The King (on the application of Ben Peter Delo) v The Information Commissioner
| Jurisdiction | England & Wales |
| Judge | Lord Justice Warby,Lady Justice Elisabeth Laing,Lord Justice Peter Jackson |
| Judgment Date | 10 October 2023 |
| Neutral Citation | [2023] EWCA Civ 1141 |
| Court | Court of Appeal (Civil Division) |
| Docket Number | Case No: CA-2022-002471 |
[2023] EWCA Civ 1141
Lord Justice Peter Jackson
Lady Justice Elisabeth Laing
and
Lord Justice Warby
Case No: CA-2022-002471
IN THE COURT OF APPEAL (CIVIL DIVISION)
ON APPEAL FROM THE HIGH COURT OF JUSTICE
KING'S BENCH DIVISION (ADMINISTRATIVE COURT)
Mr Justice Mostyn
[2022] EWHC 2046 (Admin)
Royal Courts of Justice
Strand, London, WC2A 2LL
Jason Coppel KC (instructed by Pallas Partners LLP) for the Appellant
Philip Coppel KC and David Bedenham (instructed by in-house legal team) for the Respondent
Hearing date: 18 July 2023
Approved Judgment
Introduction
The UK GDPR protects the rights of individuals with regard to the processing of their personal data. The Information Commissioner is the supervisory authority in the United Kingdom with responsibility for monitoring the application of the UK GDPR. This appeal is about the Commissioner's responsibilities when a data subject lodges a complaint that a data controller has infringed data protection law.
The appeal involves two main questions: (1) is the Commissioner obliged to reach a definitive decision on the merits of each and every such complaint or does he have a discretion to decide that some other outcome is appropriate? (2) if the Commissioner has a discretion, did he nonetheless act unlawfully in this case by declining to investigate or declining to determine the merits of the complaint made by the claimant (“Mr Delo”)?
The context in which those questions arise is as follows. Mr Delo made a data subject access request (“DSAR”) to Wise Payments Limited (“Wise”), a financial institution with which he had an account. Wise declined to provide much of the data sought, claiming that it was exempt from doing so. Mr Delo complained to the Commissioner that this response was not in accordance with his rights of access. The Commissioner reviewed relevant correspondence and advised Mr Delo that it was likely that Wise had complied with its obligations, making clear that no further action would be taken.
Mr Delo brought a claim for judicial review, maintaining that the Commissioner had failed to discharge a legal duty to determine any such complaint or alternatively had acted unlawfully in failing to investigate further and/or by reaching an unlawful and irrational conclusion. Separately, Mr Delo exercised his right to sue Wise, alleging that it had wrongfully refused him access to the personal data covered by his DSAR.
By the time the judicial review claim came before Mostyn J (“the judge”) the case against Wise had been compromised and Mr Delo had been provided with the personal data he was seeking. The judge considered that the issues raised by the present claim were accordingly academic but he proceeded to decide them nonetheless on the grounds that, applying the principles identified in R v Secretary of State for the Home Department ex p Salem [1999] 1 AC 450, there was a public interest in doing so. The judge held that the Commissioner was not obliged to determine the merits of each and every complaint but had a discretion which he had exercised lawfully. He therefore dismissed the claim.
On this appeal Mr Delo endorses the judge's decision to address the two substantive questions but maintains that he gave the wrong answer to each of them. The Commissioner argues that the judge answered both questions correctly, but by a Respondent's Notice he asks us to say that the judge should not have answered either of them. The Commissioner contends that the judge should have dismissed the claim without examination of its merits because (a) Mr Delo had adequate alternative remedies and/or (b) both questions were academic and there was no wider public interest in deciding them.
The Commissioner's arguments about alternative remedies raise points of some interest which the judge did not decide. I do not think it necessary to do so. Assuming there was some adequate alternative remedy, that is a matter that goes to discretion not jurisdiction. In all the circumstances of this case, for reasons I shall develop, I would consider the merits in any event. And although the settlement with Wise meant that Mr Delo had achieved his main objective, and in that sense at least the claim was academic, the issues raised are of importance to data subjects generally and to the Commissioner. The judge's decision that it was in the public interest to decide them was a legitimate exercise of judgment with which we have no grounds to interfere. Furthermore, the judge has decided the issues, permission has been granted for this appeal, and we have heard full argument. To dismiss the appeal on the procedural grounds advanced by the Commissioner would be a waste of resources and a recipe for uncertainty.
