Appeal number: EA/2020/0281/GDPR
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
(INFORMATION RIGHTS)
GABRIEL KANTER-WEBBER Applicant
- and -
THE INFORMATION COMMISSIONER Respondent
TRIBUNAL: Judge Moira Macmillan
Sitting in Chambers on 1 June 2021
© CROWN COPYRIGHT 2021
DECISION
1. The Respondent’s Application to stay this matter pending determination of other
cases by the Upper Tribunal is refused.
2. The Applicant’s Application for an Order under s166(2) of the Data Protection Act
2018 is also refused.
REASONS
Background
3. 6 October 2020 the Applicant applied to the Tribunal for an Order to progress a
complaint made under s. 165 of the Data Protection Act 2018 (“DPA”).
4. The Applicant complained to the Information Commissioner on 9 March 2020
about personal data that had been included in a letter sent by the London Borough of
Barnet (‘Barnet’) to the Respondent, about which the Applicant became aware in the
course of other Tribunal proceedings.
5. Having received no response, the Applicant contacted the Respondent again on 1
June 2020. The Respondent replied the following day and informed the Applicant that
his complaint was not yet ‘at the top of the queue’.
6. On 17 July 2020 the Respondent sent the Applicant a more substantive response
which explained the steps taken in response to his complaint in the following terms:
“We have considered the issues that you have raised with us and have written to the
London Borough of Barnet to explain that we expect their organisation to work with
you to resolve any outstanding matters
Next Steps […] In this case, we expect the organisation to explain to you how they have
complied with their obligations under the law as comprehensively as possible,
including correcting any issues that they have identified or clarifying any areas of
misunderstanding. [Having referred to the impact of the global pandemic] Although we
expect the organisation to review your data protection concern as soon as possible, we
note that it is possible that it may take them longer than usual…”
7. The Respondent’s letter to Barnet, also dated 17 July 2020, included the following:
“If you feel that you have complied with data protection law in this case, you need to
explain to your customer in as much detail as you can, why this is. You also need to be
confident that you have done all that you can to find an appropriate resolution….
We therefore advise you to review the data protection concerns and provide a full
response to Mr Kanter-Webber.”
2
8. On 10 August 2020 the Applicant received a response from Barnet, which stated
that the Applicant’s complaint had been investigated. The letter addressed each aspect
of the Applicant’s complaint in turn and explained why it had concluded that it had
complied with data protection obligations under GDPR, other than a failure to respond
to his request within a month.
9. The Applicant remained unsatisfied with Barnet’s response and wrote to the
Respondent again on 11 August 2020.
10. The Respondent replied on 4 September 2020 as follows:
The ICO, when considering a data protection complaint, is obliged only to provide you
with an outcome. One of the approaches that we take to casework is to use the
‘pushback’ approach, where we believe that the organisation could have done more to
explain and resolve your complaint before you raise the matter with the ICO. This was
the approach to take in this matter.
I note the detailed response you have received from the London Borough of Barnet. I
believe it addresses all of the points that you have raised in your complaint. While I
appreciate that you may disagree with the response you have received, the ICO does
not consider it necessary to pursue this matter further.
If you disagree with the Council’s response, it is important that you respond to them
with the appropriate evidence if you wish them to consider you complaint further.
11. The Applicant replied to the Respondent on the same day, stating that he did not
consider her latest letter to be an ‘outcome’ to his complaint within the meaning of the
DPA, which he said should comprise a clear statement upholding or dismissing the
complaint that had been made. The Applicant further stated that the Respondent had
failed to comply with her obligation under the DPA to investigate his complaint, and
requested that she did so.
12. The Respondent sent the Applicant a further reply on 8 September 2020 in which
she stated:
“Section 165(4) of the Data Protection Act 2018 states that when the Information
Commissioner receives a data protection complaint, we must:
(a) take appropriate steps to respond to the complaint
(b) inform the complainant of the outcome of the complaint.
