3. Mr I complains that the ICO failed to consider the complaint he brought to it in October 2022 and the service complaint he made in February 2023.
4. Mr I says he feels discriminated against and the ICO’s lack of consideration of his complaints has caused distress and frustration.
5. As an outcome, Mr I wants the ICO to investigate his complaints.
6. The complaint Mr I made relates to a press release made by a police force in May 2018 that named Mr I. Mr N says this contained inaccurate information about Mr I, which they have asked the police force to remove from public circulation.
7. An online news service published an article referencing the information about Mr I. After a complaint from Mr I, the news service updated the article two years later.
8. The relevant regulator considered the news service’s reporting of the issue and published its findings in July 2022. It concluded that the news service had published incorrect information in 2018, which it had only partly corrected in 2020.
9. As the online article was based on the press statement, which Mr N and Mr I said was inaccurate, Mr N complained to the ICO on 22 October 2022 about the police force’s failure to ‘take action to remove the press statement from media and report the Police Officer in question for Gross Misconduct’. He asked that the ICO ask the police force to remove the article from circulation because it was inaccurate.
10. The ICO replied to Mr N’s complaint on 29 October and told him he had not provided enough evidence to decide whether there had been ‘an infringement of data protection law’. Mr N responded in several emails between 29 October and 5 December pointing out that he had already provided a lot of evidence and including more information. The ICO did not provide a response to these emails, some of which included requests from Mr N for it to reply and give an update.
11. On 9 December, the ICO replied to Mr N to tell him it could not look at the complaint at that time because he had sent ‘over 20 emails containing over 85 attachments’. The ICO asked for clarification of a few points and said it would not be able to consider the matter until Mr N had provided this. Mr N gave the ICO the information it asked for that day.
12. Mr N also made a complaint about the ICO’s service on 9 December. He complained about the delays and the ‘dismissive and disrespectful’ case handler’s correspondence with him about this. Mr N chased the ICO for a response to this on 19 December and got this the next day. The ICO upheld his complaint, apologised for this and explained Mr N could expect a response to his first complaint within the week. Mr N told the ICO on 22 December that he accepted these findings.
13. The ICO responded to Mr N’s request of 22 October on 23 December. It explained its remit and its decision that it was not going to look into the complaint further. The ICO provided Mr N with information about where else he might take his complaint and explained his review rights in respect of its decision.
14. Mr N was unhappy with this response and requested a review of the case the same day. The ICO started this and asked Mr N for more information on 10 January 2023. Mr N sent two emails on 11 January and another on 13 January. On 25 January the ICO asked Mr N to limit his contact and asked him to give it a particular piece of information, which he did later that day.
15. On 11 February, Mr N raised another complaint and chased a response to this on 15 February.
16. The ICO sent its review of the case on 20 February. It explained that Mr N’s complaint was essentially asking it to comment on or to decide the validity of the police force’s press statement. The ICO said it was not able to do this.
17. Mr N complained about this on 22 February and he got a response the same day saying the ICO was not going to comment further.
18. Mr N made a service complaint the next day. He chased a response to this on 27 February and again on 4 and 5 March. The ICO responded to this on 24 March.
Complaint about the police force
21. Before we decide if we should investigate a complaint further, we look at whether there are signs the organisation got something wrong. We do this by comparing what should have happened with what did happen. We have done this and have not seen any signs that something has gone wrong.
22. The ICO provided its view first on 23 December 2022 and again on 20 February 2023 after Mr N asked for a review.
23. It seems Mr N’s complaint is not strictly about the ICO’s lack of consideration of the complaint, but about the decision it reached. The ICO told Mr N it would not be investigating his complaint because this would require it to comment on whether the press statement (which is central to his complaint) was accurate or not. The ICO explained this was not something it was able to do.
24. We have not looked at the content of the statement either. Whether or not it is accurate is between Mr I and the police force and is something he can take legal action on if he wants to. We are only able to look at his complaint about the ICO’s handling of the concerns he raised with it about the statement.
25. The ICO does not have to investigate every complaint in detail. It is a regulator and, in this case, the ICO considered Mr N’s complaint and gave him with a response to it.
26. Section 165(4) of the Act states that the ICO must: • take appropriate steps to respond to the complaint • tell the complainant about the outcome of the complaint • tell the complainant about the rights under section 166 • if asked to by the complainant, give them further information about how to take the complaint forward.
27. ‘Appropriate steps’ is defined by the Act as: • ‘investigating the subject matter of the complaint, to the extent appropriate, and • informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with another…authority is necessary. ’
28. The ICO has done all of this. The ICO has discretion about what forms an ‘appropriate extent’ in responding to a data concern or complaint. Its role is not to investigate or adjudicate on every part of a complaint and it does not have to take specific action (like contacting an organisation), even if this is requested by the complainant. It decides how to regulate and when to take enforcement action in line with its Regulatory Action Policy.
29. While we recognise Mr N did not agree with the ICO’s decision, this does not mean the decision was wrong. We have seen no sign that it did not respond.
Complaint about the ICO
30. Mr N complains that the ICO failed to respond to his service complaint made on 23 February 2023.
31. We can see the ICO did respond to the service complaint on 24 March, after acknowledging receipt of his correspondence on 6 March. The delay was because of the case handler’s annual leave.
32. The ICO’s service complaint policy says it will acknowledge complaints about its service within 14 days and respond within 30 days. There are exceptions, but this is the general standard and it kept to this. The ICO acknowledged the complaint 11 days later and gave its response on 24 March, 29 days after it was received.
33. As the ICO has acted in line with its policy we have not seen that anything has gone wrong.
34. We realise our decision is likely to add to the frustration and upset Mr I has experienced in trying to resolve this matter. We hope our explanation of why we have made this decision is of some help to him.
1. We have carefully considered Mr I’s complaint about the Information Commissioner’s Office (ICO) which Mr N brought to us on his behalf. We are sorry to hear about the distress and frustration Mr I has experienced in his attempts to resolve his complaint.
2. We have not seen any sign that the ICO did anything wrong. It responded to the complaint brought to it and the complaint made about it. We acknowledge that neither Mr I or Mr N are happy with the ICO’s responses, but this does not mean it has failed to act as it should.