Ms Anna Morgan:

It is important to distinguish between the complaint handling function that we perform, which relates to the vast majority of issues that come into the office, and the statutory inquiry. In terms of complaint handling, our obligations under the GDPR are to handle a complaint and investigate it to the extent appropriate. In complaint handling we are always focused on vindication of the data subject's rights. It may be that having concluded a complaint handling function and having obtained an outcome for the individual we then go on to consider whether issues that had been raised in the context of that individual complaint are systemic to the data processing operations of a given organisation or pose a particularly high risk to individuals who are also users of services or products of a particular organisation.

There is a decision to be taken by us as to whether it is appropriate, when we are faced with a set of circumstances that might indicate systemic or high-risk issues around processing, to commence a statutory inquiry.

It is in the context of statutory inquiries that we can impose administrative fines as a range of corrective powers and, as I referred to, 49 statutory inquiries have been opened by us. In that context, it is open to us, at the end of a statutory inquiry wherein we have found one or more infringements, to impose a corrective power or another administrative fine.

To contrast that with complaint handling, we can use a different range of methods to close off complaints. We might issue advice to the data controller if we find that a company's systems are not necessarily compliant with the GDPR but the complaint lends itself to amicable resolution or to another of the different types of outcome that are contemplated by section 109, which sets out what steps we can take in handling a complaint.