We have taken both of these steps in this matter. In addition to this, section 165(5) states
that we are required to investigate the matter ‘to the extent appropriate’.
In this case we considered the evidence you provided and determined that the data
controller should provide you with a more comprehensive response. We asked them to
do this and they have done so. The view of the ICO is that this matter has already been
3
investigated to the appropriate extent and we do not intend to take any further action
in this matter.
We appreciate that this may not be the outcome you were seeking…”
13. The Respondent informed the Applicant that he could request a case review if he
was unhappy with the way the ICO had handled his complaint. A review was carried
out, and the result sent to the Applicant on 8 October 2020. This stated that the
complaint had been dealt with appropriately and in accordance with case handling
procedures, and would not be pursued further. The Respondent further stated:
“As […] explained in her emails, the Council has now provided you with a full and
final response to your complaint, as we instructed them to do. As a result our view is
that this matter has been investigated to the appropriate extent, and we do not therefore
intend to take any further action.”
14. The review letter explained that part of the ICO’s process when investigating a
complaint was to consider whether further regulatory action is necessary or appropriate.
“If we think an organisation has not complied with its obligations we can give them
advice and ask them to solve the problem. Our main aim is to improve the information
rights practices of organisations”. The Respondent drew the Applicant’s attention to
the fact that he was able to bring court proceedings under the data protection legislation
in his own right.
15. I note that the Applicant applied to the Tribunal for an Order two days before he
received the review outcome letter from the Respondent.
16. The Applicant’s grounds in support of his application may be summarised as
follows:
(a) that the Respondent has not informed him of the outcome of his complaint in
accordance with s165(4)(b) DPA; and
(b) that the Respondent has not carried out any sort of investigation, in breach of
s165(4)(a) read with 5(a).
Stay Application
17. On 26 November 2020 the Tribunal refused an application by the Respondent to
strike out this matter under rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal)
(General Regulatory Chamber) Rules 2009, on the basis that neither party had provided
an authority on the issue of what constitutes an outcome for the purposes of s. 166(1).
18. On 17 December 2020 the Respondent provided further submissions as directed,
and further requested that this application be stayed pending the outcome of 2 appeals
to the Upper Tribunal relating to s. 166: Killick & Veale v Information Commissioner
(QJ/2020/0303/GDPR) and Wyndham-Carrington v Information Commissioner
(GI/1321/2020). When doing so the Respondent described both cases as raising ‘very
4
similar issues under section 166 DPA (including the meaning of “outcome” and
“appropriate steps”).
19. The Applicant’s submissions in response to the stay application are, in essence, that
the Respondent has refused to provide him with any details about these cases such that
he is unable to make any meaningful representations on the issue. There is some force
in his point.
20. Having reviewed the issues raised in Killick and Veale, and in Wyndham-
Carrington, I conclude that it would not be appropriate to stay this application pending
the outcome of those proceedings. This is because I am not persuaded that the issues
raised by the Applicant in this case are sufficiently similar to the issues due to be
considered by the Upper Tribunal. As the Respondent will be aware, the question of
whether an applicant has received an ‘outcome’ pursuant to s. 165(4)(b) is frequently
raised in s. 166 applications, and these continue to be determined on a case by case
basis.
Law
Data Protection Act 2018
21. Section 165 creates a right of complaint to the Respondent by a data subject:
Complaints by data subjects
(1) Articles 57(1)(f) and (2) and 77 of the UK GDPR (data subject's right to
lodge a complaint) confer rights on data subjects to complain to the
Commissioner if the data subject considers that, in connection with personal data
relating to him or her, there is an infringement of the UK GDPR .
(2) A data subject may make a complaint to the Commissioner if the data subject
considers that, in connection with personal data relating to him or her, there is
an infringement of Part 3 or 4 of this Act.
(3) The Commissioner must facilitate the making of complaints under subsection
(2) by taking steps such as providing a complaint form which can be completed
electronically and by other means.
