Appeal number: EA/2019/ 0149/GDPR
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
INFORMATION RIGHTS
ROBERT FINCH Applicant
- and -
THE INFORMATION COMMISSIONER Respondent
TRIBUNAL: JUDGE MOIRA MACMILLAN
SUZANNE COSGRAVE
Dr HENRY FITZHUGH
Determined on the papers, the Tribunal sitting in Chambers on 25 July 2019
© CROWN COPYRIGHT 2019
DECISION
1. The application is refused.
5 REASONS
2. The Applicant applied to the Tribunal for an Order to Progress his Complaint
under s. 166 of the Data Protection Act 2018 (“DPA 2018”).
3. In his Notice of Appeal form dated 23 April 2019, the Applicant relies on
grounds that the Commissioner had not replied to a complaint he made on 17 October
10 2018.
4. The Information Commissioner’s Response dated 23 May 2019 accepts that she
failed to provide information about the progress of the Applicant’s complaint within 3
months of having received it. The Commissioner has since responded to the
Applicant’s complaint and relies on grounds of opposition that there is no basis for
15 making the Order sought.
5. The parties and the Tribunal agreed that this matter was suitable for
determination on the papers in accordance with rule 32 of The Tribunal Procedure
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009, as amended. The
Tribunal considered an agreed open bundle of evidence comprising 47 pages,
20 including submissions made by both parties.
The Law
6. Section 166 of the DPA 2018 creates a new right of application to the Tribunal
as follows:
Orders to progress complaints
25 (1) This section applies where, after a data subject makes a complaint under
section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on the
complaint, or of the outcome of the complaint, before the end of the period of 3
30 months beginning when the Commissioner received the complaint, or
(c) if the Commissioner's consideration of the complaint is not concluded during
that period, fails to provide the complainant with such information during a
subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order
35 requiring the Commissioner—
2
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the outcome of
the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
5 (a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a period
specified in the order.
(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it
applies for the purposes of section 165(4)(a).
10 7. The “appropriate steps” which must be taken by the Information
Commissioner is further defined by s. 165 (5) DPA 2018 as investigating the subject
matter of the complaint “to the extent appropriate” and keeping the complainant
updated as to the progress of inquiries.
8. The powers of the Tribunal in determining a s. 166 application are limited to
15 those set out in s. 166 (2). In Order to exercise them, the Tribunal must be satisfied
that the Commissioner has failed to progress a complaint made to her under s. 165
DPA 2018. The jurisdiction to make an Order is limited to circumstances in which
there has been a failure of the type set out in s. 166 (1) (a), (b) and (c).
The Evidence
20 9. We have considered carefully the agreed bundle of evidence. This shows that
the Applicant made a complaint to the Commissioner on 17 October 2018 about
Erudio Student Loans Company (’Erudio’). The Applicant contacted the
Commissioner a number of times thereafter to request an update on the progress of his
complaint. The Commissioner wrote to the Applicant on 7 November and 27
25 November 2018 to advise him that her substantive response would be delayed because
she was dealing with a high volume of cases. On 30 January 2019 the Commissioner
wrote to the Applicant requesting further information about his complaint. Having
received this information, on 26 March 2019 the Commissioner wrote to the
Applicant to inform him that in her view the actions of Erudio were permitted in
30 accordance with GDPR.
Submissions
10. The Applicant clearly disagrees with the Commissioner’ conclusion. He submits
that she has failed to engage with the substance of his complaint and should have
made further inquiries of Erudio. The Applicant submits he should be compensated by
35 the Commissioner due to the time it has taken to deal properly with his complaint.
11. The Commissioner accepts that her substantive response to the Applicant’s
complaint fell outside the 3-month timeframe stipulated by s. 166 DPA 2018.
3
However, she submits that she has since taken appropriate steps to respond to the
Applicant’s complaint and that, while he disagrees with the outcome, this is not a
proper basis for the Tribunal to make an Order under s. 166 DPA 2018 because the
Tribunal’s jurisdiction is limited to procedural failings. The Commissioner further
5 submits that compensation is not an outcome that can be granted by the Tribunal in
this Application.
Conclusion
12. We conclude that the Information Commissioner took appropriate steps to
respond to the Applicant’s complaint on 30 January and 26 March 2019. Although her
10 first substantive response was outside the 3-month statutory timeframe, we are not
persuaded that there has been a failure on the Commissioner’s part to address the
matters in s. 166 (1) (a) and (c). We agree with the Commissioner that s. 166 DPA
2018 does not provide the Tribunal with the power to award compensation.
13. We conclude that there is no basis for making an Order under s. 166 (2) DPA
15 2018 on the facts of this case.
14. For these reasons, the application is refused.
(Signed)
MOIRA MACMILLAN DATE: 21 August 2019
20
Promulgation date 22nd August 2019
4