Lord Justice Warby, giving the leading judgment, upheld a first instance decision. In doing so the appeal court set out to answer two questions:

1. Is the Information Commissioner obliged to reach a definitive answer on the merits of each and every complaint or is there a discretion to decide that some other outcome is appropriate?
2. If the Information Commissioner has a discretion, did they nonetheless act unlawfully in this case by declining to investigate or determine the merits of the complaint made by Mr Delo?

Background

Mr Delo opened an account with Wise, a UK-based foreign exchange financial technology company, in August 2018 in order to facilitate currency conversion. He then sought to transfer sums of money from HSBC in Hong Kong to his Wise account and then to his account with Bank of China. Wise asked Mr Delo to provide further information about the transactions. Whilst Mr Delo provided the information requested Wise informed Mr Delo that they were deactivating his account.

Mr Delo made a data subject access request to Wise. In their response, they confirmed that they had provided copies of some documents, but also that some data was exempt in accordance with the UK General Data Protection Regulation. Mr Delo submitted a second DSAR to which Wise responded maintaining that the original response was in line with the provisions of the UK GDPR and the Data Protection Act 2018.

Mr Delo was notified by Thames Valley Police that they were investigating the source of funds in the Wise account. He then wrote to Wise again to request his personal data and filed a complaint with the ICO. The ICO decided to take no further action on Mr Delo's complaint which they said was too widely drawn and supported Wise's position that they were exempt from giving some data under the UK GDPR.

Mr Delo made a second complaint asking the ICO to reconsider on the basis that he was not asking Wise to explain its decision to close his account, but disclose those documents which named him recording the decision and the reasons for it. Additionally, he complained that the ICO had not addressed Wise's failure to disclose all data. Again, the ICO dismissed the Mr Delo's complaint on the basis that it was likely that Mr Delo had been provided with all of the information to which he was entitled by Wise. Mr Delo issued a claim for judicial review.

Question 1

In dealing with the first question, Warby LJ concluded that "the legislative intent was not to require the Commissioner to determine every complaint on its merits." Instead, the Commissioner must deal with each and every complaint and inform the complainant of some form of outcome for which they have a wide discretion, having first investigated the complaint to the extent appropriate.

Warby LJ focussed on the wording of Articles 57, 77 and 78 of the UK GDPR "all of which deal in one way or another with the duties owed by the Commissioner and the rights enjoyed by data subjects with regard to the Commissioner."

Particular attention was paid to the language of Article 57 which states that the Commissioner must "handle" a complaint and "investigate the subject-matter of the complaint" but "to the extent appropriate". The complainant must be informed about the "progress" of the complaint and its "outcome". Warby LJ noted that nowhere did the Regulation adopt language such as "adjudicate, decide, determine, rule upon or resolve a complaint, or that complaints must be upheld or not upheld by the Commissioner" that would indicate the Commissioner must make a finding on the merits of the claim. The Judge made the same findings for Articles 77 and 78.

Question 2

Again, the Court of Appeal upheld the decision at first instance and rejected Mr Delo's contention that the materials available to the Commissioner were insufficient to enable him to reach a rational decision as to whether Wise had acted lawfully in their response to the DSARs. The court found that the Commissioner has a discretion to decide how to deploy the ICO's resources taking into account the merits of the complaint, the likely outcome of the investigation and alternative methods of enforcement that may be available to the data subject. Accordingly the right of a data subject to bring a direct claim against the data controller was also a relevant consideration.

Comment

This decision will likely come as a relief to the ICO who would have had to increase their resources significantly in order to investigate every complaint fully and reach a decision as to whether it should be upheld or not. A wider discretion as to how the ICO can deal with a complaint and an investigation has therefore been maintained.

For data subjects, there may be some uncertainty, but it remains open to them to exercise their rights against a data controller under Article 79 or by way of a compliance order under section 167 of the Data Protection Act 2018. The Court of Appeal's flagging that to data subjects may prove to be unwelcome for data controllers.