Appeal number: EA/2020/0353/GDPR
V1
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
Information Rights
MOHAMMED BELAL UDDIN Applicant
- and -
THE INFORMATION COMMISSIONER Respondent
Before:
JUDGE LYNN GRIFFIN
Sitting in Chambers on 4 February 2021
Appearances:
Applicant in person
Determined at a remote hearing by Cloud Video Platform which the
Applicant joined via telephone
DECISION
1. The application is struck out under rule 8(3)(c) of the Tribunal Procedure
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009, because there is
no reasonable prospect of the Applicant’s case succeeding.
1
V: video (all remote)
1
MODE OF HEARING
2. The proceedings were held by video hearing. The Applicant joined
remotely by telephone. The Respondent had indicated that she did not intend
to participate in the hearing. The Tribunal was satisfied that it was fair and just
to conduct the hearing in this way.
REASONS
Background to the Application
3. This application relates to a complaint made to the Respondent by Mr
Uddin about the processing of his personal data that began in 2016 in the
context of verbal and email communications with & amongst his work
colleagues. At the time the Applicant was employed by BGC Technology
International Limited [BGC].
4. The Applicant had emailed a colleague who worked in HR, Mrs Devika
Patel [DP] at work, to say that he wanted to meet her for a chat, but not about
any HR matter. He wanted to talk to her for an “informal/casual chat and not
to discuss anything work-related”. BGC email was used for this approach. Mrs
Patel had then verbally disclosed the nature of the correspondence to Ms Payal
Malde [PM].
5. The Applicant made the complaint that leads to this application on 11 June
2019. Mr Uddin submits that in an Employment Tribunal2, his case was struck
out by the Judge because of a misunderstanding about who was the data
controller. He says that the Respondent initially stated that the disclosure did
not involve his personal data and later changed that advice. The Applicant
believes this led to his case being struck out in the Employment Tribunal when
BGC relied upon the initial advice.
The Notice of Application and the Response
6. The Notice of Application dated 8 December 2020 the Applicant sought an
order under section 166(2) and 166(3) of the Data Protection Act 2018 to direct
a response from the Information Commissioner's Office ("ICO"). He would like
the First-tier Tribunal to make the following order:
“To ask the ICO to explicitly confirm (in light of its admission that it previously
provided wrong advice to BGC) whether the DP to PM Disclosure, which was
investigated as part of case RFA0832071, amounted to a breach of the DPA 98
(within a personal capacity as outlined above) and to provide this response as
2
Case Number: 3203011/2019 Employment Judge Ross, 2 November 2020
2
soon as possible (ideally within 14 days), as BGC now denies this and has
provided a contradictory version of events to the employment tribunal judge”
7. The Response dated 8 January 2021 invites the Tribunal to strike out the
Applicant’s application.
The Law
8. A data subject has a right to make a complaint to the Commissioner if they
consider that in connection with the processing of personal data relating to
them there is an infringement of the General Data Protection Regulation
[GDPR], and/or Parts 3 or 4 of the Data Protection Act 2018 [DPA18]: see
Article 77 GDPR, and section 165 (1) & (2) DPA18.
9. Under section 166 DPA18, a data subject has a right to make an application
to the Tribunal if they consider that the Commissioner has failed to take certain
procedural actions in relation to their complaint.
10. Section 166 DPA18 as relevant states:
(1) This section applies where, after a data subject makes a complaint under
section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on the
complaint, or of the outcome of the complaint, before the end of the period
of 3 months beginning when the Commissioner received the complaint, or
(c) if the Commissioner’s consideration of the complaint is not concluded
during that period, fails to provide the complainant with such information
during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order
requiring the Commissioner—
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the
outcome of the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a period
specified in the order.
3
11. The reference to taking “appropriate steps” in section 166(1)(a) and (2)(a),
includes “investigating the subject matter of the complaint to the extent appropriate”
and “informing the complainant about progress on the complaints”, as set out in
sections 166(4) and 165(5) DPA18.
12. The reference to “provide the complainant with…. the outcome of the
complaint” in s. 166(1)(b) and 2(b) is not qualified with the word appropriate.
13. The Tribunal can only exercise powers given to it by Parliament as set out
in legislation. When considering an application under s. 166 the Tribunal is not
concerned with the merits or strength of the underlying complaint. Section 166
DPA18 does not provide a right of appeal against the substantive outcome of
an investigation into a complaint under s. 165 DPA18. Neither does it allow the
Tribunal to direct to what extent it is appropriate to investigate any complaint;
that is a matter for the Information Commissioner.
