Is the ICO obligated to investigate every complaint it receives?

Is the Information Commissioner’s Office (ICO) required to investigate each and every complaint regarding the processing of personal data? 

Gillian Scribbins, solicitor in our dispute resolution team, considers how the High Court has ruled the ICO should handle complaints in a recent case.

The court was asked how the ICO ought generally to handle complaints, further to its decision not to investigate two particular complaints it had received.

How did the new ruling come about?

This case arose as a result of a claim by a customer and data subject of Wise Payments Limited (Wise).

He wanted to transfer funds to his Wise account so they could be converted into a different currency and transferred to another account he owned. 

Wise refused his request and the customer submitted a data subject access request (DSAR) for the personal information Wise held about him. 

Wise had (for another of its regulatory obligations) made a report regarding that customer to the National Crime Agency, and relied on an exemption in the data protection legislation from providing the customer with any internal communications regarding that report.

Wise informed him some personal data may have been exempt in accordance with the GDPR. 

The customer subsequently made two complaints to the ICO. The ICO took no further action on the first and dismissed the second. 

Dissatisfied with the ICO’s decisions, the data subject commenced a judicial review seeking a court order for the ICO reopen its investigations and either reconsider or reverse its decisions.

What did the High Court say?

The court had to determine if the GDPR contained an obligation on the ICO to investigate each and every complaint made to it. 

The conclusion of the judicial review was that the law firstly requires the Commissioner (i.e. his staff) to receive and consider a complaint, and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation of that complaint, and, if so, to what extent. 

On scrutiny of the legislation, the High Court judge found that:

“[The Information Commissioner] decides the scale of an investigation of a complaint to the extent that he thinks appropriate. He decides therefore whether an investigation is to be short, narrow and light or whether it is to be long, wide and heavy …. And then he decides whether he shall, or shall not, reach a conclusive determination.”

This means the ICO is not required to investigate each complaint that comes its way. Rather it can consider each one to the extent it feels appropriate on a case-by-case basis. 

The ICO decided not to investigate the first of the Wise data subject’s complaints in any further detail after reviewing it.

His second was dismissed and not looked into in any further detail as the ICO accepted the explanation from Wise that it had relied on an applicable DSAR exemption.

The High Court found that these decisions were completely lawful, both in substance and procedurally.

The Judge said:

“The Commissioner was under no obligation either to seek further materials from Wise or to reach a conclusive determination as to whether, or not, Wise had complied with its data protection obligations. It was sufficient for him to conclude on the basis of the available information that it appeared likely that Wise had so complied.”

Practical takeaway

Whilst it might be beneficial to businesses to learn that the ICO may not investigate all complaints, they should bear in mind that it would still be prudent to deal with the threat of complaints to the ICO accordingly.

Absent the support of the ICO, individuals may instead decide to resort to litigation, in which data subjects do have the right to have their case heard through to a final conclusion.

For more information on the issues in this article or on any other dispute query, please contact Gillian using 0191 211 7955 or [email protected].