Ben Peter Delo, R (on the application of) v The Information Commissioner

Articles 57(1)(f), 77 and 78 of the UK GDPR do not require the Information Commissioner to determine the merits of every complaint. The Commissioner must receive and handle each complaint, investigate its subject matter to the extent appropriate, and provide an outcome. That outcome may be a merits determination, but may also be a decision to take no further action after limited investigation and an expressed view that an infringement is unlikely. The discretion is subject to judicial review for lawfulness. A direct claim against the controller under Article 79 is a separate remedy, but its availability may be relevant to the Commissioner’s enforcement decisions.

The claimant complained to the Information Commissioner after Wise Payments Limited provided only part of the personal data sought in a data subject access request. The Commissioner reviewed the correspondence, considered that Wise was likely to have complied with its obligations, and took no further action.

The claimant sought judicial review. Mostyn J dismissed the claim, holding that the Commissioner had a discretion not to determine the merits of every complaint: [2022] EWHC 3046 (Admin). Although the underlying dispute with Wise was later settled, the judge decided the issues in the public interest. The appeal concerned the scope of the Commissioner’s complaint-handling duties and whether the decision was unlawful or irrational.

The appeal was dismissed. Warby LJ gave the judgment of the court, with which Laing LJ and Jackson LJ agreed.

1. The court declined to dismiss the appeal solely on the grounds of academicity or alternative remedies. Whether an alternative remedy exists is a matter of discretion, not jurisdiction. Applying the principles identified in Salem, the judge had been entitled to decide issues of general importance despite the settlement of the claim against Wise.
2. The wording of Articles 57, 77 and 78 of the UK GDPR is significant. The provisions require the Commissioner to handle complaints, investigate their subject matter to the extent appropriate, and inform complainants of progress and outcome. They do not use language requiring adjudication, determination, resolution or a decision that a complaint is upheld or rejected. The natural interpretation is therefore that the Commissioner must address every complaint but has a broad discretion over the intensity of the investigation and the form of the outcome.
3. An outcome may be a conclusive decision on the merits, but it may also be a decision to cease handling a complaint after limited investigation, including an expressed view that the alleged infringement is unlikely. Recital 141 and Article 78 support a judicial remedy for a failure to handle or inform, or where action is necessary to protect the data subject’s rights. They do not require a merits determination in every case.
4. Case C-132/21 confirms that the remedies against the Commissioner and controller may operate independently and concurrently. It does not make an Article 78 claim a cost-free proxy for an Article 79 claim, nor does it require courts always to permit parallel proceedings. The availability of a direct claim under Article 79 may be considered when the Commissioner deploys regulatory resources. The court did not decide the Commissioner’s belated argument about the full scope of section 166 of the Data Protection Act 2018.
5. Case C-311/18 concerned continuing non-compliance and the exercise of specific Article 58 enforcement powers. Its reasoning could not be extrapolated into a general obligation to determine every complaint on its merits. On the facts, the Commissioner had sufficient material to form a rational view that Wise was likely to have complied with the law and that there was no evidence of a blanket approach. No further investigation or conclusive merits determination was legally required.

1. Court of Appeal (Civil Division): The appeal was dismissed. The court upheld the conclusion that the Commissioner had lawfully exercised a broad discretion under the UK GDPR.
2. High Court of Justice, King’s Bench Division (Administrative Court): Mostyn J dismissed the judicial review claim, holding that the Commissioner was not required to determine the merits of every complaint: [2022] EWHC 3046 (Admin).