Delo, R (On the Application Of) v The Information Commissioner - 2023 EWCA Civ 1141
| Court Of Appeal (Civil Division) - 2023 EWCA Civ 1141 | |
|---|---|
 | |
| Court: | Court Of Appeal (Civil Division) (United Kingdom) |
| Jurisdiction: | United Kingdom |
| Relevant Law: | Article 15 GDPR Article 57(1)(f) GDPR Data Protection Commissioner v Facebook Ireland Ltd (Case C-311/18) BE v Nemzeti Adatvédelmi és Információszabadság Hatóság, Case C-132/21 |
| Decided: | |
| Published: | 10.10.2023 |
| Parties: | ICO Mr Delo |
| National Case Number/Name: | 2023 EWCA Civ 1141 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | English |
| Original Source: | [2023 EWCA Civ 1141 (in English)] |
| Initial Contributor: | sh |
The Court Of Appeal (Civil Division) determined that the UK DPA’s Commissioner is not obliged to reach a decision on every complaint.
English Summary
Facts
The data subject made an access request (DSAR) to Wise Payments Limited ("Wise"), a financial institution with which he had an account. Wise declined to provide much of the data sought, claiming that it was exempt from doing so. The data subject complained to the Commissioner that this response was not in accordance with his rights of access under Article 15 UK GDPR. The Commissioner reviewed relevant correspondence and advised the data subject that it was likely that Wise had complied with its obligations, making clear that no further action would be taken.
The data subject brought a claim for judicial review against the ICO, maintaining that the Commissioner had failed to discharge a legal duty to a decision over his complaint or alternatively had acted unlawfully in failing to investigate further. The Judge decided that the Commissioner was not obliged to determine the merits of each complaint and had discretion which he exercised lawfully.
This decision was then appealed to the High Court by the data subject. The appeal involved two main questions:
(1) Is the Commissioner obliged to reach a definitive decision on the merits of each and every such complaint or does he have a discretion to decide that some other outcome is appropriate?
(2) If the Commissioner has a discretion, did he nonetheless act unlawfully in this case by declining to investigate or declining to determine the merits of the complaint made by the claimant (the data subject)?
Holding
The High Court rejected the data subject’s appeal on both grounds.
On the first point, it was held that the legislative scheme (of the UK GDPR as well as CJEU case law which informs its interpretation) requires the Commissioner to receive and consider a complaint. However, the Commissioner then has a broad discretion as to whether to conduct a further investigation and, if so, to what extent. As long as these steps are taken, the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement (such as in this case). It is sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint.
Given the conclusion above, it was decided that the Commissioner acted lawfully in failing to reach a conclusive determination of the data subject’s complaint.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
