Information Commissioner not obliged to investigate and reach final conclusion on each and every complaint: High Court
The Information Commissioner, whose resources are “presently stretched to the limit in dealing with the present workload”, is not obliged to investigate and reach a final conclusion on each and every complaint made to him, a High Court judge has ruled.
According to Mr Justice Mostyn, the claim, if successful, would have had "huge ramifications" as the workload of the Information Commissioner’s Office (ICO) would have been vastly increased.
In Delo, R (On the Application Of) v Information Commissioner & Anor [2022] EWHC 3046, Mr Justice Mostyn considered an argument that the ICO unlawfully dismissed a complaint about a data subject access request on the grounds that it was "likely" the company concerned had complied with their data protection obligations.
The ICO dismissed two complaints from the claimant before he decided to seek a judicial review in pursuit of a quashing order, a mandatory order requiring the ICO to reopen its investigation, and a mandatory order requiring the ICO to retake its decision.
By the time the case came before the High Court, the claimant had received all of the documents he had requested, rendering the claim academic, the judge noted.
But Mostyn J said it was in the public interest for the claim to be heard, as the core question had not been directly considered in domestic or European case law in the 41 years since the right to data protection came into existence, or in the 4½ years since the EU GDPR became part of the law.
"The declaration, if granted, would alter, in my opinion, a very long-standing understanding of the role and functions of the Commissioner when dealing with complaints. It would be a piece of judicial legislation," he added.
In response to the ICO's decision to dismiss the second claim, the claimant pursued a judicial review. Their legal challenge advanced the following three grounds:
- The Commissioner failed to determine the claimant's complaint.
- The Commissioner failed to conduct a lawful investigation of the claimant's complaint.
- The Commissioner failed to take account of relevant considerations, proceeded on the basis of insufficient enquiry and irrationally made a determination on the basis of facts not known to him.
Acting for the ICO, David Bedenham submitted that all three grounds rest on the "flawed" premise that in every case where a complaint is made, the ICO must reach a final determination as to whether there has been a breach of a data subject's rights, or not.
"In my judgment, Mr Bedenham is correct," Mr Justice Mostyn said. "I further agree with Mr Bedenham that on the facts of this case the Commissioner complied with all the obligations imposed on him."
The judge concluded: "The Commissioner was under no obligation either to seek further materials from [the company] or to reach a conclusive determination as to whether, or not, [the company] had complied with its data protection obligations. It was sufficient for him to conclude on the basis of the available information that it appeared likely that [the company] had so complied.
"The Commissioner dealt with the complaints in his capacity as an expert Regulator in accordance with the legal requirements. He did so to the letter. There is no warrant for saying either that he failed as a matter of fact to determine the complaints; or that he handled them in violation of the law; or that his decision-making process left out of account material matters, or took into account irrelevant matters, or was otherwise irrational.
“These criticisms all stem from the false argument I have identified above namely that it is the obligation of the Commissioner in every case where a complaint is made, to investigate it to the extent necessary to enable him to reach a conclusive determination."
Adam Carey
