Appeal number: EA/2019/0029GDPR
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
INFORMATION RIGHTS
ANDREW QUIGLEY Applicant
- and -
THE INFORMATION COMMISSIONER Respondent
TRIBUNAL: JUDGE ALISON MCKENNA
Dr HENRY FITZHUGH
Mr ANDREW WHETNALL
Determined on the papers, the Tribunal sitting in Chambers on 16 May 2019
© CROWN COPYRIGHT 2019
DECISION
1. The application is refused.
5 REASONS
2. The Applicant applied to the Tribunal for an Order to Progress his Complaint
under s. 166 of the Data Protection Act 2018 (“DPA 2018”).
3. In his Notice of Appeal form dated 5 February 2019, the Applicant relies on
grounds that the Commissioner had not fully completed her assessment of his
10 complaint against a data controller and that she is in breach of her statutory duties.
4. The Information Commissioner’s Response dated 5 March 2019 relies on
grounds of opposition that the Commissioner has responded appropriately to the
Applicant’s complaint and in a timely fashion so there is no basis for making the
Order sought.
15 5. The parties and the Tribunal agreed that this matter was suitable for
determination on the papers in accordance with rule 32 of The Tribunal Procedure
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009, as amended. The
Tribunal considered an agreed open bundle of evidence comprising 176 pages,
including the submissions made by both parties. We are grateful to both parties for
20 their helpful written submissions.
The Law
6. Section 166 of the DPA 2018 creates a new right of application to the Tribunal
as follows:
Orders to progress complaints
25 (1) This section applies where, after a data subject makes a complaint under
section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on the
complaint, or of the outcome of the complaint, before the end of the period of 3
30 months beginning when the Commissioner received the complaint, or
(c) if the Commissioner's consideration of the complaint is not concluded during
that period, fails to provide the complainant with such information during a
subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order
35 requiring the Commissioner—
2
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the outcome of
the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
5 (a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a period
specified in the order.
(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it
applies for the purposes of section 165(4)(a).
10 7. The “appropriate steps” which must be taken by the Information Commissioner
is further defined by s. 165(5) DPA 2018 as investigating the subject matter of the
complaint “to the extent appropriate” and keeping the complainant updated as to the
progress of inquiries.
8. The powers of the Tribunal in determining a s. 166 application are limited to
15 those set out in s. 166 (2). In Order to exercise them, the Tribunal must be satisfied
that the Commissioner has failed to take appropriate steps to respond to or progress a
complaint made to her under s. 165 DPA 2018. The jurisdiction to make an Order is
limited to circumstances in which there has been a failure of the type set out in s. 166
(1) (a), (b) and (c).
20 The Evidence
9. We have considered carefully the agreed bundle of evidence. This shows that
the Applicant made a complaint to the Commissioner on 13 August 2018. The
Commissioner wrote to the Applicant on 7 November 2018 to clarify the terms of his
complaint. She then made various inquiries of the data controller and wrote to the
25 Applicant on 9 January 2019 to inform him of her conclusions.
Submissions
10. The Applicant clearly disagrees with the Commissioner’s conclusion. He
submits that her inquiries should have considered additional issues which he raised in
correspondence with her office.
30 11. The Commissioner submits that she took appropriate steps to respond to the
Applicant’s complaint and that, whilst he disagrees with the outcome, this is not a
proper basis for the Tribunal to make an Order under s. 166 DPA 2018 because the
Tribunal’s jurisdiction is limited to procedural failings and is not intended to serve as
an appeal against outcome. She has advised him that he may seek a remedy against
35 the data controller in the County Court.
3
Conclusion
12. We conclude that the Information Commissioner took appropriate steps to
respond to the Applicant’s complaint and in a timely manner. We are not persuaded
that she failed to address the matters in s. 166 (1) (a) (b) and (c).
5 13. We understand that the Applicant is not satisfied with the Commissioner’s
conclusions, but we agree with the Commissioner that s. 166 DPA 2018 does not
provide a right of appeal against the substantive outcome of an investigation into a
complaint under s. 165 DPA 2018. We endorse her advice that the County Court
would be the correct forum for seeking a substantive remedy.
10 14. We conclude that there is no basis for making an Order under s. 166 (2) DPA
2018 on the facts of this case.
15. For these reasons, the application is refused.
(Signed)
15 ALISON MCKENNA DATE: 5 June 2019
CHAMBER PRESIDENT PROMULGATED DATE: 7 June 2019
4