England: Court of Appeal rules ICO acted lawfully in subject access request complaint litigation

The court upheld an earlier High Court decision by Mr Justice Mostyn to dismiss a claim by Mr Ben Delo that the ICO had unlawfully failed to determine his complaint about a subject access request he had made to Wise Payments Limited.

The case raised important questions about how far the ICO has to go in investigating and reaching a decision on the merits of every complaint.

The ICO welcomed the Court of Appeal’s confirmation that it has broad discretion in deciding the extent to which it investigates each complaint and is entitled to reach and express a view on the complaint, without necessarily determining whether there has been an infringement.

It also welcomed the court’s decision that the ICO acted lawfully in deciding the outcome of Mr Delo’s complaint.

John Edwards, the information commissioner, said: “We take pride in providing a great service to customers and getting the best outcomes we can for people complaining about breaches of their information rights. This is at the heart of what the ICO does.

“We received more than 33,500 data protection complaints in 2022/23 and issued nearly 40,000 outcome decisions in the same period – figures that clearly demonstrate how many people we help each year. We’re pleased that the Court of Appeal agrees that it’s important we’re able to prioritise appropriately, taking into account the merits of each complaint and likely outcome of further investigation.

“We’re always thinking about how we can improve our service. For example, in response to the fact that more than a third of complaints are about subject access requests, we’ve recently launched a new service to help people exercise their rights more easily.”