Appeal number: EA/2021/0009/GDPR
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
INFORMATION RIGHTS
SOLOMON BROWNE Applicant
- and -
THE INFORMATION COMMISSIONER Respondent
TRIBUNAL: JUDGE MOIRA MACMILLAN
Determined following a Case Management Hearing on 19 March 2021
© CROWN COPYRIGHT 2021
DECISION
1. The Application is struck out under rule 8(3)(c) of the Tribunal Procedure (First-
tier Tribunal) (General Regulatory Chamber) Rules 2009, as amended
REASONS
2. Mr Browne applied to the Tribunal for an Order to progress his complaint under
s. 166 of the Data Protection Act 2018 (“DPA”).
3. He complained to the Information Commissioner on 28 June 2020 and 2 July
2020 about Bradford Council’s (‘the Council’s’) response to his subject access request.
In particular, Mr Browne is concerned that the Council has failed to provide him with
personal data in the form of CCTV footage that shows his trailer being stolen.
4. In his Notice of Appeal dated 7 January 2021, Mr Browne relies on grounds that
the Commissioner has not complied with all of her procedural obligations under the
DPA and has failed to properly investigate his complaint. He has expanded on these
points in his Reply.
5. In terms of the outcomes sought, Mr Browne identifies:
i. A ‘credible investigation’ of his complaint; and
ii. Recovery of his stolen trailer; or
iii. £3000 compensation to be spent replacing his trailer.
6. The Information Commissioner’s Response dated 26 January 2021 relies on
grounds of opposition that, although she did not initially comply with her obligation
under the DPA to respond to Mr Browne’s complaint within 3 months, she has since
responded appropriately and sent him her determination of his complaint on 20 January
2021. The Commissioner submits that, this being the case, there is no basis for the
Tribunal to make the Order sought.
The Law
7. Section 166 of the DPA 2018 creates a right of application to the Tribunal as
follows:
Orders to progress complaints
2
(1) This section applies where, after a data subject makes a complaint under
section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on the
complaint, or of the outcome of the complaint, before the end of the period of 3
months beginning when the Commissioner received the complaint, or
(c) if the Commissioner's consideration of the complaint is not concluded during
that period, fails to provide the complainant with such information during a
subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order
requiring the Commissioner—
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the outcome of
the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a period specified
in the order.
(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it
applies for the purposes of section 165(4)(a).
9. The reference in s. 166(4) to s. 165(5) means that the “appropriate steps” which
must be taken by the Respondent includes investigating the subject matter of the
complaint “to the extent appropriate” and keeping the complainant updated as to the
progress of inquiries. The extent to which it is appropriate to investigate any complaint
is a matter for the Respondent, as regulator, to determine.
10. The limited nature of the Tribunals jurisdiction in this context has been confirmed
by the Upper Tribunal, most recently in Scranage v Information Commissioner [2020]
UKUT 196 (AAC) where Upper Tribunal Judge Wikeley observed at paragraph 6:
“.. there is a widespread misunderstanding about the reach of section 166. Contrary to
many data subjects’ expectations, it does not provide a right of appeal against the
substantive outcome of the Information Commissioner’s investigation on its merits.
Thus, section 166(1), which sets out the circumstances in which an application can be
made to the Tribunal, is procedural rather than substantive in its focus. This is
consistent with the terms of Article 78(2) of the GDPR (see above). The prescribed
circumstances are where the Commissioner fails to take appropriate steps to respond
to a complaint, or fails to update the data subject on progress with the complaint or the
3
outcome of the complaint within three months after the submission of the complaint, or
any subsequent three month period in which the Commissioner is still considering the
complaint.”
11. Therefore s.166, when read together with s. 165, requires the Respondent to (i)
consider a complaint once made, and (ii) provide the person who made the complaint
with a response, both within 3 months. Thereafter, if the Respondent has not sent a final
response to the complainant, she must update them on the progress of her consideration
of their complaint at least every 3 months thereafter.
12. This requirement is reflected in the Orders available to the Tribunal under s.
166(2). The Tribunal can make an Order requiring the Respondent to investigate or
conclude an investigation of a complaint if she has not done so (the ‘appropriate steps’
referred to in s. 166(2)(a)), or to provide the complainant with an update (s. 166(2)(b)).
13. The powers of the Tribunal in determining a s. 166 application are limited to those
set out in s. 166(2). In Order to exercise them, the Tribunal must be satisfied that the
Commissioner has failed to progress a complaint made to her under s. 165 DPA 2018.
The jurisdiction to make an Order is limited to circumstances in which there has been
a failure of the type set out in s. 166 (1) (a), (b) and (c).
The Evidence
14. I have considered carefully all of the documents provided by Mr Browne. He
accepted at today’s hearing that he has been notified of the outcome of his complaint
by the Commissioner, albeit that this did not take place until after the date of his
application.
15. His submissions today were that he made an application to the Tribunal on the
understanding that it had jurisdiction to consider whether the Commissioner’s
investigation was procedurally flawed. This understanding is reflected in his Notice of
Appeal and in his Reply to the Commissioner’s Response. It is apparent that Mr Browne
has put of lot of thought into these documents, for which I am very grateful.
Submissions
16. Mr Browne’s grounds are that the Commissioner has failed to comply with her
statutory obligations because her investigation was procedurally flawed.
17. The Commissioner accepts that her substantive response to Mr Browne’s
complaint fell outside the 3-month timeframe stipulated by the DPA. However, she
submits that she has since taken appropriate steps to respond to the Applicant’s
complaint and that there is no longer an Order for the Tribunal to make under s. 166.
Conclusion
18. I am satisfied that the Commissioner has taken appropriate steps to respond to Mr
Browne’s complaint. I find that, although the Commissioner’s initial substantive
response to the complaint was outside the 3-month statutory timeframe, she has since
4
remedied this oversight, has concluded her investigation, and informed Mr Browne of
the outcome on 20 January 2021.
19. As explained to Mr Browne today, the Tribunal has no jurisdiction to consider
either the way in which the Commissioner investigates a complaint, or the decision that
she reaches in respect of it. Any concerns Mr Browne may have about these issues must
be raised with the Commissioner directly.
20. Accordingly, I conclude that there is no basis for making an Order under s. 166(2)
DPA on the facts of this case, and that Mr Browne’s Application therefore has no
reasonable prospect of success.
21. For these reasons, the application is struck out under rule 8(3)(c).
(Signed)
JUDGE MOIRA MACMILLAN DATE: 19 March 2021
Date Promulgated: 22 March 2021
5