Of Appeal Rule On An ICO Decision

Ben Peter Delo, R (on the application of) v The Information Commissioner [2023] EWCA Civ 1141

Case background

Mr Delo made a data subject access request (DSAR) to Wise Payments Limited. Mr Delo was unhappy with the response to his DSAR and therefore made a complaint to the Information Commissioner’s Office (ICO). The ICO considered the complaint and advised Mr Delo that it was likely that Wise had complied with its obligations and that they would be taking no further action.

Mr Delo brought a claim for judicial review arguing that as the ICO had not determined the complaint they had failed to discharge their legal duty and/or alternatively the ICO had acted unlawfully in failing to investigate the complaint further and by reaching what he considered to be an unlawful and irrational conclusion. We have written about the judicial review claim brought by Mr Delo in a previous blog.

By the time the judicial review came before Mostyn J, Wise had provided Mr Delo with the data that he was seeking. Mostyn J held that the ICO was not obliged to determine the merits of each and every complaint and therefore, the claim was dismissed. Mr Delo appealed the decision.

The appeal Court was tasked with determining the answer to two questions:

What are the ICO’s responsibilities?

Mostyn J concluded that it would not be possible for the ICO to conduct a full investigation and reach a conclusion on each and every complaint it received, as to do so would “take the system to breaking point if not beyond”. The appeal Judge, Warby LJ decided to take a slightly different approach, placing focus on the language of the UK GDPR itself rather than the extent of the ICO’s resources.

Warby LJ considered Articles 57, 77, and 78 of the UK GDPR, which deal with the duties owed by the ICO. The judge considered that all three articles contained similar wording and phrases and noted a lack of any express duty on the ICO to adjudicate, decide, determine or rule upon, or resolve a complaint. All three articles instead only require the ICO to handle a complaint and investigate the subject matter, but only to the extent appropriate. The only express duty of the ICO is to inform the complainant of the progress and outcome of their complaint. The UK GDPR does not go any further than this.

Warby LJ concluded that the wording of the Articles was a good indication that the intent was not to require the ICO to determine every complaint on its merits but to instead give the ICO the discretion to decide whether to conduct a full investigation. It follows that the ICO can decide to reach an express view without conducting a full investigation. This view could result in them deciding to take no further action. Warby LJ made it clear that this would be enough to discharge the ICO of their duty.

Did the ICO act unlawfully in this case?

The ICO’s first decision dated 12 October 2021 confirmed:

The ICO went on to confirm that Wise was not under any obligation under data protection legislation to explain to Mr Delo why they had decided to close his account. Mr Delo asked for the ICO to review their decision. They issued a second decision on 24 November 2021 reaffirming their position from the first decision.

Mostyn J said that the ICO had received and reviewed the complaint and the attached correspondence, formed the view that the case did not require further investigation, and communicated their decision to Mr Delo. On this basis, he concluded that the ICO had done all they had needed to do and had complied with its obligations under the UK GDPR. Mostyn J also pointed out that Mr Delo was able to bring a civil claim against Wise and commented that this was another good reason for the ICO to have reached the decision they did.

Mr Delo argued that it was impossible for the ICO to reach a conclusion on whether Wise had complied with their obligations without conducting further inquiries. He further argued that it is not legitimate for the ICO to use the fact that it is possible for a data subject to pursue a civil claim as a reason to not properly investigate a complaint. Mr Delo therefore argued that Mostyn J had erred in concluding that the ICO had acted lawfully.

Warby LJ considered the correspondence provided to the ICO with the original complaint and concluded that Mostyn J was entitled to reach the decision that the ICO had sufficient materials to enable them to reach the decision that they did. He confirmed that he would have reached the same decision.

In relation to the second part of Mr Delo’s argument, Warby LJ endorsed the approach taken by Mostyn J, concluding that the right of the data subject to bring a direct claim against the data controller is a relevant consideration that supports the decision made by the ICO. Warby LJ dismissed Mr Delo’s argument that the ICO is obliged to operate the complaints regime as a free alternative to a civil claim. He made it clear that the ICO has full discretion and can decide how to deploy its resources.

Comment

This case makes it clear that the ICO is under no obligation to investigate and reach a final determination in relation to each and every complaint. If you are unhappy with a decision made by the ICO you can seek to challenge it. At Nelsons, we will be able to provide you with some advice as to whether you are able to challenge the decision and if so, we will be able to assist you with the drafting of the relevant documentation and seeing the claim through to the end.