For these reasons I conclude that it is clearly in the public interest for this court now to decide both the questions I have identified.
The legal framework
Data protection law has gone through three main phases of development in this jurisdiction. The Data Protection Act 1984 gave effect to the Council of Europe Convention of 28 January 1981 for the Protection of Individuals with regard to Automatic Processing of Personal Data. The 1984 Act created a novel but relatively basic regime to protect individuals against misuse of personal data being processed by computers. It established the office of the Data Protection Registrar, with responsibility for dealing with complaints. The Data Protection Act 1998 (“the DPA 1998”) gave domestic effect to Directive 95/46/EC (“the Data Protection Directive”). It created the role of Information Commissioner with expanded functions compared with those of the Data Protection Registrar. The General Data Protection Regulation 2016/679 (“the GDPR”) replaced the Data Protection Directive. It was made in May 2016 and came into force with effect from 25 May 2018.
The GDPR had direct effect in EU Member States, including the UK, until the end of the Brexit implementation period on 31 December 2020 (“IP Completion Day”). It was supplemented domestically by the DPA 2018 which came into force at the same time as the GDPR. Part 2 of the DPA 2018 was designed to be read with the GDPR, and as complementary to it. Part 3 was intended to give effect to the EU Law Enforcement Directive (2016/680) by making provision about the processing of personal data for law enforcement purposes, which is outside the scope of the GDPR. Part 4 deals with processing for intelligence purposes, which is also beyond the scope of the GDPR. Part 5 deals with the powers of the Information Commissioner. Part 6 makes provision about enforcement of the data protection legislation.
I have spoken of only three main phases in the law because the UK Parliament decided that from IP Completion Day the content of the GDPR should remain part of English law, with certain modifications and amendments, under the title “UK GDPR”. The legislative measures used to achieve this are identified and summarised in R (Open Rights Group) v Secretary of State for the Home Department [2021] EWCA Civ 800, [2021] 1 WLR 3611 [5] and [12]–[13]. They included some textual amendments to the GDPR and to the DPA 2018 but none that affects the substantive provisions that are relevant in this case.
So, although Mr Delo's DSAR and Wise's response to it came before IP Completion Day, nothing turns on this. Mr Delo's complaint to the Commissioner was made after IP Completion Day so the relevant rights, duties, powers and responsibilities are to be found in the UK GDPR and the DPA 2018 as amended. For simplicity, I shall refer to the UK GDPR except where I am referring to an aspect that appears only in the EU version.
The provision relied on by Mr Delo for his DSAR is Article 15 of the UK GDPR. This confers the “Right of access by the data subject”: the right to obtain from the data controller access to the personal data themselves and information as to the purposes of the processing and the identities of those to whom the data have been or will be disclosed, as well as other rights.
The right of access is an important one but it is not absolute. There are several exemptions. The one relevant to this case is provided for by paragraph 2 of Schedule 2 Part 1 of the DPA 2018. This provides that “the listed GDPR provisions”, which include Article 15, do not apply to personal data processed for the purposes of preventing or detecting crime, apprehending or prosecuting offenders, or assessing or collecting taxes, “to the extent that the application of those provisions would be likely to prejudice” any of those matters. This qualified exemption, which has been called “the Crime and Taxation Exemption”, is relevant here because, as I shall explain, the Commissioner inferred that this was the exemption on which Wise had relied when responding to Mr Delo's DSAR.
A data subject dissatisfied with the data controller's response to a DSAR has two options: a regulatory complaint to the Commissioner about the conduct of the data controller and a direct claim for a judicial remedy against the data controller itself. Both are provided for in Chapter VIII of the UK GDPR, which is headed “Remedies, liability and penalties”.
Article 77 of the UK GDPR is headed “Right to lodge a complaint with the Commissioner”. It says this:
“1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with the Commissioner if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
2. The Commissioner shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article...
To continue reading
Request your trial