Information Commissioner's Office

3. Mr T complains the ICO applied the wrong burden of proof when considering his complaint between September and November 2021.He thinks the ICO applied the ‘beyond reasonable doubt’ test which is a stricter test.

4. He says because of this the ICO did not consider his concerns properly or fairly and the decision is therefore flawed.

5. He would like the ICO to review the case again and apply the right burden of proof.

6. In September 2021 Mr T complained to the ICO about how a university (the University) handled his subject access request (SAR).

7. In the same month the ICO concluded there were errors in the University’s handling of the SAR because it failed to provide a document Mr T was entitled to. However, its view was this omission amounted to human error and not a fault, meaning it made no recommendations.

8. Mr T asked the ICO to review its decision and in November it did this and upheld the original decision.

9. In December Mr T contacted his MP to refer his complaint to us.

10. We closed this complaint in March 2022 as we found no signs of any failings in how the ICO had handled his case. Mr T responded to say he was disappointed with the decision but understood why we had reached that view.

11. On 13 May 2022, Mr T received the outcome to his service complaint with the ICO. In this letter, the ICO advised the investigator had made an error during a phone call with Mr T and said the ICO had used ‘beyond reasonable doubt’ as its burden of proof. The letter apologised as this was wrong. The ICO had in fact used ‘on the balance of probabilities’ – a less stringent burden of proof.

12. Mr T asked us to reconsider his complaint in light of this new information.

15. Our Principles say organisations should be open and honest when accounting for their decisions and actions and give clear, evidence-based explanations and reasons for their decisions. When things have gone wrong, public bodies should explain fully and say what they will do to put matters right as quickly as possible.

16. Mr T accepted and understood our decision on his previous case that the ICO had carried out its investigation appropriately and in line with the responsibilities set out in section 165(4) of the Data Protection Act 2018. We have opened this case specifically to consider whether the ICO applied the wrong burden of proof to his case and whether this had a significant impact on the outcome.

17. We asked the ICO to clarify this. The ICO explained while the lead case investigator did give Mr T incorrect advice, it found no evidence this had resulted in reaching the wrong outcome on his case.

18. The lead case officer who had reviewed the ICO’s original decision gave the incorrect advice. During Mr T’s service complaint to the ICO, the ICO has confirmed the manager reviewed the initial decision again to make sure the outcome was accurate and the investigator’s review was fair, reasonable and in line with the ICO’s casework processes.

19. The question that remains is whether the ICO applied the wrong burden of proof and, if it did, whether this had an impact on its decision. The first thing to mention is the ICO uses the civil burden of proof (looking at whether it is more likely than not that something happened) in its casework. So this lends weight to its claim that this is indeed what it applied. Other than what the lead case officer said over the phone – which the ICO identified and raised with Mr T unprompted – there is no evidence to suggest it applied the wrong burden of proof.

20. On balance, it seems the lead case officer likely misspoke during the phone call and what they said did not truly reflect how the ICO had handled the case. However, even if what they said was accurate, it is likely this would not have made any difference to the outcome. The ICO’s decision was the University failed to send a document to Mr T through human error rather than deliberately. This means even if it reached this decision beyond reasonable doubt the outcome would have been the same.

21. We think the ICO has proactively accepted and apologised for its mistake. It has since explained the error and confirmed this has not affected Mr T’s case. We have seen no reason to doubt what the ICO has said or seen anything that means the whole case should be reviewed a second time. We have already concluded the ICO acted appropriately and have taken this complaint only to consider the burden of proof aspect. We are satisfied with the explanation offered and believe the ICO has acted in line with its own responsibilities and our Principles. We are sorry for the concern this has caused and understand why Mr T wanted this to be double-checked. We hope this decision provides him with the assurance needed to bring closure to this matter.

1. The Parliamentary and Health Service Ombudsman has carefully considered Mr T’s complaint about the Information Commissioner’s Office (ICO). Based on what we have seen, we do not think the ICO applied the wrong burden of proof (standard or test used to consider whether it is likely that something happened) when considering his case. We believe it is more likely the lead case investigator misspoke during their conversation.

2. We understand this has been a frustrating experience for Mr T and he believes the ICO has mishandled his case. We appreciate the error made during the call was frustrating but, based on the evidence available and for the reasons we set out below, we do not believe this had any impact on Mr T’s case or the ICO’s decision.