(4) If the Commissioner receives a complaint under subsection (2), the
Commissioner must—
(a) take appropriate steps to respond to the complaint,
(b) inform the complainant of the outcome of the complaint,
(c) inform the complainant of the rights under section 166, and
5
(d) if asked to do so by the complainant, provide the complainant with further
information about how to pursue the complaint.
(5) The reference in subsection (4)(a) to taking appropriate steps in response to
a complaint includes—
(a) investigating the subject matter of the complaint, to the extent appropriate,
and
(b) informing the complainant about progress on the complaint, including about
whether further investigation or co-ordination with [a] foreign designated
authority is necessary.
22. S.166 creates a right of application to the Tribunal:
Orders to progress complaints
(1) This section applies where, after a data subject makes a complaint under
section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on the
complaint, or of the outcome of the complaint, before the end of the period of 3
months beginning when the Commissioner received the complaint, or
(c) if the Commissioner's consideration of the complaint is not concluded during
that period, fails to provide the complainant with such information during a
subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order
requiring the Commissioner—
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the outcome of
the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a period specified
in the order.
(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it
applies for the purposes of section 165(4)(a).
24. The reference in s. 166(4) to s. 165(5) means that the “appropriate steps” which
must be taken by the Respondent includes investigating the subject matter of the
6
complaint “to the extent appropriate” and keeping the complainant updated as to the
progress of inquiries. The extent to which it is appropriate to investigate any complaint
is a matter for the Respondent, as regulator, to determine.
25. Articles 77 & 88 of the GDPR read as follows:
Article 77 Right to lodge a complaint with a supervisory authority
1. Without prejudice to any other administrative or judicial remedy, every data subject
shall have the right to lodge a complaint with a supervisory authority, in particular in
the Member State of his or her habitual residence, place of work or place of the alleged
infringement if the data subject considers that the processing of personal data relating
to him or her infringes this Regulation.
2. The supervisory authority with which the complaint has been lodged shall inform the
complainant on the progress and the outcome of the complaint including the possibility
of a judicial remedy pursuant to Article 78.
Article 78 Right to an effective judicial remedy against a supervisory authority
1. Without prejudice to any other administrative or non-judicial remedy, each natural
or legal person shall have the right to an effective judicial remedy against a legally
binding decision of a supervisory authority concerning them.
2. Without prejudice to any other administrative or non-judicial remedy, each data
subject shall have the right to a an effective judicial remedy where the supervisory
authority which is competent pursuant to Articles 55 and 56 does not handle a
complaint or does not inform the data subject within three months on the progress or
outcome of the complaint lodged pursuant to Article 77.
26. The limited nature of the Tribunals jurisdiction in this context has been confirmed
by the Upper Tribunal, including in Scranage v Information Commissioner [2020]
UKUT 196 (AAC) in which Upper Tribunal Judge Wikeley observed:
[4] The Data Protection Act (DPA) 2018, which received Royal Assent on 23
May 2018, updated data protection legislation, especially in the light of the EU’s
General Data Protection Regulation (GDPR). In particular, section 165 of the
DPA 2018 sets out a data subject’s right to make a complaint to the Information
Commissioner about an infringement of the data protection legislation in relation
to his or her personal data (reflecting Articles 57 and 77 of the GDPR). Section
166 then enables a data subject to apply for an order from the Tribunal if the
Commissioner does not take certain actions in relation to the data subject’s
complaint. This provision, which had no equivalent in the DPA 1998, reflects the
right set out in Article 78(2) of the GDPR:
[5] [Article 78(2)…]
[6] .. there is a widespread misunderstanding about the reach of section 166.
Contrary to many data subjects’ expectations, it does not provide a right of
7
appeal against the substantive outcome of the Information Commissioner’s
investigation on its merits. Thus, section 166(1), which sets out the circumstances
in which an application can be made to the Tribunal, is procedural rather than
substantive in its focus. This is consistent with the terms of Article 78(2) of the
GDPR (see above). The prescribed circumstances are where the Commissioner
fails to take appropriate steps to respond to a complaint, or fails to update the
data subject on progress with the complaint or the outcome of the complaint
within three months after the submission of the complaint, or any subsequent
three month period in which the Commissioner is still considering the
complaint.”