14. On an application under s. 166 DPA18 the Tribunal is limited to
considering whether to make an order of the kinds set out in s. 166(2) requiring
the Commissioner to
a. Take appropriate steps to respond to the complaint or
b. Inform the complainant of progress on the complaint or
c. Inform the complainant of the outcome of the complaint.
15. Once the Information Commissioner has sent a response to the complaint
there is no longer an order for the Tribunal to make under s.166(2).
16. The powers of the Tribunal in determining such an appeal have been
considered by the Upper Tribunal in Leighton v Information Commissioner (No.2)
[2020] UKUT 23 (AAC) in which Upper Tribunal Judge Wikeley said at
paragraph 31
“Appropriate steps” mean just that, and not an “appropriate outcome”. Likewise,
the FTT’s powers include making an order that the Commissioner “take
appropriate steps to respond to the complaint”, and not to “take appropriate steps
to resolve the complaint”, least of all to resolve the matter to the satisfaction of
the complainant.
17. In the case of Scranage v Information Commissioner [2020] UKUT 196 (AAC)
the Upper Tribunal went further in saying:
“... there is a widespread misunderstanding about the reach of section 166.
Contrary to many data subjects’ expectations, it does not provide a right of appeal
against the substantive outcome of the Information Commissioner’s investigation
on its merits. Thus, section 166(1), which sets out the circumstances in which an
application can be made to the Tribunal, is procedural rather than substantive in
4
its focus. This is consistent with the terms of Article 78(2) of the GDPR (see
above). The prescribed circumstances are where the Commissioner fails to take
appropriate steps to respond to a complaint, or fails to update the data subject on
progress with the complaint or the outcome of the complaint within three months
after the submission of the complaint, or any subsequent three month period in
which the Commissioner is still considering the complaint.”.
18. These decisions of the Upper Tribunal are binding on the First Tier
Tribunal as to the approach that must be taken to applications such as that
made by Mr Uddin.
19. Mr Uddin thought that this Tribunal had the power to consider an
application about the substantive outcome of the Information Commissioner’s
investigation. He is not alone in thinking that, as has been acknowledged by
the Upper Tribunal in the decision in Scranage, but the Tribunal is limited in
its powers to those given by Parliament as interpreted by the Upper Tribunal.
20. A person who wants a data controller (or processor) to rectify personal
data or otherwise properly comply with the Data Protection Act 2018 or
General Data Protection Regulations in relation to holding personal data must
go to the High Court or a County Court pursuant to section 180 of the Data
Protection Act 2018.
21. This Tribunal does not have an oversight function in relation to the
Information Commissioner’s Office and does not hold them to account for their
internal processes. The Parliamentary and Health Service Ombudsman is the
body which has that function.
The Facts
22. There is no dispute that on 11 June 2019 the Commissioner received a
complaint made anonymously, but in fact made by the Applicant, against BGC.
The complaint related to the way BGC had handled the Applicant’s personal
data.
23. The Commissioner took the following steps
a. allocated a case reference; RFA0832071.
b. 3 July 2019 an ICO case officer wrote to BGC to request further
information in relation to the Applicant’s complaint.
c. 3 July 2019 the case officer also wrote to the Applicant to advise
that he had written to BGC and would write to the Applicant again
once he had received a response from the company.
5
d. 8 July 2019 the case officer wrote to the Applicant to provide an
update.
e. 5 August 2019 the case officer wrote to the Applicant with an
outcome to his complaint. The case officer was of the view that BGC
had complied with its data protection obligations.
f. 11 September 2019 the case officer responded to the Applicant’s
correspondence since 5 August 2019. The case officer advised that he
would not be taking any further action on the matter.
24.On 12 September 2019 the Applicant wrote to request a case review of
RFA0832071. This matter was allocated RCC0875113 by the Commissioner.
25. The case review was completed and by letter dated 18 October 2019 the
Applicant was provided with an outcome to that case review. The reviewing
officer was satisfied that the previous case officer had handled the matter
reasonably and in line with casework processes. The reviewing officer stated
that the disclosures complained about would not fall under data protection
legislation.
26. In response to correspondence from the Applicant on 18 December 2020
the Commissioner wrote to the Applicant to explain that the Applicant’s recent
queries did not raise any issues that the Commissioner was required to pursue
and that there was no need to consider this matter further.
27. The Applicant had made an earlier application under s. 166 to this
Tribunal given reference EA/2020/0345/GDPR. That was made on 23
November 2020 in relation to ICO case reference RFA0906261 (new case
number: IC-70316-Z3N2). That appeal was withdrawn on 17 December 2020
because Mr Uddin was satisfied that “the information simply does not exist
and is a fabrication by BGC (hence why they are unable to provide it)”. The
Commissioner’s position in that application was that an outcome to the
complaint in that case had been provided on 26 November 2020 and so no order
under s. 166 was appropriate.
