Ben Peter Delo, R (on the application of) v The Information Commissioner & Anor

The Information Commissioner is not required to investigate every data-protection complaint to the point of reaching a conclusive determination. Under Article 57.1(f) of the UK GDPR, the Commissioner may decide the appropriate extent and form of an investigation and may conclude that no further action is required. The complaints function forms part of the Commissioner’s wider regulatory, educational and advisory functions.

Section 166 of the Data Protection Act 2018 provides a procedural remedy for delay or failure to provide progress information. It does not permit the Tribunal to review, or require reconsideration of, a merits-based outcome already reached. Such an outcome may be challenged by judicial review.

The claimant complained to the Information Commissioner that Wise Payments Limited had failed to disclose personal data, including suspicious activity reports and internal records, in response to a data subject access request. The Commissioner investigated the complaint on the material supplied, concluded that Wise was likely to have complied with its obligations, and took no further action.

The claimant sought judicial review. By the hearing, Wise had disclosed the documents, making the claim technically academic. The court nevertheless heard it in the public interest because the issue had not been directly resolved in domestic or European case law: whether Article 57.1(f) required a conclusive determination of every complaint.

1. Academic claim. Applying R v Secretary of State for the Home Department ex p Salem [1999] 1 AC 450, the residual claim was academic because the claimant had obtained the documents and no remaining issue directly affected the parties’ rights and obligations between themselves. The court nevertheless exercised its discretion to hear the claim because the issue had substantial public importance.
2. Nature of the Commissioner’s complaints function. The historical legislation showed a continuing observance objective. The Commissioner’s complaints function remains part of a wider regulatory package, alongside monitoring, enforcement, educational and advisory functions. It is not quasi-judicial and does not determine the complainant’s civil rights.
3. Article 57.1(f). The words requiring investigation “to the extent appropriate” confer a broad discretion. Read literally, purposively and contextually, Article 57.1(f) does not impose an implicit duty to investigate every complaint sufficiently to reach a conclusive determination. The Commissioner may conduct a short, narrow investigation or a more extensive one, and may decide that no further action is appropriate.
4. Relationship with judicial remedies. Article 78.2 recognises that handling a complaint may include taking no action or rejecting it. Section 166 of the Data Protection Act 2018 addresses procedural failures while a complaint remains pending. It does not enable the Tribunal to convert a completed merits-based outcome into a different outcome. Judicial review supplies the effective remedy against such an outcome.
5. Application. The Commissioner was entitled to rely on the available correspondence, decide that further investigation was unnecessary, and inform the claimant that no further action would be taken. He was not required to obtain further material from Wise or determine conclusively whether Wise had complied with the UK GDPR. The judicial review claim was dismissed.

First-instance judicial review in the Administrative Court. Permission was granted by Richard Clayton KC, sitting as a Deputy High Court Judge. Mr Justice Mostyn dismissed the claim.