Appeal number: EA/2020/0167/GDPR/P
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
INFORMATION RIGHTS
PANORMITIS PLEVRAKIS Applicant
- and -
THE INFORMATION COMMISSIONER Respondent
TRIBUNAL: JUDGE MOIRA MACMILLAN
Determined on the papers
The Tribunal sitting in Chambers on 12 January 2021
© CROWN COPYRIGHT 2021
DECISION
1. The application is refused.
REASONS
2. The Applicant applied to the Tribunal for an Order to Progress his complaint
under s. 166 of the Data Protection Act 2018 (“DPA”). Unfortunately, since receiving
the parties’ further submissions in August 2020 this case has been overlooked, a matter
for which I must sincerely apologise.
3. Following a case management hearing on 24 July 2020, the parties and the Tribunal
agreed that this matter was suitable for determination on the papers in accordance with
rule 32 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber)
Rules 2009, as amended. The Tribunal considered an agreed open bundle of evidence
comprising 187 pages.
The Law
4. Section 166 of the DPA 2018 creates a right of application to the Tribunal as
follows:
Orders to progress complaints
(1) This section applies where, after a data subject makes a complaint under
section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on
the complaint, or of the outcome of the complaint, before the end of the
period of 3 months beginning when the Commissioner received the
complaint, or
(c) if the Commissioner's consideration of the complaint is not concluded
during that period, fails to provide the complainant with such information
during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order
requiring the Commissioner—
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the
outcome of the complaint, within a period specified in the order.
2
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a period
specified in the order.
(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it
applies for the purposes of section 165(4)(a).
5. The reference in s. 166(4) to s. 165(5) means that the “appropriate steps” which
must be taken by the Respondent includes investigating the subject matter of the
complaint “to the extent appropriate” and keeping the complainant updated as to the
progress of inquiries. The extent to which it is appropriate to investigate any complaint
is a matter for the Respondent, as regulator, to determine.
6. The limited nature of the Tribunals jurisdiction in this context has been confirmed
by the Upper Tribunal, most recently in Scranage v Information Commissioner [2020]
UKUT 196 (AAC) where Upper Tribunal Judge Wikeley observed at paragraph 6:
“.. there is a widespread misunderstanding about the reach of section 166.
Contrary to many data subjects’ expectations, it does not provide a right of
appeal against the substantive outcome of the Information Commissioner’s
investigation on its merits. Thus, section 166(1), which sets out the circumstances
in which an application can be made to the Tribunal, is procedural rather than
substantive in its focus. This is consistent with the terms of Article 78(2) of the
GDPR (see above). The prescribed circumstances are where the Commissioner
fails to take appropriate steps to respond to a complaint, or fails to update the
data subject on progress with the complaint or the outcome of the complaint
within three months after the submission of the complaint, or any subsequent
three month period in which the Commissioner is still considering the
complaint.”
7. Therefore s.166, when read together with s. 165, requires the Respondent to (i)
consider a complaint once made, and (ii) provide the person who made the complaint
with a response, both within 3 months. Thereafter, if the Respondent has not sent a final
response to the complainant, she must update them on the progress of her consideration
of their complaint at least every 3 months thereafter.
8. This requirement is reflected in the Orders available to the Tribunal under s. 166(2).
The Tribunal can make an Order requiring the Respondent to investigate or conclude
an investigation of a complaint if she has not done so (the ‘appropriate steps’ referred
to in s. 166(2)(a)), or to provide the complainant with an update (s. 166(2)(b)).
9. The powers of the Tribunal in determining a s. 166 application are limited to those
set out in s. 166(2). In Order to exercise them, the Tribunal must be satisfied that the
Commissioner has failed to progress a complaint made to her under s. 165 DPA 2018.
The jurisdiction to make an Order is limited to circumstances in which there has been
a failure of the type set out in s. 166 (1) (a), (b) and (c).
3
Conclusions
10. The reference cited in the Notice of Appeal (‘NOA’) as being the complaint to
which the Application relates is RFA0849403. This is a complaint about the
Commissioner’s response as a data controller to an SAR made by the Applicant
(reference IRQ0831463) for all information held by the Commissioner in relation to a
2014 case (reference RFA0817253).
11. Although one of the outcomes sought in the NOA is a review of the 2014 case, it
is common ground between the parties that the 2014 case is not before the Tribunal (see
Applicant’s 3 August 2020 submissions, paragraphs 6 & 7).