28. That complaint, RFA0906261, had arisen from a Subject Access Request
[SAR] made by the Applicant to BGC. In reply to the complaint the
Commissioner set out that BGC had explained that they had now sent
additional personal data to the Applicant, that some personal data had been
withheld under the legal professional privilege exemption, and that BGC had
applied the exemption appropriately. The Commissioner was satisfied that
BGC had now complied with the Applicant’s SAR.
6
Submissions
29. The Tribunal is grateful to the parties for their written submissions
provided for the hearing and to the Applicant for his oral submissions. Having
read the bundle, read all the written submissions, and heard oral submissions,
I reserved judgment on the application.
30. After the hearing the Applicant sent two emails to the Tribunal
a. 04/02/2021 – at 12.01, in which he raised a point in relation to
jurisdiction
b. 05/02/2021 – at 08.54, which included further submissions and an
email exchange with BGC from 11/02/2021, plus three
attachments to that exchange
31. The Applicant disagrees with the Commissioner that there is no need for
further consideration. He makes three points to underpin his application under
s.166
a. There were two investigations which led to two different outcomes
& there should only be one outcome and not multiple outcomes
b. The Commissioner said that if BGC made a significant deviation
from what they had previously said in then the Commissioner
would consider a reassessment. Mr Uddin says that there has been
a significant deviation and so the Commissioner should reconsider
c. The Commissioner has failed to investigate the subject matter of his
complaint to the extent appropriate
32. The Respondent submitted that
a. The alleged disclosure of data that the Applicant complains of
took place in 2016. The applicable law at the time of the incident was
the Data Protection Act 1998. The Applicant has no right to make an
application under section 166 in respect of it. The complaint is not
one that therefore falls within the scope of section 165 DPA18 or
article 77 GDPR.
b. The applicant had been provided with an outcome to his
complaint
33. In reply to the Respondent’s points the Applicant said during the hearing
that BGC was withholding information and in August 2020 the Respondent
had admitted providing the wrong advice to BGC. In addition, BGC had
deviated from their original position. Mr Uddin submitted that the
correspondence showed that BGC had withheld emails that showed the
7
processing of his data. He had made his complaint in 2019 and his submission
was that the Tribunal should apply the law at that time and therefore had
jurisdiction to apply DPA18. He said the Respondent had not investigated the
complaint he made to the extent appropriate.
34. The Applicant further contended that the Respondent had a duty to
provide advice under schedule 13 DPA18 and should correct their advice
previously given to BGC which he believes would affect the result of the
Employment Tribunal.
Conclusions
35. The Applicant’s complaint stems from events which began in 2016. If the
matters had definitively ended there the Tribunal would have no jurisdiction
under DPA18 s166. However, these matters have continued to preoccupy the
Applicant and to develop since that time and it is at least arguable that there
was a continuing processing of the Applicant’s data by BGC that would bring
the case within the reach of s166 DPA18. For the purposes of this application it
is proportionate to proceed on that basis.
36. Turning to s166 DPA18, the Respondent has considered the Applicant’s
complaint in case reference RFA0832071, taken steps as outlined above and
informed him of the outcome.
37. The Applicant is not satisfied with that outcome and wishes it to be
reconsidered but it is an outcome nonetheless.
38. This Tribunal has no power to make a decision about the merits of that
outcome, whether it be right or wrong, nor to compare it to any other decision
of the Commissioner. Neither does the Tribunal have power to examine
whether there should be further or different steps to those taken by the
Commissioner even if the circumstances have changed since the outcome was
sent to the Applicant.
39.Furthermore, the Tribunal does not have any power to supervise or
mandate the performance of the Commissioner’s functions under schedule 13
DPA18.
40. There is subsequently no basis for the Tribunal to make an order under
section 166(2) DPA18.
41. In order for Mr Uddin’s application to go forward there must be a realistic,
as opposed to a fanciful or unrealistic, prospect of its success as explained by
Lord Woolf MR in Smith v Cosworth Casting Processes Ltd [1997] 1 WLR 1538.
8
42. For the reasons set out above, I have concluded that this Tribunal would
not be able to provide the Applicant with the order he seeks and that therefore
the application has no reasonable prospect of success.
43. Having taken account of all relevant considerations, I strike out this
application pursuant to 8(3)(c) of the Tribunal Procedure (First-tier Tribunal)
(General Regulatory Chamber) Rules 2009 because there is no reasonable
prospect of the application succeeding.
Lynn Griffin
Tribunal Judge
Date of Decision: 02 March 2021
Date Promulgated: 03 March 2021
© CROWN COPYRIGHT 2021
9