Appeal number: EA/2018/ 0258/GDPR
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
INFORMATION RIGHTS
SUU NGUYEN Applicant
- and -
THE INFORMATION COMMISSIONER Respondent
TRIBUNAL: JUDGE ALISON MCKENNA
Mr DAVE SIVERS
Mr NIGEL WATSON
Determined on the papers, the Tribunal sitting in Chambers on 25 March 2019
© CROWN COPYRIGHT 2019
DECISION
1. The application is refused.
5 REASONS
2. The Applicant applied to the Tribunal on 16 November 2018. It was assumed
that his application was for an Order to Progress his Complaint under s. 166 of the
Data Protection Act 2018 (“DPA 2018”).
3. In his Notice of Appeal, the Applicant relies on grounds that his rights under the
10 Data Protection Act 2018 have been infringed by a housing association. He complains
that the Information Commissioner has “ignored” his evidence of infringement.
4. The Information Commissioner’s Response dated 19 December 2018 resists the
Applicant’s application on the basis that the Commissioner has responded
appropriately to the Applicant’s complaint so that there is no basis for making the
15 Order sought. It is submitted that s. 166 DPA 2018 does not provide a right of
challenge to the substantive determination of a complaint by the Commissioner, but
only a procedural remedy.
5. The Applicant’s Reply dated 5 January 2019 states that he regards himself as
having a right of appeal to the Tribunal but it is a matter for the Tribunal to decide.
20 6. The parties and the Tribunal agreed that this matter was suitable for
determination on the papers in accordance with rule 32 of The Tribunal Procedure
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009, as amended. The
Tribunal considered an agreed open bundle of evidence comprising 90 pages,
including submissions made by both parties, for which we were grateful.
25 The Law
7. Section 166 of the DPA 2018 creates a right of application to the Tribunal as
follows:
Orders to progress complaints
(1) This section applies where, after a data subject makes a complaint under
30 section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on the
complaint, or of the outcome of the complaint, before the end of the period of 3
months beginning when the Commissioner received the complaint, or
2
(c) if the Commissioner's consideration of the complaint is not concluded during
that period, fails to provide the complainant with such information during a
subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order
5 requiring the Commissioner—
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the outcome of
the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
10 (a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a period
specified in the order.
(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it
applies for the purposes of section 165(4)(a).
15 8. The powers of the Tribunal in determining a s. 166 application are limited to
those set out in s. 166 (2). In order to exercise them, the Tribunal must be satisfied
that the Commissioner has failed to progress a complaint made to her under s. 165
DPA 2018. The jurisdiction to make an Order is limited to circumstances in which
there has been a failure of the type set out in s. 166 (1) (a), (b) and (c).
20 The Evidence
9. We have considered carefully the agreed bundle of evidence. This shows that
the Applicant made a complaint to the Commissioner on 4 July 2018. The
Commissioner wrote to the Applicant on 5 July, 18 September and 18 October 2018.
She made inquiries of the data controller before informing the Appellant on 18
25 October 2018 that the matters falling within the ICO’s remit had been addressed and
that his remaining concerns were not within the ICO’s jurisdiction, so no further
action would be taken.
Submissions
10. The Applicant clearly disagrees with the Commissioner’s conclusion. He
30 appears to consider that her inquiries should have covered additional issues which he
had raised in correspondence.
11. The Commissioner submits that she took appropriate steps to respond to the
Applicant’s complaint and that, whilst he disagrees with the outcome, this is not a
proper basis for the Tribunal to make an Order under s. 166 DPA 2018 because the
3
Tribunal’s jurisdiction is limited to procedural failings and is not intended to serve as
an appeal against outcome.
Conclusion
12. We conclude that the Information Commissioner took appropriate steps to
5 respond to the Applicant’s complaint in a timely manner. We are not persuaded that
she failed to address the matters in s. 166 (1) (a) (b) and (c).
13. We understand that the Applicant is not satisfied with the Commissioner’s
conclusions, but we agree with the Commissioner that s. 166 DPA 2018 does not
provide a right of appeal against the substantive outcome of an investigation into a
10 complaint under s. 165 DPA 2018.
14. We conclude that there is no basis for making an Order under s. 166 (2) DPA
2018 on the facts of this case.
15. For these reasons, the application is refused.
(Signed)
15
ALISON MCKENNA DATE: 17 April 2019
CHAMBER PRESIDENT
20
4