Landmark Decision Handed Down On ICO's Responsibilities In Handling Subject Access Requests

On 10 October 2023, the England and Wales Court of Appeal handed down its decision in Delo, R. (On the Application Of) v. The Information Commissioner¹, in which it upheld an earlier High Court ruling that the UK's data protection regulator, the Information Commissioner's Office (ICO), is not obliged to reach a definitive decision on the merits of each and every data subject access request (DSAR) complaint, but that it – instead – has broad discretion, which it found the ICO had exercised lawfully under the UK General Data Protection Regulation (GDPR) when responding to a DSAR complaint.

Background

The claimant, Ben Delo, was a customer of Wise Payments Limited, a financial institution with which he held an account. Wise had deactivated the claimant's account and sent a suspicious activity report to the National Crime Agency following a bank transfer request of £270,000 by the claimant. As a result, Delo submitted a DSAR asking for a copy of the personal data