Veri Koruma Şikayetlerine İlişkin Yazışmalara Erişim

1. Background
2. Scope of the Review
3. Preliminary Matter
4. Analysis and Findings
5. Decision
6. Right of Appeal

Whether the DPC was justified in its decision to refuse the applicant's request for a copy of emails/communications sent to its customer service department about full or interim replies to complaints taking longer than 20 working days on the ground that the FOI Act does not apply to the records sought, pursuant to Schedule 1, Part(1)(f) of the Act

12 December 2024

Background

Given the nature of the request that is the subject of review in this case, I consider it appropriate to include some relevant background information.

On 23 October 2023, the applicant submitted a complaint by email to the DPC customer service email address about the manner in which it had handled complaints she had made previously under data protection legislation. On 7 November 2023, she sent a further email noting that under the DPC's customer service charter, her email should have been acknowledged within three working days and that this had not happened. She asked for a progress update on her complaint. Following an exchange of emails, she sent further emails on 24 November 2023 and 5 January 2024 noting she had not received a full or interim replay within 20 working days as set out in the customer service charter.

Also, on 5 January 2024, the applicant submitted an FOI request to the DPC for a copy of emails/communications sent to the DPC's customer service department about full or interim replies to complaints taking longer than 20 working days.

On 12 January 2024, in response to the applicant's emails in respect of her customer service complaint, the DPC informed the applicant that the role of its customer service complaints was to review the applicant's complaint against its customer charter to assess her customer service complaint as it relates to its service and how this service is provided. It said customer service complaints do not assess her data protection concerns and do not impact upon the outcome of her case. It said that as the content of her original email to customer services concerned her complaint as opposed to how the service from the DPC was provided to her, her correspondence was provided to the complaint handling team to consider and it would respond in due course. In response, the applicant said that her complaint was based on Article 3.1 of the DPC's customer service charter and that her complaint was not handled according to natural justice and fair procedures.

On 2 February 2024, the DPC issued its decision on the FOI request the applicant had submitted on 5 January 2024. It refused the request pursuant to Part 1(f), Schedule 1 of the FOI Act, on the ground that the records sought do not concern the 'general administration' of the DPC and as such, fall outside the scope of the Act. On 9 February, the applicant sought an internal review of the DPC's refusal of her request. Among other things, she argued that complaints about the DPC's customer service taking a long time to respond to customer service complaints well beyond what is in the customer service charter does not concern the core business of DPC and rather is an FOI request about general administration. She said the complaints she was seeking access to are only in relation to customer service. She said that if any of those complaints also detail anything about core business, then the DPC is free to redact those parts. The DPC issued its internal review decision on 22 February 2024, wherein it affirmed its original decision. It said that correspondence about complaints concern a core function of the DPC. The applicant sought a review by this Office of the DPC's decision on 24 February 2024.

I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the communications between the DPC and the applicant as outlined above and to the communications between this Office and both the DPC and the applicant on the matter. I have decided to conclude this review by way of a formal, binding decision.

Scope of the Review

This review is concerned solely with whether the DPC was justified in refusing, pursuant to Schedule 1, Part 1(f) of the FOI Act, the applicant's request for a copy of emails/communications sent to its customer service department about full or interim replies to complaints taking longer than 20 working days.

Preliminary Matter

It should be noted at that outset that this Office has no role in considering the appropriateness, or otherwise, of the manner in which the DPC handles customer service complaints nor does it have a remit to act as an alternative dispute resolution mechanism with respect to actions taken by FOI bodies.

Analysis and Findings

Section 6 of the FOI Act defines those entities that are public bodies for the purposes of the FOI Act. Section 6(2)(a) provides that an entity specified in Part 1 of Schedule 1 of the Act shall, subject to the provisions of that Part, be a public body for the purposes of the Act. Schedule 1, Part 1 contains details of bodies that are partially included for the purposes of the Act and details of certain specified records that are included or excluded. If the records sought do not come within the description of the records that are included, or if they come within the description of the records that are excluded, then the Act does not apply and no right of access exists.

Part 1(f) of Schedule 1 provides that section 6 does not include a reference to the Data Protection Commissioner, or an officer of the Commissioner, in relation to a record, save as regards a record concerning the general administration of the Office of the Commissioner. In other words, the only records held by the DPC that are subject to the FOI Act are those that concern the general administration of that Office. In accordance with Part 1(f), all other records held by the DPC are excluded.

