Decision
Mr. K & The Data Protection Commissioner (the DPC/ the Commission)
From Office of the Information Commissioner (OIC)
Case number: OIC-160764-K7G0H9
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-160764-K7G0H9
Published on
Whether the DPC was justified in refusing access to aggregated data regarding decisions made by the Data Protection Commission pursuant to Schedule 1, Part 1(f) of the FOI Act on the basis that, for the purposes of the FOI Act, the DPC is not a public body with respect to the records requested
10 November 2025
In a request dated 5 May 2025, the applicant sought access to:
• The number of decisions made under the one-stop-shop (Article 60) mechanism where the DPC is the Lead Supervisory Authority
• The number of these decisions which report “amicable settlements”
• The number of these decision which have been referred to the Article 65 consistency mechanism
For each year, or part thereof, for the period May 2018 to May 2025.
On 22 May 2025, the DPC refused the applicant’s request pursuant to Schedule 1, Part 1(f) of the FOI Act, on the basis that the DPC is not a public body for the purposes of the FOI Act save for records concerning the general administration of the DPC. It said the records sought do not relate to the general administration of the DPC and are not releasable under FOI. On 27 May 2025, the applicant requested an internal review of the DPC’s decision. The applicant said that his request does not concern information on a specific complaint, but statistical data in relation to the DPC’s overall output, which he contends relates to the general administration of the office. On 13 June 2025, the DPC affirmed its original decision. On 21 July 2025, the applicant applied to this Office for a review of the DPC’s decision.
In his application to this Office the applicant argued that his request was for aggregated data, similar in kind to records he said the DPC released to a separate requester in 2024, and questioned the veracity of the DPC’s assessment that the requested records did not form part of the general administration of the DPC. He said he is not seeking records relating to any individual investigation and noted that the DPC publishes the information requested, at least in part, in its Annual Report.
The Investigating Officer invited the DPC to make focused submissions justifying its decision and provided the applicant an opportunity to make further submissions of his own, which they both duly did.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the correspondence outlined above and to the submissions from both parties. I have decided to conclude this review by way of a formal, binding decision.
This review is concerned solely with whether the DPC was justified in refusing the applicant’s request on the basis that the FOI Act does not apply to the records sought pursuant to Schedule 1, Part 1(f) of the Act.
Section 6 of the FOI Act defines those entities that are public bodies for the purposes of the FOI Act. Section 6(2)(a) provides that an entity specified in Part 1 of Schedule 1 of the Act shall, subject to the provisions of that Part, be a public body for the purposes of the Act. Schedule 1, Part 1 contains details of bodies that are partially included for the purposes of the Act and details of certain specified records that are included or excluded. If the records sought do not come within the description of the records that are included, or if they come within the description of the records that are excluded, then the Act does not apply and no right of access exists.
Part 1(f) of Schedule 1 provides that section 6 does not include a reference to the Data Protection Commissioner, or an officer of the Commissioner, in relation to a record, save as regards a record concerning the general administration of the Office of the Commissioner. In other words, the only records held by the DPC that are subject to the FOI Act are those that concern the general administration of that Office. In accordance with Part 1(f), all other records held by the DPC are excluded.
DPC’s submissions
In its submissions, the DPC said the applicant in this case sought access to statistical records regarding cross-border complaints handled by the DPC pursuant to the Data Protection Act 2018 and Articles 60 and 65 of the General Data Protection Regulation (GDPR).
It said that, for cross-border inquiries, the DPC acts as the Lead Supervisory Authority (LSA) under the GDPR and works with its peer EU/ EEA Supervisory Authorities to conclude inquiry decisions in accordance with the cooperation mechanism set out in Articles 60 to 65 of the GDPR and is a core, statutory function of the DPC. It said it is of the view that records concerning the DPC’s investigation of complaints do not fall within the categories of records identified as “general administration”. The DPC said it considers records held by it in relation to the investigation of cross-border complaints to relate to its core investigative role and fall outside the remit of the FOI Act.
The Applicant’s submissions
In his submissions to this Office, the applicant reiterated his belief that the records requested relate to the general administration of the DPC. He said the DPC’s understanding of what constitutes general administration is unclear. He cited previous releases under the FOI Act where requests that he believes to be similar in kind to his own were granted by the DPC. Specifically, he said requests for the numbers and types of data breaches and the amounts levied and collected in fines for certain years were granted in 2020 and 2024, respectively. He argued that this was inconsistent with its position on his own request and asked that this Office overturn the DPC’s decision on his request. He said no information was sought in relation to any individual complaint, but solely the DPC’s overall output and there was no request for ‘correspondence’ of any type, nor for information connected to any DPC investigation.
I have noted the applicant comments about what he views to be similar types of information that was released previously by the DPC under FOI. However, the question before me is whether the information sought in this case is a record of general administration. I am satisfied from the submissions in this case that it is not.
While the Act is silent on the meaning of 'general administration', this Office considers that it clearly refers to records which have to do with the management of the Office of the DPC such as records relating to personnel, pay matters, recruitment, accounts, information technology, accommodation, and the like. This list is non-exhaustive.
The essence of the DPC's argument is that records concerning the investigation of cross-border complaints to relate to its core investigative role. It says such records are related to its role as the Lead Supervisory Authority (LSA) in cooperation with other EU and EEA bodies under the auspices of the Data Protection Act, and thus is a core statutory function. In my view, while records of aggregated data concerning the number of and decisions on investigations of complaints made under data protection legislation may not be directly concerned with the core issues under investigation, they are nevertheless concerned with the outcomes of the investigative process that has been conducted in those cases. Such matters extend beyond this Office's understanding of the types of matters captured by the term general administration as described above.
In conclusion, therefore, I find that the DPC was justified in its decision to refuse the information sought by the applicant relating to aggregated data on the outcomes of cross-border complaints in which the DPC acted as the LSA on the ground that the FOI Act does not apply to the records sought, pursuant to Schedule 1, Part(1)(f) of the Act.
Having carried out a review under section 22(2) of the FOI Act, I hereby affirm the DPC’s decision. I find that the DPC was justified in refusing access to the records sought pursuant to Schedule 1, Part 1(f) of the FOI Act on the basis that, for the purposes of the FOI Act, the DPC is not a public body with respect to the records requested.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
____________________
Richard Crowley
Investigator