Appeal number: EA/2020/0178/GDPR/V
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
(INFORMATION RIGHTS)
HEIDI BENNETT Applicant
- and -
INFORMATION COMMISSIONER Respondent
Before:
JUDGE MOIRA MACMILLAN
Appearances:
The Applicant represented herself.
The Respondent was not represented.
Determined at a remote hearing via video on 19 June 2020
DECISION
1. The Respondent’s application for the case to be struck out is refused.
2. The Applicant’s substantive Application is also refused.
1
MODE OF HEARING
3. The proceedings were held by video. The Applicant joined remotely. The
Tribunal was satisfied that it was fair and just to conduct the hearing in this way.
4. The hearing was conducted by a Judge, sitting alone. The Tribunal was satisfied
that it was appropriate to conduct the hearing in this way.
5. The Tribunal directed that the proceedings would be conducted in private in
accordance with rule 35(2) of the Chamber’s Procedure Rules1. A recording of the
proceedings is available on application.
6. The Tribunal considered an agreed open bundle of evidence comprising pages 1
to 60.
REASONS
Background to the Application
7. The Application relates to a complaint made by the Applicant to the Respondent
on 12 December 2019. The complaint relates to the London Borough of Islington (‘the
Council’). The chronology of events is as follows:
(a) 29 October 2019: The Applicant makes a subject access request
(‘SAR’) to the Council;
(b) 12 December 2019: The Applicant complains to the Respondent
about both the lack of a response to her SAR and about a different, earlier
data protection breach.
(c) 6 January 2020: The Respondent writes to the Council, requesting a
response to the SAR within 14 days. The Respondent updates the
Applicant.
(d) 20 January 2020: The Applicant informs the Respondent that she has
still heard nothing from the Council.
(e) 21 January 2020: The Respondent contacts the Council again, and is
told that the Council is prioritising the SAR response.
1
https://www.gov.uk/government/publications/general-regulatory-chamber-tribunal-
procedure-rules
2
(f) 29 January 2020: The Applicant contacts the Respondent to say that
she has still not received a reply from the Council. She receives no response.
(g) 12 February 2020: The Applicant contacts the Respondent again, and
again receives no response.
(h) 19 April 2020: The Applicant complains to the Respondent about the
handling of her complaint.
(i) 18 May 2020: Having still received no response from the Respondent
or the Council, the Applicant applies to the Tribunal under s. 166 of the
Data Protections Act 2018 (‘DPA’).
(j) 27 May 2020: The Respondent contacts the Council and the
Applicant.
(k) 28 May 2020: The Respondent upholds the Applicant’s complaint
about the Respondent’s handling of her complaint. The Respondent
explains that she mistakenly believed the Applicant to have received a
response to her SAR.
(l) Unknown date: The Applicant receives a response to her SAR, which
she considers to be incomplete. She contacts the Respondent again.
(m) 2 June 2020: The Respondent serves a rule 23 Response to this
Application and invites the Tribunal to strike it out as having no reasonable
prospect of success.
(n) 4 June 2020: The Respondent addresses, for the first time, that part of
the Applicant’s complaint relating to the earlier data protection breach. The
Respondent upholds this part of the Applicant’s complaint.
(o) 6 June 2020: The Respondent responds to the Applicant’s concern
that the Council has not provided a full response to her SAR. She asks the
Applicant to raise the issue with the Council in the first instance, and to
revert to the Respondent if it cannot be resolved.
The Notice of Appeal and the Response
8. The Notice of Appeal dated 18 May 2020 relies on the following grounds:
(a) The Council has ignored the Applicant’s SAR;
(b) The Respondent has allowed the Council increasing time to respond
to her SAR, and appears not to be compelling the Council to comply with
its obligations; and
(c) The Respondent has not updated the Applicant on the progress of her
complaint since 21 January 2020.
9. The Response dated 2 June 2020 relies on the following grounds of opposition:
(a) The Respondent has, since the Application was made, responded to
the Applicant’s complaint, and
(b) There is no longer a s. 166(2) DPA Order for the Tribunal to make.
3
The Law
10. The Applicant’s right of application is contained in s. 166 DPA:
Orders to progress complaints
(1) This section applies where, after a data subject makes a complaint under
section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on
the complaint, or of the outcome of the complaint, before the end of the
period of 3 months beginning when the Commissioner received the
complaint, or
(c) if the Commissioner's consideration of the complaint is not
concluded during that period, fails to provide the complainant with such
information during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order
requiring the Commissioner—
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the
outcome of the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a period
specified in the order.