DPC's Submissions

In its submission to this Office, the DPC said it considers that records it holds in relation to the investigation of customer service complaints relates to its core investigative role and do not form part of the general administration of the Office. It argued, therefore, that records relating to the DPC's assessment and handling of complaints fall outside the remit of the FOI Act. It said that the applicant specifically requested records pertaining to other people's complaints which, it said, falls within the realm of the DPC's core function. It said that for the DPC, a complaint is a defined term in section 107 of the Data Protection Act 2018 and that this is how it understands the meaning of this term in the context of the request.

The DPC said that Article 57(1)(f) of the General Data Protection Regulation (GDPR) provides that one of the tasks of the DPC, as a Supervisory Authority, shall be to handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80 of the same regulatory framework. It said the records requested consist of emails/other communications between the DPC and data subjects, or Article 80 bodies, in the context of the relationship formed between those parties on foot of the handling of their complaint(s), pursuant to Part 6 of the Data Protection Act 2018. It said the request does not seek records as to how the DPC handles customer service complaints, i.e. records that set out the DPC's office procedures for dealing with queries on delays in issuing replies to complaints. Rather, it said the request seeks the actual correspondence, which it considers to be held by the DPC within the context of the relationship established between the parties by dint of their lodging a complaint pursuant to Part 6 of the Data Protection Act, and thus for a core, statutory function.

Following a request by this Office for further clarification of its position, the DPC said that if the applicant had made a general request about how she specifically was treated in a customer service capacity, having regard to what she has identified as replies or interim replies to complaints taking longer than 20 days, it would have been necessary for the DPC to consider whether some or all of each relevant record fell within the meaning of 'general administration' of the DPC. It said it does not have a separate 'customer service' unit that operates in isolation from its complaint-handling teams. It said that in those circumstances, any interactions between the applicant and the DPC that contained complaints regarding customer service, and in particular the time taken to respond to data protection complaints, would have taken place in the context of the complaint-handling process itself, i.e. a core statutory function of the DPC. It said that in circumstances where it was possible to identify records or parts of records that did not also relate to the DPC's core statutory complaint-handling function, the request in respect of how the applicant herself was treated in a customer service capacity would have been granted.

The DPC added that the handling of complaints lodged by a data subject, or an Article 80 body, is a task of the DPC under Article 57(f) GDPR, and Part 6 of the Data Protection Act 2018. It said a complaint submitted to the DPC as a customer service complaint does not carry the same statutory meaning as a 'data protection complaint'. It said any customer service complaint relating to alleged or actual delay on the part of the DPC in relation to any such complaint, would necessarily have been raised in the overall context of the 'data protection complaint' handling process, given the manner in which the DPC is currently internally structured.

Applicant's Submissions

In her application to this Office for a review of the DPCs refusal of her request, the applicant provided a summary of her correspondence with the DPC. She said she believed that in assessing her FOI request, there was a fundamental failure to distinguish between a customer service complaint and a complaint about customer service. She argued that while the former may relate to the core business of the Office, i.e. data protection complaints, the latter concerns the management of the Office and is therefore covered under general administration. She said the DPC chose to make the standards it set for itself available online on its customer service charter, which, she said, is clearly under the auspice of office procedures. She said that inquiring if the DPC has any complaints about those office procedures and if it is fulfilling what it set out in its customer service charter does fall under the FOI act and should be released.

The DPC's Customer Service Charter

Section 3 of the DPC's 'Customer Charter 2024 -� 2026', which is available on its website, is entitled 'Timelines in relation to queries, concerns and complaints under the Data Protection Legislation'. Among other things, the relevant section provides that the DPC will acknowledge all new queries and concerns within three days, keep the complainant advised of progress of their case, and inform the complainant as promptly and clearly as possible of the outcome. It provides that for queries received by web-form, email or letter, the DPC will acknowledge correspondence (queries) within 3 working days and aims to reply within 20 working days. It provides that complaints will only undergo an initial assessment during this timeframe and complex complaints may require further assessment and/or additional information before being progressed, and that the complainant will be advised of this. It provides that if the email is in relation to an existing case, the DPC will be in contact with the complainant at its earliest opportunity.

