4. Mr O complains the ICO has failed to respond to concerns he has raised about third-party organisations within its agreed timescales. He complains that, when he then complains to the ICO about its failings in this regard, it does not respond to his complaints within its agreed timescales.
5. Mr O says he has to chase the ICO for responses, which causes him to spend time and trouble doing so.
6. Mr O seeks payment of £5,000 to compensate for this.
7. Mr O provided 23 complaint forms for us to consider, which we combined to look at the overall issues rather than each complaint.
8. As of the end of November 2022, Mr O had just over 70 complaints registered with the ICO. These span the period 15 May 2020 to 8 March 2022.
11. Before we decide whether we should look at a complaint in more detail, we look at whether there are signs the organisation has got something wrong. We do this by comparing what should have happened with what did happen. We have done this and have not found any signs the ICO takes an unreasonably long time to deal with Mr O’s complaints.
12. Mr O’s complaints with the ICO seem to have come about in a similar way. For example, he receives unsolicited contact from a third party and asks them to provide him with details of the information it holds about him and his consent to receiving such contact. He then complains to the ICO about the third party using his data without his agreement. When he does not receive a response from the ICO within its stated timescale, he then complains to the ICO about this. We will consider his complaints to the ICO and those about the ICO separately.
Complaints to the ICO
13. Our principles say organisations should consider taking a new or different approach where it will lead to better service, provide easily accessible services, and make sure customers know what to expect from it and what their own responsibilities are. They add organisations should deal with people quickly and let them know if things will take longer than either party thought.
14. The ICO told us it has provided Mr O with a single point of contact (SPOC) ‘for many years now, due to the frequency and volume of complaints and the fact [it] want[s] to ensure a consistent approach is taken in relation to his concerns across all sectors’.
15. The first stage in bringing a complaint to the ICO is to complete a form. It starts by explaining it should be used to report a concern the complainant has been unable to resolve with an organisation. It indicates the complainant should try to do this directly before asking the ICO to consider the issue. Indeed, the ICO’s automated email acknowledgement says, ‘if you have made a new complaint – we are unlikely to look into it unless you have raised it with the responsible organisation…first’.
16. The ICO’s responsibilities when it receives a complaint about an organisation are set out in section 165(4) of the Data Protection Act, 2018. It is required to ‘take appropriate steps to respond to the complaint’. ‘Appropriate steps’ is defined within the same Act as ‘investigating the subject matter of the complaint, to the extent appropriate’.
17. The ICO’s Service Standards set out it will not investigate or adjudicate on every single complaint made. It also explains it is the ICO’s decision whether it takes further action in response to the issue raised. It is not obliged to take specific action, even if the complainant asks it to.
18. Regardless of the decision reached, the Act requires the ICO to inform the complainant of the outcome. It told us it has responded to all of Mr O’s complaints to provide him with an outcome. It says it ‘usually’ advises him to contact the third-party organisation first and allow it the opportunity to respond to the issue (where this has not been done) and then closes cases where he has not done so.
19. The ICO also explained it aims to allocate an officer to a complaint within three months of receiving the complainant’s concern. It said, however, this was exceeded across the organisation on a number of occasions as a result of the COVID-19 pandemic and the pressures this placed on it, as with many other organisations. In view of this, it said it aims to provide an outcome within six months of receipt of the complaint in 90% of cases received.
20. We are mindful Mr O has a SPOC. This may cause him to have to wait longer than would otherwise be the case. We would not expect the ICO to prioritise his complaints above those of other people because he has a SPOC. We would expect his complaint to be added to the queue of cases waiting to be considered and to be allocated to his SPOC when it reaches the top and the SPOC has the capacity to take on his case.
21. The ICO aims to provide an outcome within six months of receipt of 90% of cases. This means not all cases will be concluded in that time. In any case, the ICO deals with Mr O's case slightly differently, and this might result in delays to his specific cases.
22. It is not reasonable for us to apply standard working practices to non-standard situations such as this. The ICO has evidently tried to deal with Mr O helpfully and quickly, communicated with him about its approach and told him what its, and his, responsibilities are. We believe in tailoring its approach to Mr O in the way it has it has acted in line with our principles. We have not identified anything in the ICO’s actions that fall so far short of these they might amount to maladministration (mismanagement or fault).
Complaints about the ICO
23. As with the SPOC allocated to Mr O, the ICO also explained it has assigned a specific Reviewing Officer to consider any review requests or service complaints Mr O makes. Again, the ICO advised this is the result of the volume and frequency of correspondence Mr O sends to it. It is also to make sure it takes a consistent approach in dealing with his cases.
24. Our principles say organisations should follow their own policy and procedural guidance. In this case, the ICO’s Service Standards apply.
25. The ICO’s Service Standards state a complaint about it should be dealt with within 30 days. This is not an obligation but an ideal aim. As with the non-standard approach to dealing with Mr O’s complaints to the ICO, it seems appropriate to apply the same reasoning to his complaints about the ICO. Given the novel approach it is using to try to provide an effective service to Mr O, it seems fair the ICO cannot always meet the aim of dealing with his complaints within 30 days. Again, there are no signs the ICO has delayed its responses so significantly or frequently that we might deem it to amount to maladministration.
26. It is clear Mr O is unhappy with the level of service he has received from the ICO overall. It appears to have a backlog of work attributable to the effects of the COVID-19 pandemic. The more contact Mr O makes with the ICO, the more delays he is likely to experience, given he is in more regular contact with it than another complainant would likely be. It does not seem his current approach to dealing with this is aiding faster responses. Indeed, he explains he has spent considerable time and effort in making contact with the ICO. In fact, he may well be contributing to his own perceived injustice by persisting with complaining in this way.
27. In summary, we have decided not to proceed with our consideration of this complaint. This is because although there have been delays in responding to Mr O in comparison with the ICO’s standard timescales, there is no failure in this regard. Mr O’s contact with the ICO has resulted in his correspondence being handled in a non-standard way, which has led to the increased time. Although we acknowledge how Mr O feels inconvenienced, as there has been no maladministration, there is nothing further for us to consider.
1. The Parliamentary and Health Service Ombudsman has carefully considered Mr O’s complaints about the Information Commissioner’s Office (ICO). We are sorry to hear about the inconvenience dealing with these complaints has caused him.
2. The ICO has, quite reasonably, put non-standard practices in place to deal with Mr O’s frequent contact. We cannot, therefore, compare this to standard approaches the ICO takes in dealing with complaints brought to it or about it. With this in mind, we do not consider the ICO takes an unreasonably long time to deal with Mr O’s concerns.
3. We have therefore decided to take no further action.