27. Therefore s.166, when read together with s. 165, requires the Respondent to (i)
investigate a complaint once made, and (ii) provide the person who made the complaint
with an outcome, both within 3 months. Thereafter, if the Respondent has not sent a
final response to the complainant, she must update them on the progress of her
consideration of their complaint at least every 3 months thereafter.
28. This requirement is reflected in the Orders available to the Tribunal under s. 166(2).
The Tribunal can make an Order requiring the Respondent to investigate or conclude
an investigation of a complaint if she has not already done so (the ‘appropriate steps’
referred to in s. 166(2)(a)), or to provide the complainant with an update (s. 166(2)(b)).
29. The powers set out in s. 166(2) are the only ones available to the Tribunal in this
context. When exercising them, the Tribunal must consider whether an Order is
required at the date it determines the application. At that stage, if there continues to be
a failure of the type set out in s. 166 (1) (a), (b) or (c) in relation to a complaint made
under s. 165, the Tribunal has jurisdiction to make an Order.
Submissions
30. The Applicant’s grounds in support of his application are set out in his initial
application, and are developed in his reply to the Respondent’s further written
submissions.
31. The Applicant’s position throughout has been that the Respondent has failed to
provide him with an ‘outcome’. He submits that the Respondent’s letter of 17 July 2020
did not involve any consideration of the merits of his complaint and that, although the
4 September 2020 letter was more comprehensive, the Respondent’s focus remained on
whether Barnet had addressed all of the points raised in his complaint, rather than
whether it had complied with its obligations under GDPR.
32. The Applicant contends that in relation to each complaint received the Respondent
is obliged to consider whether there has been an infringement of GDPR and must then
answer that question. He submits that this is the ‘outcome’ envisaged by s. 165(4)(b).
33. The Applicant relies on the language of recital 141 of the GDPR in support of this
contention. This states:
8
“ Every data subject should have the right to lodge a complaint with a single
supervisory authority, […], and the right to an effective judicial remedy in
accordance with Article 47 of the Charter if the data subject considers that his
or her rights under this Regulation are infringed or where the supervisory
authority does not act on a complaint, partially or wholly rejects or dismisses a
complaint or does not act where such action is necessary to protect the rights of
the data subject. The investigation following a complaint should be carried out,
subject to judicial review, to the extent that is appropriate in the specific case.
The supervisory authority should inform the data subject of the progress and the
outcome of the complaint within a reasonable period. If the case requires further
investigation or coordination with another supervisory authority, intermediate
information should be given to the data subject. In order to facilitate the
submission of complaints, each supervisory can also be completed electronically,
without excluding other means of communication.”
34. The Applicant submits that this gives rise to three circumstances in which an
Applicant may seek a judicial remedy in relation to the supervisory authority’s handling
of a complaint:
a. Where no action is taken;
b. Where a complaint is partially or wholly rejected or dismissed; and
c. Where no action is taken in circumstances where action is necessary in
order to protect the rights of the data subject.
35. The Applicant’s case is that circumstance (b) above gives rise to an inference that
that the Respondent has an obligation to either uphold, reject or dismiss his complaint,
or provide a valid reason for not considering the complaint at all. He contends that, in
his case, the Respondent has failed to determine his complaint in any of these ways,
and that he is therefore without an outcome.
36. The Applicant further submits that the Respondent has failed to investigate his
complaint in any depth and therefore cannot be said to have dealt with it, or to have
taken appropriate steps.
37. The Respondent submits in reply that an application to the Tribunal under s. 166 is
available to a complainant only where they have made a complaint under s. 165 or
Article 77 GDPR and are dissatisfied with the procedure adopted by the Respondent.