12. The NOA also refers to a second complaint made by the Applicant to the
Commissioner, reference RFA0817253. This was made on 28 January 2019 and relates
to Durham Constabulary’s response to an SAR. There is a dispute between the parties
as to whether the Commissioner has responded to this complaint.
13. I have looked carefully at the documents provided and have reached the following
conclusions:
ICO SAR complaint - RFA0849403
(a) The Applicant complained to the Commissioner as regulator, about the
Commissioner’s response to the SAR, on 7 June 2019.
(b)The complaint was acknowledged on 10 June 2019 and the Commissioner
provided her determination of the complaint on 5 September 2019, which
was within the 3 months required by s.166(1)(b).
(c) The 5 September 2019 letter stated that the response the Applicant had
received to his SAR on 2 May 2019 had complied with the requirements of
the DPA and GDPR and that this concluded the investigation of his
complaint.
(d)The Applicant requested a review of the complaint decision on 6 October
2019, which was carried out. The outcome of the review was communicated
to the Applicant on 23 October 2019. The NOA specifies that the “decision”
to which the application relates is the 23 October 2019 letter.
Durham Police SAR complaint - RFA0817253
(e) The Applicant made a complaint to the Commissioner on 28 January 2019
which she acknowledged on 26 February 2019 with a request for supporting
information. I am satisfied that this was a sufficient response to ‘reset the
3-month clock’ for the purposes of s166.
(f) On 3 May 2019 the Commissioner contacted the Applicant by telephone.
The Commissioner has provided a note of the conversation, which records
the Applicant as having told the case officer that he had received a response
to his SAR from Durham Constabulary. The Applicant disputes having said
4
this, and claims that his complaint was therefore closed without being
properly investigated.
(g)Following further correspondence, the Commissioner confirmed in a letter
to the Applicant dated 11 June 2019 that her investigation of this complaint
had been concluded following the 3 May 2019 telephone call.
(h)On 30 July 2019 the Applicant complained to the Commissioner about the
handling of his complaint. The case was reviewed (reference RCC0866092)
and the decision upheld. The outcome was communicated to the Applicant
on 15 August 2019.
14. The Commissioner’s Response to this Application dated 9 July 2020, and her
supplementary submissions dated 31 July 2020, rely on grounds that the Commissioner
has responded appropriately to both complaints, and that there is no basis for making
the Orders sought.
15. In relation to the Durham Constabulary complaint, addition to the record of the
telephone conversation the Commissioner relies on correspondence produced by the
Applicant dated 6 January 2017, 15 February 2017 and 16 March 2017. The
Commissioner submits that this confirms that the Applicant has received all relevant
personal data from Durham Constabulary, and supports her position that the complaint
has been properly determined.
16. The Tribunal must consider whether an Order is required at the date of the
Tribunal’s decision. Further, and as previously stated, the Tribunal has no jurisdiction
to make an Order requiring the Commissioner to consider a complaint for a second
time, or requiring her to reach a different conclusion.
17. In relation to the ICO SAR complaint (RFA0849403), the Tribunal’s jurisdiction
is to consider whether the Commissioner has complied with the requirements of s.166
in her role as regulator. I am satisfied from the events summarised at paragraphs 13(a)
to (d) above that she has considered and responded to the complaint about her actions
as a data controller in accordance with ss.165 & 166.
18. It is equally clear from the Applicant’s grounds of appeal that he remains
dissatisfied with the outcome of his 2014 complaint (RFA0817253) and with the
Commissioner’s response to the subsequent SAR (IRQ0831463). However, for reasons
already given, neither of these matters are within the jurisdiction of this Tribunal.
19. In relation to the Durham Constabulary complaint (RFA0817253) I am satisfied
that, even were it the case that the Commissioner failed to properly consider the
Applicant’s complaint at the time of the 3 May 2019 telephone call, she has done so
since in her consideration of the correspondence from Durham Constabulary described
above. Whilst the Applicant also remains unhappy with the outcome of this complaint,
it is again not a matter in relation to which the Tribunal has jurisdiction.
20. Accordingly, I have concluded that there is no basis for making an Order under
s. 166(2) in relation to either of the Applicant’s complaints and the Application is
refused.
5
JUDGE MOIRA MACMILLAN
DATE: 12 January 2021
6