Mr Delo made a data subject access request to Wise Payments Limited, a financial institution with which he had an account. Wise declined to provide much of the data sought, claiming that it was exempt from doing so. Mr Delo complained to the Commissioner that this response was not in accordance with his rights of access.
The ICO reviewed relevant correspondence and advised Mr Delo that it was likely that Wise had complied with its obligations, making clear that no further action would be taken.
Mr Delo brought a claim for judicial review, maintaining that the ICO failed to discharge a legal duty to determine any such complaint or alternatively had acted unlawfully in failing to investigate further and/or by reaching an unlawful and irrational conclusion.
By the time the judicial review claim came before the Court Mr Delo had been provided with the personal data he was seeking and although the claim became academic at that point the judge nonetheless decided to proceed with the case because there was a public interest in doing so. The High Court held that the ICO was not obliged to determine the merits of each and every complaint, it had a discretion which it exercised lawfully. The claim was therefore dismissed.
Mr Delo appealed to the Court of Appeal, however, the Court of Appeal agreed with the High Court. The ICO has the discretion to decide whether to investigate a complaint, in this case, it reviewed the relevant correspondence and concluded that it was likely that Wise complied with its obligations. If the ICO exercises its discretion in a reasonable and proportionate manner then the ICO is not obliged to reach a definitive decision on the merits of every complaint, and it may be appropriate in some cases to take other action, such as providing advice or guidance to the data subject or the data controller. The Court of Appeal also noted that Mr Delo had a few other options available to him, including bringing a civil claim against Wise.
Comments