(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it
applies for the purposes of section 165(4)(a).
11. The reference in s. 166(4) to s. 165(5) means that the “appropriate steps” which
must be taken by the Respondent includes investigating the subject matter of the
complaint “to the extent appropriate” and keeping the complainant updated as to the
progress of inquiries. The extent to which it is appropriate to investigate any complaint
is a matter for the Respondent, as regulator, to determine.
12. S.166, when read together with s. 165, requires the Respondent to (i) consider a
complaint once made, and (ii) provide the person who made the complaint with a
response, both within 3 months. Thereafter, if the Respondent has not sent a final
response to the complainant, she must update them on the progress of her consideration
of their complaint at least every 3 months.
4
13. This requirement is reflected in the Orders available to the Tribunal under s.
166(2). The Tribunal can make an Order requiring the Respondent to investigate or
conclude an investigation of a complaint (the ‘appropriate steps’ referred to in s.
166(2)(a)), or to provide the complainant with an update (s. 166(2)(b)).
Striking out an application
14. The Upper Tribunal has provided guidance on the approach to be taken by this
Tribunal when considering whether to strike out a case as having no reasonable prospect
of success. In HMRC v Fairford Group (in liquidation) and Fairford Partnership
Limited (in liquidation) [2014] UKUT 0329 (TCC), the Upper Tribunal stated that:
“…an application to strike out in the FTT under rule 8 (3) (c) should be
considered in a similar way to an application under CPR 3.4 in civil
proceedings (whilst recognising that there is no equivalent jurisdiction in the
First-tier to summary judgement under Part 24). The Tribunal must consider
whether there is a realistic, as opposed to a fanciful (in the sense of it being
entirely without substance) prospect of succeeding on the issue at a full
hearing…The Tribunal must avoid conducting a “mini-trial”. As Lord Hope
observed in Three Rivers the strike out procedure is to deal with cases that are
not fit for a full hearing at all.”
The Evidence
15. There is no dispute between the parties as to the facts of this case.
Submissions
16. The Applicant submits that the Respondent has failed to respond adequately to
her complaint. She contends that the Respondent has also failed to explain why she had
previously concluded that the Council had responded to the SAR.
17. In her Notice of Appeal the Applicant requests sight of the correspondence
between the Respondent and the Council, and asks whether either could be fined due to
unwarranted delay she has experienced in receiving a response to her SAR. However,
at the oral hearing the Applicant accepted that the Tribunal’s powers were limited to
making an Order under s. 166(2).
18. The Respondent acknowledges that she previously failed to keep the Applicant
updated on the progress of her complaint, but submits that she had now done so. She
contends that there is no longer an Order for the Tribunal to make and that the
Application should be struck out under rule 8(3)(c).
5
Conclusions
Strike out
19. I have considered in accordance with HMRC v Fairford Group whether the
Applicant has put forward non-fanciful grounds in support of her Application. When
doing so I have considered the current prevailing circumstances, rather than the
circumstances that existed at the date of Application.
20. I note that, in response to this Application, the Respondent has reanimated her
investigation and has updated the Applicant in respect of her complaint. However I also
note that, at the date of the strike out application, the Respondent had not yet addressed
the part of the complaint relating to the earlier data breach.
21. Having considered that circumstance, and the Respondent’s poor handling of the
complaint overall, I do not consider the grounds of this Application to be without
substance, even in light of the Respondent’s more recent activity. For example, given
the history of this complaint it would be open to the Tribunal to make an Order,
requiring the Respondent to inform the Applicant of the progress of her complaint
within a specified period of time.
22. The Respondent’s application for the Application to be struck out is therefore
refused.
The Application
23. I have considered whether an Order is required. I note that the Respondent has,
since the date of Application, taken steps to inform the Applicant of the progress of her
complaint. Provided she continues to do so, there is no requirement for an Order to be
made pursuant to s. 166(2).
24. Disposal: The Application for an Order is therefore refused.
Date: 19 June 2020
Judge Moira Macmillan
(First Tier Tribunal Judge)
Date Promulgated: 22 June 2020
© CROWN COPYRIGHT 2020
6