15. Before we decide if we should conduct a detailed investigation of a complaint, we look at whether there are signs the organisation has got something wrong. We do this by comparing what should have happened with what did happen. We have done this and have not found any indications that something has gone wrong.
Failure to consider new complaints raised in January and February
16. In October 2023 Mr T contacted the ICO to raise concerns the property developer had not engaged with his SAR request. Mr T requested the ICO carry out a review of his complaint, which it did. We have discussed this in more detail in the section below.
17. In its response sent to Mr T in October, the ICO reminded Mr T of its remit. It said it considers complaints to an appropriate extent and a decision by it, is only a view or opinion. It said it was not able to investigate and resolve every aspect of a person’s complaint. The ICO said Mr T may chose to take this case to court if he wanted a more final decision.
18. In January 2024, Mr T contacted the ICO again to raise a complaint the property developer had not complied with the advice the ICO had given. This advice included both parties to work together to refine Mr T’s SAR request as the property developer said the data it held for him was too significant to process. Mr T said it was his view the property developer unreasonably withheld information from him.
19. The ICO wrote back to Mr T and said this was a continuation of the complaint it had already considered about the property developer and it did not need to consider opening a new case. The ICO said it would contact the property developer again about Mr T’s request, but it did not have any concerns about the organisation’s compliance with the Data Protection Act. The ICO said it would not take any further action as it was satisfied with the advice it had given.
20. The ICO confirmed it had reviewed recent emails between the parties and did not find there to be any additional data protection concerns for it to consider. The ICO advised Mr T to respond to the property developer and identify the information he wanted. It said if the property developer refused to provide information, it would then review its position.
21. After receiving this letter, Mr T contacted the ICO to raise concerns about the way it handled his complaint. He requested it log his service complaint and escalate this to a manger.
22. Mr T called the ICO again in February 2024. He said he was unhappy with the ICO and the advice it gave to him in January when he called its helpline. The notes taken from the call show the ICO signposted Mr T to our Office to escalate his service complaint and referred him to court if he wanted a final decision on his SAR request.
23. The ICO provided its final response to Mr T in February 2024. It said it understood Mr T was unhappy with its decision to refine his request and he still had concerns about the way the ICO had handled this matter.
24. Within its response the ICO said the advice it gave to Mr T in January would be the same should he wish to escalate his concerns. It said it was satisfied this was the correct advice. It considered it had handled his case and complaints appropriately and in line with its case handling procedures.
25. In considering complaints about the ICO we can only look at how the ICO handled a complainant’s data concerns, or complaints about its service. It is not our role to reach our own view on the application of data protection law or substitute our own judgement for that of the ICO.
26. The ICO’s responsibilities upon receiving complaints such as Mr T’s are set out under section 165(4) of the Data Protection Act 2018. This states the ICO must take appropriate steps to respond to the complaint, inform the complainant of the outcome and if asked to do so, provide them with further information on how to pursue the complaint.
27. Upon review of the evidence, we can see the ICO contacted the property developer to investigate Mr T’s complaint on 15 August, 22 August, 5 October and 16 October 2023 and provided its decision to both parties on 5 October. It also gave information on how to escalate his concerns. We consider this was in line with the DPA legislation.
28. We have also looked at the ICO’s service standards which say it is up to the ICO to decide whether it should take further action. The standards reiterate it is not the ICO’s role to investigate every individual complaint, but it will consider whether there is an opportunity to improve an organisation’s practice.
29. From its initial investigations the ICO found the property developer had an incorrect address for Mr T. The developer explained to the ICO it had written to Mr T and provided him with a list of the personal data it held for him.
30. The ICO contacted both parties and said Mr T and the property developer should work together to refine the request. It advised it could not make the organisation provide all the data but acknowledged it would be unreasonable for the developer to fully restrict Mr T’s information. It concluded it did not need to take any further action.
31. In line with legislation, the ICO has discretion as to what constitutes ‘appropriate steps’ in responding to a data concern/complaint. Its role is not to investigate or decide on every aspect of a complaint and it is not obliged to take specific action, even if the complainant requests this.
