Thread by @theDPOdaily

An individual used the #FOI website What Do They Know to ask @ICOnews about complaints made about the Met Police; effectively, they wanted to know how many of the complaints were upheld. The info was disclosed, but the response also contained an interesting statement. (1/7)

The ICO reply said: “Please keep in mind that there is no requirement to produce a formal decision in data protection cases such as the Decision Notices issued in FOIA ones.” whatdotheyknow.com/request/795467… (2/7)

There’s a solid argument that this is true – there isn’t a line in the Data Protection Act 2018 which is as unambiguous as S50(2) of the FOI Act (the Commissioner “shall” make a decision unless certain conditions are met. (3/7)

S165(4) of the DPA says that the ICO must “take appropriate steps to respond to the complaint”, and the complainant has a right to challenge the ICO if they don’t respond within a certain timeframe, but a formal response isn’t required in every case. (4/7)

There have been several attempts to beef up complainants’ rights via that right of challenge, but the Tribunal has decided more than once that the only thing complainants can do is push the ICO to deal with the complaint, not appeal its outcome. (5/7)

I think ICO’s interpretation of what constitutes ‘appropriate steps’ is flawed; their priority is plainly closing complaints rather than reaching the right outcome. I think this approach is unhelpful and doesn’t entirely line up with what the law says. (6/7)

However, I don’t imagine many people have the appetite to launch a judicial review of whether the ICO’s response to their complaint is appropriate (I've given up making complaints to them about DP matters), so the complaints side of the business will remain as it is. (7/7)