Section 8 of the Charter is entitled 'Quality Customer Service'. It states that the DPC welcomes customer help in providing the best service possible by making any comments, suggestions or complaints about the service received, or the way in which it is delivered. It states that if a customer wishes to make a complaint, it should be made in the first instance to the supervisor at the point of service. It states that if the issue remains unresolved or the customer feels the service received did not meet the standards outlined in this customer service charter, they can appeal by lodging a formal complaint with the DPC's customer service complaints unit. It states that the role of customer service complaints does not impact on the outcome of cases, but it is to formally review the complaint against the commitments specified under the charter. It contains no details of time commitments in relation to its consideration of such customer service complaints

Analysis

It appears to me that there may be some disagreement between the applicant and the DPC as to the precise nature of the records sought in this case. On this point, it is relevant to note that under section 12(1)(b) of the Act, a request for access to records must contain sufficient particulars in relation to the information concerned to enable the record to be identified by the taking of reasonable steps.

In her application to the DPC for an internal review of its original decision, the applicant argued that her request for records of complaints about the DPC's customer service taking longer than the times outlined in its customer service charter to respond to customer service complaints does not concern the core business of DPC and rather is an FOI request about general administration. Moreover, in her correspondence with this Office, the applicant has sought to distinguish between a customer service complaint, which she described as including a data protection complaint, and a complaint about customer service, which she described as concerning the management of the Office. In essence, it seems to me that her argument is that she was simply seeking access to copies of any complaints made that the DPC failed to respond to complaints about customer service within the time commitments set out in section 3 of the DPC's Customer Charter 2024 -� 2026. It appears she may consider those commitments to apply not only to the DPC's handling of complaints made under data protection legislation, but also to complaints made about the quality of customer service received, as described in section 8 of the charter.

On the other hand, the DPC clearly interpreted the request as being a request for records of complaints made relating to the time taken to respond to complaints made under data protection legislation. It did not interpret the request as a request for records of complaints made about the time taken to deal with complaints made about the quality of customer service received.

As I have outlined above, the customer service complaint the applicant made to the DPC on 23 October 2023 concerned the manner in which the DPC had handled complaints she had made under data protection legislation. In other words, she made a complaint that concerned the core business of the DPC, namely how it handled her data protection concerns. Her subsequent exchanges of correspondence with the DPC concerned her view that the DPC should have responded to that complaint in accordance with the commitments set out in the DPC's customer service charter.

It is apparent from the DPC's customer charter that the time commitments set out therein concern its handling of 'queries, concerns and complaints [made] under the Data Protection Legislation' (my emphasis). However, the charter does not expressly commit the DPC to meeting those same time commitments when handling customer service complaints made in accordance with section 8 of the charter.

Accordingly, having regard to:

-� the substance and nature of the complaint the applicant made on 23 October 2023 and the following exchanges between the parties,

-� the express wording of the DPC's customer service charter, and

-� the wording of the applicant's FOI request,

I am satisfied that the DPC reasonably interpreted the request as a request for records of complaints made concerning the length of time taken to respond to complaints made under data protection legislation. Accordingly, the question I must consider is whether such records concern the general administration of the DPC.

On this point, while the Act is silent on the meaning of 'general administration', this Office considers that it clearly refers to records which have to do with the management of the Office of the DPC such as records relating to personnel, pay matters, recruitment, accounts, information technology, accommodation, and the like. This list is non-exhaustive.

The essence of the DPC's argument is that records of complaints made concerning the length of time taken to respond to complaints made under the data protection legislation are concerned with its core investigative role. It says such correspondence is held within the context of the relationship established between the parties by dint of their lodging a complaint pursuant to Part 6 of the Data Protection Act, and thus is a core statutory function. In my view, while records of complaints made concerning the length of time taken to respond to complaints made under data protection legislation may not be directly concerned with the core issues under investigation, they are nevertheless concerned with the manner in which the investigative process has been conducted in those cases. Such matters extend beyond this Office's understanding of the types of matters captured by the term general administration as described above.

In conclusion, therefore, I find that the DPC was justified in its decision to refuse the applicant's request for a copy of emails/communications sent to its customer service department about full or interim replies to complaints taking longer than 20 working days on the ground that the FOI Act does not apply to the records sought, pursuant to Schedule 1, Part(1)(f) of the Act.

Decision

Having carried out a review under section 22(2) of the FOI Act, I hereby affirm the DPC's refusal of the applicant's request, pursuant to Schedule 1, Part 1(f) of the FOI Act, for access to a copy of any emails/communications sent to its customer service department about full or interim replies to complaints taking longer than 20 working days.

Right of Appeal

Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.

Stephen Rafferty

Senior Investigator