Court of Appeal upholds ruling on responsibilities of Information Commissioner when complaint made about subject access request

The Court of Appeal has handed down its ruling in a long-running dispute over the UK Information Commissioner's responsibilities when a data subject lodges a complaint that a data controller has infringed data protection law.

Lord Justice Warby said the appeal in Delo, R (On the Application Of) v Information Commissioner [2023] EWCA Civ 1141 involved two main questions:

(1) is the Commissioner obliged to reach a definitive decision on the merits of each and every such complaint or does he have a discretion to decide that some other outcome is appropriate?

(2) if the Commissioner has a discretion, did he nonetheless act unlawfully in this case by declining to investigate or declining to determine the merits of the complaint made by the claimant?

The background to the case, as set out by Lord Justice Warby, was that the claimant had made a data subject access request ("DSAR") to a financial institution with which he had an account.

The financial institution declined to provide much of the data sought, claiming that it was exempt from doing so.

The claimant complained to the Commissioner that this response was not in accordance with his rights of access.

The Commissioner reviewed relevant correspondence and advised him that it was likely that the financial institution had complied with its obligations, making clear that no further action would be taken.

The claimant brought a claim for judicial review, maintaining that the Commissioner had failed to discharge a legal duty to determine any such complaint or alternatively had acted unlawfully in failing to investigate further and/or by reaching an unlawful and irrational conclusion.

Separately, the claimant exercised his right to sue the financial institution, alleging that it had wrongfully refused him access to the personal data covered by his DSAR.

By the time the judicial review claim came before Mr Justice Mostyn, the case against the financial institution had been compromised and the claimant had been provided with the personal data he was seeking.

Mr Justice Mostyn considered that the issues raised by the present claim were accordingly academic but he proceeded to decide them nonetheless on the grounds that there was a public interest in doing so.

The judge held that the Commissioner was not obliged to determine the merits of each and every complaint but had a discretion which he had exercised lawfully. He therefore dismissed the claim.

On his appeal the claimant endorsed the judge's decision to address the two substantive questions but maintained that he gave the wrong answer to each of them.

The Commissioner argued that the judge answered both questions correctly, but by a Respondent's Notice he asked the Court of Appeal to say that the judge should not have answered either of them.

The Commissioner contended that Mr Justice Mostyn should have dismissed the claim without examination of its merits because (a) the claimant had adequate alternative remedies and/or (b) both questions were academic and there was no wider public interest in deciding them.

Lord Justice Warby said: “The Commissioner's arguments about alternative remedies raise points of some interest which the judge did not decide. I do not think it necessary to do so. Assuming there was some adequate alternative remedy, that is a matter that goes to discretion not jurisdiction. In all the circumstances of this case, for reasons I shall develop, I would consider the merits in any event. And although the settlement with [the financial institution] meant that [the claimant] had achieved his main objective, and in that sense at least the claim was academic, the issues raised are of importance to data subjects generally and to the Commissioner.

"The judge's decision that it was in the public interest to decide them was a legitimate exercise of judgment with which we have no grounds to interfere. Furthermore, the judge has decided the issues, permission has been granted for this appeal, and we have heard full argument. To dismiss the appeal on the procedural grounds advanced by the Commissioner would be a waste of resources and a recipe for uncertainty.”

For these reasons Lord Justice Warby concluded that it was clearly in the public interest for the Court of Appeal to decide both the questions he had identified.

On the first issue the Court of Appeal judge said: “….I would uphold the conclusion of the judge at [85] that the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent.

“I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint.”

On the second issue, whether the Commissioner acted unlawfully in the claimant’s case, Lord Justice Warby said the claimant’s arguments were in substance an irrationality challenge to the Commissioner's decision-making.

“As emerged at the hearing the contention, stripped to its essentials, is that even if (as I have concluded) the Commissioner is not invariably required to conduct a detailed investigation or to reach a conclusive determination of the merits of every complaint, nonetheless the Commissioner was legally obliged to do both those things on the facts of this case.

“But this is an appeal against the judge's rejection of that contention. The appeal is not a re-hearing. It proceeds by way of a review. Although there has been criticism of the adequacy of the judge's reasoning, the ground of appeal is not that he gave insufficient reasons but that he was wrong. To succeed in that contention, [the claimant] has to identify one or more legal errors in the judge's assessment. I do not consider the judge committed any such error. Indeed, I consider his conclusions were right.”

Lord Justice Warby added that there was no indication that Mr Justice Mostyn applied the wrong legal test to the decision-making of the Commissioner. “In my judgment, his application of the law to the facts cannot be impeached.”

The Court of Appeal judge said: “The judge plainly accepted the importance of the right at issue but rejected the central contention of [the claimant], that the materials available to the Commissioner were insufficient to enable him to reach a rational decision about the likelihood that [the financial institution] had acted lawfully. The judge was entitled to reach that conclusion. I would have done the same.”

Lord Justice Warby dismissed the appeal. Lady Justice Elisabeth Laing and Lord Justice Peter Jackson agreed.

The Information Commissioner’s Office said it welcomed the Court of Appeal’s confirmation that the ICO has broad discretion in deciding the extent to which it investigates each complaint and is entitled to reach and express a view on the complaint, without necessarily determining whether there has been an infringement.

The ICO also welcomed the court’s decision that the ICO acted lawfully in deciding the outcome of the claimant’s complaint.

John Edwards, the Information Commissioner, said: “We take pride in providing a great service to customers and getting the best outcomes we can for people complaining about breaches of their information rights. This is at the heart of what the ICO does.

“We received more than 33,500 data protection complaints in 2022/23 and issued nearly 40,000 outcome decisions in the same period – figures that clearly demonstrate how many people we help each year. We’re pleased that the Court of Appeal agrees that it’s important we’re able to prioritise appropriately, taking into account the merits of each complaint and likely outcome of further investigation.

“We’re always thinking about how we can improve our service. For example, in response to the fact that more than a third of complaints are about subject access requests, we’ve recently launched a new service to help people exercise their rights more easily.”