Decision
Mr Z & Data Protection Commission
From Office of the Information Commissioner (OIC)
Case number: OIC-200132-A0A0J8
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-200132-A0A0J8
Published on
Whether the DPC has complied with the requirements of section 10 of the FOI Act in response to an application for a statement of reasons concerning its delay in making a decision on the applicant’s data protection/GDPR appeal
28 May 2026
On 13 December 2025, the applicant asked the DPC to provide him with a statement of reasons, under the FOI Act, for its delay in making a decision on a Data Protection/GDPR appeal he had submitted in June 2020.
On 9 January 2026, the DPC issued its original decision in which it refused to provide the applicant with the requested statement of reasons. In its decision, the DPC said that it is not a “public body” for the purposes of the FOI Act save in one limited respect, namely, as regards records concerning the general administration of the DPC.
On the same day, the applicant made a request for an internal review of the DPC’s original decision. The applicant said that he considered that he had a right under the FOI Act to reasons regarding the considerable prejudicial delay in processing his appeal. He said that in general administrative terms, there is a world of a difference between being timely and being tardy. He urged the DPC to deal with the merits of his request rather than focusing on excuses not to.
On 26 January, the DPC affirmed its original decision. The DPC said that it is listed as a partially included agency under Schedule 1, Part 1(f) of the FOI Act, and as such is excluded from the scope of section 6 of that Act in relation to a record, except as regards a record concerning its general administration. The DPC said that a request for a statement of reasons for an act of the DPC pertaining to its core, statutory functions is not within the scope of section 10 of the Act.
On 3 February, the applicant applied to this Office for a review of the DPC’s internal review decision. In his application, the applicant noted that the DPC, in support of its decision, had referred to a prior decision of this Office. The applicant stated that the decision referred to by the DPC did not concern a request for a statement of reasons under section 10 but a request for access to records.
I have now completed my review in accordance with section 22(2) of the FOI Act. Following his application to this Office, the applicant made further submissions. The Investigating Officer asked the DPC if it wished to make submissions, but the DPC said it had nothing to add to what it had already stated in its decisions on the applicant’s request. In carrying out my review, I have had regard to the submissions made by the applicant and to the arguments made by the DPC in its decisions on the applicant’s request, although I do not propose to provide full details of them in this decision. I have decided to conclude this review by way of a formal, binding decision.
This review is concerned solely with whether the DPC was justified in refusing the applicant’s application, under section 10 of the FOI Act, for a statement of reasons.
I would like to address a preliminary matter before proceeding to the substantive issues of this review.
In submissions to this Office, the applicant said that the DPC’s delay in finalising his GDPR appeal is unreasonable and affects him as a citizen. He referred to an attached “Your Europe - Advice” complaint form, which, he said, supports this position and speaks for itself. I would like to remind the applicant that this Office has no role in adjudicating on how FOI bodies perform their functions generally, nor to act as an alternative dispute resolution mechanism with respect to actions taken by FOI bodies. Our role in this case is confined to reviewing the DPC’s decision on the applicant’s request for a statement of reasons under section 10 of the FOI Act.
Section 10 of the FOI Act provides that a person is entitled to a statement of reasons for an act of an FOI body where that person is affected by the act and has a material interest in a matter affected by the act or to which it relates. The statement of reasons must give the reasons for the act and any findings on any material issues of fact made for the purposes of the act.
It is important to state at the outset that the DPC is a partially included body for FOI purposes.
Section 6(2) of the FOI Act provides that an entity specified in Schedule 1, Part 1 of the Act shall, subject to the provisions of that Part, be a public body for the purposes of the Act. Schedule 1, Part 1 contains details of bodies that are partially included for the purposes of the Act. If a request relates to anything not included in Part 1, then the Act does not apply, and no right exists for the request to be granted by the body.
Schedule 1, Part 1(f) provides that the DPC is not a public body for the purposes of the FOI Act save as regards a record concerning the general administration of the Office of the Data Protection Commissioner. In other words, the DPC is only subject to the Act insofar as it holds records that relate to its general administration. In accordance with Part 1(f), with the exception of these records, the DPC is not subject to the Act.
The FOI Act does not define the term “general administration” as provided for in Part 1(f). This Office considers the term to cover records relating to the administration of the body, as opposed to say, records relating to its operational matters or core functions. In the case of a number of specified public bodies, the right of access afforded by the FOI Act is restricted to records relating to their general administration. We consider the term “general administration” to refer to records which have to do with the management of a public body such as records relating to personnel, pay matters, recruitment, accounts, information technology, accommodation, internal organisation, office procedures, etc.
The applicant’s submissions
In submissions to this Office, the applicant said that the DPC has not addressed the issue of the delay in finalising his GDPR appeal but rather claims that it is under no obligation to provide a statement of reasons as it is only partially included under the FOI Act. The applicant said that he was challenging the DPC’s assertion on two grounds. The first of these, he said, is that the limitation in Schedule 1, Part 1(f) only curtails access to records provided by section 11. The applicant said that the right to a statement of reasons is a standalone right governed by section 10 and that this limitation does not apply to such requests. The second ground of his challenge, the applicant continued in his submissions, is that the delay in processing his GDPR appeal relates to the general administration of the DPC. He said that proper case management of appeals is the bread and butter of such a body and falls within the scope of general administration.
As noted above, the DPC declined to add anything to what it had already laid out in its decisions, the substance of which is outlined in the “Background” section of this decision.
My analysis
Section 10 of the FOI Act outlines rights of persons to information regarding acts of FOI bodies affecting them. The DPC is only a partially included agency for FOI purposes and is only subject to the FOI Act insofar as it relates to general administrative records. In accordance with Schedule 1, Part 1(f), the DPC is not subject to the Act, other than in relation to records concerning general administration.
Given the very limited application of the FOI Act to the DPC, the question I must consider is whether the act of delaying a decision further to a data protection/GDPR appeal is an act within the meaning of section 10 of the FOI Act in so far as the Act applies to the DPC. While the applicant has argued that the act of delaying to issue such a decision falls within the scope of general administration, I am satisfied that the act in question does not relate to the general administration of the DPC (as understood by this Office and explained above), but to the administration of one of the DPC’s core functions, i.e. examining data protection/GDPR appeals.
Having considered the matter carefully, I am satisfied that the DPC was justified in refusing the applicant’s request for a statement of reasons in this case, and I find accordingly.
Having carried out a review under section 22(2) of the FOI Act, I hereby affirm the decision of the DPC to refuse the applicant’s application, under section 10 of FOI Act, for a statement of reasons.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Mary Connery
Investigator