Judicial Review Of An ICO Decision

R (on the application of Delo) v Information Commissioner [2022] EWHC 3046 (Admin)

Case background

The Claimant in this case (BPD) made a data subject access request (DSAR) of a company he used to facilitate currency conversion for (Wise). BPD was not satisfied with the response received from Wise and therefore made a complaint to the Information Commissioner’s Office (ICO). In October 2021, the ICO decided to take no further action against Wise. BPD wasn’t satisfied with this and asked the ICO to reconsider. The ICO dismissed BPD’s second complaint without any further investigation.

In December 2021, BPD issued a claim against Wise in the High Court for breach of contract and breach of the UK GDPR. During this claim, Wise provided BPD with all of the data it had withheld, they however did not admit any liability. In February 2022, BPD exercised his right under Recital 141 and Article 78.2 of the UK GDPR to challenge the ICO’s decision on the following grounds:

All three of the above grounds hinged on BPD’s assertion that there is a requirement for the ICO to reach a final determination in every case where a complaint is made.

The main question for Mr Justice Mostyn was therefore whether under the UK GDPR the ICO is obliged to investigate and reach a final conclusion on each and every complaint.

Mr Justice Mostyn first considered the ICO’s website which lists the potential outcomes for a complaint. One of these outcomes is that the ICO simply records the complaint but takes no further action. BPD argued that this was unlawful and that they were under an obligation to properly investigate and reach a final determination. The ICO argued that not only is it lawful, but a necessary option. In 2020/21 the ICO received 36,607 complaints, 46% of the complaints received were to do with access issues. The ICO has 140 staff dedicated to handling complaints. The ICO, therefore, argued that to investigate every complaint and to reach a final conclusion in each and everyone would take it to breaking point.

When considering the ICO’s obligations, Mr Justice Mostyn looked at the relevant legislation, both historic and current. Article 57.1(f) of the UK GDPR contains an explicit instruction requiring the ICO to investigate, to the extent necessary, to reach a conclusive determination of each complaint made. Recital 141 of the UK GDPR states that an investigation into a complaint should be carried out to the extent that it is appropriate to do so.

Having considered the wording within the UK GDPR, Mr Justice Mostyn concluded that handling a complaint:

Mr Justice Mostyn as a result concluded that the ICO had complied with all of the obligations imposed on it and that their decisions of 12 October and 24 November 2021 were both lawful in substance and procedurally. Mr Justice Mostyn also noted that the ICO would have been aware when making their decision that BPD had the option of pursuing a civil claim. Mr Justice Mostyn confirmed that this was a further good reason for the ICO to reach the decision that it did.

Comment

This case makes it clear that the ICO is under no obligation to investigate and reach a final determination in relation to each and every complaint. Even if they decide to uphold a complaint, they may still decide to take no further action. Whilst many are likely to find this approach unsatisfactory, as explained by the ICO, it is an important option to ensure that they are able to deal with the vast number of complaints received.

If you are unhappy with a decision made by the ICO you can seek to challenge it. At Nelsons, we will be able to provide you with some advice as to whether you are able to challenge the decision and if so, we will be able to assist you with the drafting of the relevant documentation and seeing the claim through to the end.