Appeal number: EA/2020/0044/GDPR/P
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
INFORMATION RIGHTS
EDYTA SOLODUCHA Applicant
- and -
THE INFORMATION COMMISSIONER Respondent
TRIBUNAL: JUDGE MOIRA MACMILLAN
Determined on the papers
The Tribunal sitting in Chambers on 12 August 2020
© CROWN COPYRIGHT 2020
DECISION
1. The application is refused.
REASONS
2. The Applicant applied to the Tribunal for an Order to Progress her Complaint
under s. 166 of the Data Protection Act 2018 (“DPA 2018”).
3. In her Notice of Appeal dated 28 January 2020, the Applicant relies on grounds
that the Commissioner has not responded to her complaint against Park Medical
Practice and is therefore in breach of her statutory duties.
4. The Commissioner’s Response dated 12 February 2020 relies on grounds of
opposition that the Commissioner has since responded appropriately to the Applicant’s
complaint, so there no basis for making the Order sought.
5. The parties and the Tribunal agreed that this matter was suitable for determination
on the papers in accordance with rule 32 of The Tribunal Procedure (First-tier Tribunal)
(General Regulatory Chamber) Rules 2009, as amended. The Tribunal considered an
agreed open bundle of evidence comprising 85 pages.
The Law
6. Section 166 of the DPA 2018 creates a right of application to the Tribunal as
follows:
Orders to progress complaints
(1) This section applies where, after a data subject makes a complaint under
section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on
the complaint, or of the outcome of the complaint, before the end of the
period of 3 months beginning when the Commissioner received the
complaint, or
(c) if the Commissioner's consideration of the complaint is not concluded
during that period, fails to provide the complainant with such information
during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order
requiring the Commissioner—
2
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the outcome of
the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a period
specified in the order.
(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it
applies for the purposes of section 165(4)(a).
7. The “appropriate steps” which must be taken by the Information Commissioner
is further defined by s. 165 (5) DPA 2018 as investigating the subject matter of the
complaint “to the extent appropriate” and keeping the complainant updated as to the
progress of inquiries.
8. The powers of the Tribunal in determining a s. 166 application are limited to those
set out in s. 166 (2). In Order to exercise them, the Tribunal must be satisfied that the
Commissioner has failed to progress a complaint made to her under s. 165 DPA 2018.
The jurisdiction to make an Order is limited to circumstances in which there has been
a failure of the type set out in s. 166 (1) (a), (b) and (c).
The Evidence
9. I have considered carefully the agreed bundle of evidence. This shows that the
Applicant made a complaint to the Commissioner on 15 September 2019 about Park
Medical Practice’s handling of her medical records and personal data.
10. The Commissioner responded on 15 October 2019 and advised the Applicant to
pursue the matter further with the data controller at the Practice. The Applicant
responded the following day with more information, but unfortunately the
Commissioner missed this response and took no further action.
11. The Commissioner became aware that she had failed to respond to the Applicant’s
16 October correspondence when she was made aware of this Application. She has
since written to the Applicant, most recently on 6 March 2020, requesting her consent
to disclose information to Park Medical Practice and further information she requires
in order to investigate the complaint.
12. To date, the Applicant has declined to provide the Commissioner with consent or
with any further information as she wished to await the outcome of this Application.
13. The Applicant’s position is that the Commissioner has failed to comply with her
statutory obligations because she has failed to respond to her complaint within the
3
required 3-month period. She suggests various courses of further action against the
Commissioner.
14. The Commissioner accepts that her substantive response to the Applicant’s
complaint fell outside the 3-month timeframe stipulated by s. 166 DPA 2018. However,
she submits that she has since taken appropriate steps to respond to the Applicant’s
complaint and that there is no longer an Order for the Tribunal to make under s. 166
DPA 2018.
Conclusion
15. Although the Commissioner failed to respond to the Applicant’s further
information, sent by email on 16 October 2020, she has since remedied this oversight.
The Commissioner has told that Applicant that she will consider her complaint further
and is waiting for the Applicant’s response to her 6 March 20202 letter.
16. The Tribunal must consider whether an Order is required at the date of the
Tribunal’s decision. Although there may have been an argument that an Order was
required at the time the Application was lodged with the Tribunal, there is no longer
any such need. This is because the Commissioner will ‘get on with’ investigating the
Applicant’s complaint once the Applicant has responded to her latest correspondence.
17. I find that there is no basis for making an Order under s. 166 (2) DPA 2018 in the
current circumstances. Accordingly, the application is refused.
JUDGE MOIRA MACMILLAN
DATE: 12 August 2020
DATE PROMULGATED: 13 August 2020
4