She does not contest that she has an obligation under the DPA and GDPR to provide
such a complainant with an ‘outcome; but submits that she has a wide margin of
discretion as to how she investigates and responds to each complaint.
38. The Respondent rejects the submission that she is required to respond to every
complaint by reaching a determination as to whether the complainant’s rights have been
breached. She relies in part on an earlier decision by Upper Tribunal Judge Wikeley in
an application for permission to appeal, Leighton v Information Commissioner (No.2)
[2020] UKUT 23 (AAC (emphasis added by the Respondent):
9
“31. I note that in Platts v Information Commissioner (EA/2018/0211/GDPR) the FTT
accepted a submission made on behalf of the Commissioner that “s.166 DPA 2018 does
not provide a right of appeal against the substantive outcome of an investigation into a
complaint under s.165 DPA 2018” (at paragraph [13]). Whilst that is a not a precedent
setting decision, I consider that it is right as a matter of legal analysis. Section 166 is
directed towards providing a tribunal-based remedy where the Commissioner fails to
address a section 165 complaint in a procedurally proper fashion. Thus, the mischiefs
identified by section 166(1) are all procedural failings. “Appropriate steps” mean just
that, and not an “appropriate outcome”. Likewise, the FTT’s powers include making
an order that the Commissioner “take appropriate steps to respond to the complaint”,
and not to “take appropriate steps to resolve the complaint”, least of all to resolve the
matter to the satisfaction of the complainant. Furthermore, if the FTT had the
jurisdiction to determine the substantive merits of the outcome of the Commissioner’s
investigation, the consequence would be jurisdictional confusion, given the data
subject’s rights to bring a civil claim in the courts under sections 167-169 (see further
DPA 2018 s.180).”
39. The Respondent submits that the ‘outcome’ of a complaint in this context may take
the form of decision by her not to take [further] regulatory action, or a finding that the
data controller has addressed the complainant’s concerns, both of which would meet
the requirement set out in s. 165(4)(a) and s.166(1)(a) that she “take[s] appropriate
steps to respond to a complaint”. She further submits that this is reflected in the Upper
Tribunal’s language in Leighton, which makes a distinction between ‘responding to’
and complaint and ‘resolving’ a complaint.
40. The Respondent relies on the language of Article 57(1)(f) of GDPR which requires
a supervisory authority to “handle” a complaint rather than reach a determination on
breach.
41. The Respondent submits in addition that the rights described in Recital 141 are
reflected in both Article 78(1) & (2), and the right to a judicial remedy in circumstances
where the supervisory authority partially or wholly rejects or dismisses a complaint (the
Applicant’s option ‘(b)’) are met though Article 78(1), which provides a right to a
judicial remedy against a legally binding decision.
42. The Respondent contends that the application of the Applicant’s definition of an
‘outcome’ would result in two overlapping routes to redress under the DPA, because a
complainant would be able to both seek a determination on breach by the Respondent
pursuant to ss. 165 & 166 whilst also seeking the same determination from a court under
ss. 167- 170. The Respondent submits that this would result in the ‘jurisdictional
confusion’ described by the Upper Tribunal in Leighton.
43. The Respondent submits in addition that the creation of a 2 tier scheme of this
nature, where an identical determination on breach could be sought from the
Respondent and the courts, but the former without incurring costs, would lead to the
Respondent being overwhelmed with complaints.
10
44. The Respondent further submits that application of the Applicant’s definition would
curtail her discretion to decide the extent to which any complaint should be
investigated, since every complaint would have to be investigated to the extent required
in order to establish a breach of data protection rights.
45. In relation to the current application, the Respondent submits that both the 4 & 8
September 2020 letters provided the Applicant with an ‘outcome’ to his complaint, in
that both make clear that, Barnet having responded to the Applicant’s complaint, no
further action would be taken. The Respondent contrasts this with a situation in which
a complainant is left unclear as to whether an investigation of a complaint is ongoing.