32. We have found the ICO considered Mr T’s complaint in line with its role and obligations and have therefore not seen indications anything went wrong. We acknowledge Mr T’s belief that his concerns should have been handled as new issues, but overall, we think the ICO managed Mr T’s additional concerns appropriately. After looking at Mr T's correspondence to the ICO, we can see his concerns were related to the issues the ICO had previously dealt with about the property developer.
33. As advised by the ICO, it is open to Mr T to take his data protection complaint to court under data protection legislation, irrespective of the ICO’s decision. If Mr T wishes to explore this option, we strongly recommend he approach a legal professional for further information on this matter.
Failure to review its own case handling in January 2024
34. In early October 2023, Mr T asked the ICO to review the handling of his data protection complaint. He was unhappy with the ICO’s decision and wanted it to take further action in response to his SAR case.
35. The ICO responded to Mr T in the same month saying it had considered the points he had raised and reviewed the relevant information it held about his case. It said it had reviewed its case handling procedures and was satisfied it dealt with his complaint appropriately. It said it was not appropriate for it to take regulatory action because it believed there was further action Mr T, and the property developer could take to resolve the matter.
36. In January 2024, Mr T requested a second review from the ICO and asked it to reconsider how it has handled his case against the property developer. Mr T reaffirmed he wanted the ICO to take further action against the property developer.
37. The ICO responded to Mr T in January and February 2024. It said it had fully considered his case and provided its outcome. It said it had already carried out a case review and considered the case handling concerns Mr T had raised. It said it did not have concerns about the way his case had been managed. It acknowledged Mr T requested for someone new to review his case but determined he had reached the end of its process. The ICO said it would not be taking any further action and advised Mr T of his options to either pursue legal action or approach our Office to escalate his service complaint.
38. Mr T says he is concerned he was only able to ask the ICO to review his case once. He says the ICO failed to address its own poor service in not carrying out a further independent review of how it handled his case. Mr T believes the case review carried out in October should not have prevented him from raising issues which he experienced since then.
39. The ICO’s service standards say when a complaint is escalated, someone independent to the original case officer will review the case handling. the standards say the reviewing officer will try to resolve outstanding issues with the complainant. When a final response is issued, the reviewing officer will advise the complainant how to escalate their complaint if they remain dissatisfied. This includes requesting an external review from our Office.
40. Our Principles say organisations should ensure its decisions and actions are proportionate, appropriate and fair. They also say organisations should inform customers what they can expect, and they should act in accordance with the law and with regard for the rights of those concerned.
41. The evidence available to us shows the ICO carefully reviewed Mr T’s additional request for a review of how it handled his case, but it did not deem this proportionate given its advice remained unchanged. The ICO wrote to Mr T on 22 January 2024 to explain it was not able to assist him further, it referred to the action it had already taken on his case and gave advice on the next steps available to him.
42. We can see Mr T feels strongly about his concerns and that the ICO should have done more to address them. We appreciate the outcome of the ICO’s processes led him to lose trust in the regulator and caused him stress.
43. Having thought about everything Mr T has told us, and considering the evidence available, we do not think the ICO’s decision not to carry out a further formal review of Mr T’s data handling concerns indicates maladministration on its part. This is because the ICO acted in line with its service standard when it explained it was open to him to approach our Office if he remained unhappy on the outcome of its review in October 2023.
44. We also consider the ICO’s actions were in line with our Principles. In January 2024, the ICO explained to Mr T the reasons why it did not consider a further formal review was indicated when it wrote to him. In a further letter to Mr T dated February 2024, the ICO reflected on the more recent case handling concerns he had raised and concluded his case was handled appropriately.
45. We consider this was a fair and proportionate response from the ICO given the steps it had already taken to investigate Mr T’s concerns and the further work it did to reflect on the case handling concerns he had raised.
46. Additionally, explaining to Mr T it was open to him to pursue his SAR request with the courts or to approach us, was also reasonable.
47. As we are satisfied the ICO acted in line with the guidance we have mentioned, we do not consider there is any further action we can take. We know these matters are important to Mr T, so we hope that we have clearly explained above how we reached our decision in his case. We thank him for bringing his complaint to us for us to consider.