Appeal number: EA/2019/ 0126/GDPR
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
INFORMATION RIGHTS
CHRISTINE SANDERS Applicant
- and -
THE INFORMATION COMMISSIONER Respondent
TRIBUNAL: JUDGE MOIRA MACMILLAN
SUZANNE COSGRAVE
Dr HENRY FITZHUGH
Determined on the papers, the Tribunal sitting in Chambers on 25 July 2019
© CROWN COPYRIGHT 2019
DECISION
1. The application is refused.
REASONS
2. The Applicant applied to the Tribunal for an Order to Progress her Complaint
under s. 166 of the Data Protection Act 2018 (“DPA 2018”).
3. In her Notice of Appeal form dated 7 April 2019, the Applicant relies on grounds
that the Commissioner had not replied to or provided information about the progress of
a complaint she made on 19 December 2018.
4. The Information Commissioner’s Response dated 9 May 2019 accepts that she
failed to provide information about the progress of the Applicant’s complaint within 3
months of having received it, and apologises for this oversight. The Commissioner has
since responded to the Applicant’s complaint and relies on grounds of opposition that
there is no basis for making the Order sought.
5. The parties and the Tribunal agreed that this matter was suitable for determination
on the papers in accordance with rule 32 of The Tribunal Procedure (First-tier Tribunal)
(General Regulatory Chamber) Rules 2009, as amended. The Tribunal considered an
agreed open bundle of evidence comprising 26 pages, including submissions made by
both parties.
The Law
6. Section 166 of the DPA 2018 creates a new right of application to the Tribunal
as follows:
Orders to progress complaints
(1) This section applies where, after a data subject makes a complaint under
section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on the
complaint, or of the outcome of the complaint, before the end of the period of 3
months beginning when the Commissioner received the complaint, or
(c) if the Commissioner's consideration of the complaint is not concluded during
that period, fails to provide the complainant with such information during a
subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order
requiring the Commissioner—
2
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the outcome of
the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a period
specified in the order.
(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it
applies for the purposes of section 165(4)(a).
7. The “appropriate steps” which must be taken by the Information Commissioner
is further defined by s. 165(5) DPA 2018 as investigating the subject matter of the
complaint “to the extent appropriate” and keeping the complainant updated as to the
progress of inquiries.
8. The powers of the Tribunal in determining a s. 166 application are limited to those
set out in s. 166 (2). In Order to exercise them, the Tribunal must be satisfied that the
Commissioner has failed to progress a complaint made to her under s. 165 DPA 2018.
The jurisdiction to make an Order is limited to circumstances in which there has been
a failure of the type set out in s. 166 (1) (a), (b) and (c).
The Evidence
9. We have considered carefully the agreed bundle of evidence. This shows that the
Applicant made a complaint to the Commissioner about Guy’s and St Thomas’ NHS
Foundation Trust (‘the NHS Trust’) on 19 December 2018. The Applicant contacted
the Commissioner again on 5 April 2019 to request an update on the progress of her
complaint. The application for an Order was made two days later. The Commissioner
wrote to the Applicant on 17 April 2019, enclosing a letter she had sent to the NHS
Trust that day. On 21 May 2019 the Applicant received a hard copy of the information
she had requested from the NHS Trust.
Submissions
10. The Applicant submits that the NHS Trust repeatedly failed to provide her with
the requested information and wishes to know why the Information Commissioner
failed to deal with her complaint.
11. The Commissioner submits that she took appropriate steps to respond to the
Applicant’s complaint on 17 April 2019 and that there is no longer a proper basis for
the Tribunal to make an Order under s. 166 DPA 2018 because the Tribunal’s
jurisdiction is limited to procedural failings.
3
Conclusion
12. We conclude that the Information Commissioner took appropriate steps to
respond to the Applicant’s complaint on 17 April 2019. We are not persuaded that there
has been a failure on the Commissioner’s part to address the matter in s. 166 (1) (a) and
(c) and any failure under s. 166 (1) (b) has been remedied.
13. We conclude that there is no basis for making an Order under s. 166 (2) DPA
2018 on the facts of this case.
14. For these reasons, the application is refused.
(Signed)
MOIRA MACMILLAN DATE: 21 August 2019
Promulgation date 22nd August 2019
4