46. The Applicant submits in reply that a response to a complaint must engage with the
subject matter of the complaint, and that a response which is simply a reply must be
inadequate. He relies on Article 63 of the EU Regulation 2018/1725, a provision
relating to complaints by data subjects made to the European Data Protection
Supervisor, as a relevant comparable framework, under which a failure to respond or
inform a complainant of an outcome within three months is deemed ‘a negative
decision’.
47. The Applicant rejects the Respondent’s submission that some of the rights set out
in Recital 141 are met through Article 78(1). He does so on the basis that this provision
contains no reference to ‘complaints’ and because there is no authority for such a
proposition. The Applicant submits that the application of Recital 141 to the DPA must
lead to a conclusion that the purpose of ss. 165 & 166 is to create an alternative route
for determination of breach, to that available in the courts pursuant to ss. 167-170. He
contends that Parliament must have intended to create two routes when drafting the
DPA, thereby enabling complainant to seek a determination from the Respondent
without incurring cost.
Conclusion
48. There is no dispute between the Parties as to whether the Respondent is required to
provide an outcome in response to a complaint made under s. 165 or Article 77. The
issue is whether the outcome provided must always “either uphold, reject or dismiss
[the] complaint, or provide a valid reason for not considering the complaint at all”,
including by reaching a determination relating to a breach of a complainant’s rights.
49. When considering this issue the Tribunal must give effect to the statutory language
in context, having regard to the relevant statutory purpose, and is bound by any relevant
decisions taken by the Upper Tribunal.
50. In context, the language of ss. 165 & 166 is open to misinterpretation, as evidenced
by some previous applications to the Tribunal and as acknowledged by the Upper
Tribunal in Scranage. It may therefore be helpful to summarise the principles relating
to s. 166 confirmed by the Upper Tribunal to date:
a. The purpose of s.166 is to give effect the rights set out in Article 78(2)
(Leighton and Scranage).
11
b. It does not provide a right of appeal against the substantive outcome of
the Information Commissioner’s investigation on its merits (Scranage).
The Tribunal understands the ‘substantive outcome’ of a complaint in this
context to be the Respondent’s final decision in relation to it.
c. “Section 166 is directed towards providing a tribunal-based remedy
where the Commissioner fails to address a section 165 complaint in a
procedurally proper fashion” (Leighton).
d. This Tribunal’s powers “include making an order that the Commissioner
“take appropriate steps to respond to the complaint”, and not to “take
appropriate steps to resolve the complaint”, least of all to resolve the
matter to the satisfaction of the complainant” (Leighton).
51. The Tribunal has no jurisdiction to make an Order requiring the Commissioner to
take action in relation to a complaint once an outcome has been provided to the
complainant. Neither does it have jurisdiction to consider the merits of that outcome.
As stated above, the Orders available under s.166(2) are purely procedural.
52. The Applicant accepts the limited nature of the Tribunal’s jurisdiction but submits
that the Respondent is procedurally required to provide an outcome that upholds, rejects
or dismisses his complaint, based on the language of Recital 141.
53. I am not persuaded by the Applicant’s arguments for the following reasons:
i. The Applicant submits that Recital 141 gives rise to three circumstances in which
there is a right to a judicial remedy in relation to the handling of a complaint:
a. Where no action is taken;
b. Where a complaint is partially or wholly rejected or dismissed; and
c. Where no action is taken in circumstances where action is necessary in
order to protect the rights of the data subject.
ii. The Applicant rejects the Respondent’s submission that the right summarised at
(b) refers only to decisions made under Article 78(1), relying on the fact that only
Article 78(2) refers to “complaints”. However, there is nothing in the language of
Article 78(2) that reflects the Applicant’s right (c), which appears to describe
enforcement proceedings and in any event goes significantly beyond informing a
complainant of an ‘outcome’. I therefore conclude that Article 78(2) cannot be
intended to capture and reflect all of the rights described in Recital 141 in relation
to the handling of complaints. When reaching this conclusion I note, in passing,
that the purpose of s.166 is to give effect to the rights set out in Article 78(2),
rather than those described in Recital 141.
iii. As to whether the Applicant’s summarised right (b) is intended to be captured
and reflected by Article 78(2), I note that this right arises in circumstances where
a complaint has been wholly or partially dismissed. It is difficult to understand
12
how the exercise of a right to a judicial remedy in such a circumstance where a
complaint has been partially dismissed could be properly characterised as a
procedural issue, as opposed to an appeal against a substantive outcome.
Therefore, irrespective of the applicable Article(s) of the GDPR, I am bound to
conclude that the appropriate judicial remedy available under domestic law in the
Applicant’s summarised right (b) must be found somewhere other than in s.166,
possibly by way of judicial review.
iv. Although the Respondent submits that summarised right (b) is captured by Article
78(1), I note that this provision only applies to legally binding decisions by the
supervisory authority. As there is nothing before me to suggest that the
Respondent’s determination of a complaint is in any way legally binding, I am
not convinced by the Respondent’s suggestion, but have not had the benefit of
detailed submission on this issue. Alternative explanations are that summarised
right (b) is captured by a wholly different Article, or that that the right is captured
by Article 78(2) but the effective judicial remedy is made available under
domestic law by a provision other than s.166. Again, this might be by way of
judicial review, but this is not a matter I need to determine.
v. The other basis upon which the Applicant seeks to argue that an outcome must
encompass a determination of the complaint is by reference to Article 63 of the
EU Regulation 2018/1725. However, there is no similar default presumption
contained in the GDPR and no reference in any relevant GDPR Recital or Article
relating to a supervisory authority having an obligation to determine every
complaint. The requirement is that the complaint is investigated to the extent
appropriate.
vi. I therefore conclude that there is no requirement that an outcome provided under
s. 165(4)(b) must include a determination of whether a complainant’s rights under
the DPA or GDPR have been breached.
vii. The absence of such a requirement is reflected in the Upper Tribunal decision in
Leighton, which makes a clear distinction between responding to a complaint and
resolving it. The Applicant’s submission that ‘resolve’ in this context should be
understood as referring to taking action or enforcement proceedings is
misconceived. The resolution of a complaint does not always require
enforcement. I am satisfied that the distinction made by the Upper Tribunal in
Leighton is between an order requiring the Respondent to take action in response
to a complaint, which is a procedural matter within the Tribunal’s jurisdiction,
and an order requiring the respondent to resolve a complaint by determining it,
which is not.
viii. This is because such an order would to interfere with the discretion afforded to
the Respondent in Recital 141 and s.165, to determine the extent to which it is
appropriate to investigate any complaint. This wide margin of discretion must be
incompatible with an obligation to determine in each case whether a
complainant’s rights have been breached. This is also why the Applicant’s second
ground in support of his application, relating to the extent to which his complaint
13
has been investigated, also fails to succeed. It is clear from correspondence that
the Respondent has considered the Applicant’s complaint and has investigated it
to the extent to which she considers it appropriate, in this case through application
of her ‘pushback’ policy.
54. Having reached these conclusions, I have then considered whether the Applicant
has received an ‘outcome’ in relation to his complaint as at the date of this decision, by
considering whether he has been informed of the Respondent’s ‘final decision’. I have
concluded that he has received such an outcome. Although the language used in the
Respondent’s July letter was suboptimal, since it left the Applicant without a clear
understanding of the extent to which his complaint remained under consideration, I am
satisfied that the language of the 4 and 8 September letters, and the 8 October review
letter, left the Applicant in no doubt as to the Respondent’s final decision in respect of
his complaint.
55. Accordingly, I conclude that there is no longer a basis for making an Order under
s. 166(2) DPA on the facts of this case. The Application is therefore dismissed..
(Signed)
JUDGE MOIRA MACMILLAN
DATE: 01 June 2021
DATE PROMULGATED: 01 June 2021
14