Appeal number: EA/2021/0072/GDPR
P1
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
Information Rights
Neil White Applicant
- and -
Information Commissioner Respondent
Before:
JUDGE LYNN GRIFFIN
Determined on the papers, sitting in Chambers 28 May 2021
DECISION
1. Mr White’s application is struck out pursuant to rule 8(3)(c) of the Tribunal
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009, on
the grounds that there is no reasonable prospect of it succeeding.
1
P: paper determination which is not provisional
Appeal number EA/2021/0072/GDPR
MODE OF HEARING
2. The proceedings were due to be held by the cloud video platform on 28 May
2021. The notice of hearing was sent to the parties on 21 April 2021. The
Respondent had indicated that she did not propose to attend the hearing. The
Tribunal was ready to hear the case at 11am on 28 May 2021 but the Applicant
did not join the hearing. The Tribunal clerk made attempts to contact him by
telephone and email. No message was received from the Applicant so at 11.20
the CVP room was closed. At 11.40 an email was received from Mr White
saying that he apologised for not attending but he had “expected the matter to be
dealt with on papers only and not require attendance”.
3. The Tribunal may make a decision without a hearing pursuant to rule 32
where that decision disposes of proceedings under rule 8 (striking out a party's
case).
4. Having read all the documents including, the submissions of the
Respondent in her response and of the Applicant’s emails and attachments, I
am satisfied that the Applicant has received notice of the hearing and that it is
fair and just to proceed in this way.
REASONS
Factual Background to the Application
5. This application relates to a complaint made to the Respondent by Mr White
on 19 December 2020 about a request for data he made to the organisation
Doctor Care Anywhere Limited (“DCA”) on 4 August 2020. The data requested
related to his employment with this organisation.
6. The response from DCA had been that it would take 3 months to action the
request. At the point of his complaint to the Respondent Mr White said
“As of today, no response has been received and follow up emails have not been
answered. I am also concerned that my personal data was shared with a third party
organisation without my consent. There was no contractual reason that would have
allowed the transfer of personal information to the third party organisation. I am aware
that this organisation has had significant issues with keeping personal data secure and
2
Appeal number EA/2021/0072/GDPR
I feel that I have made reasonable requests and do not understand why they have been
ignored.”
7. Subsequent to his complaint to the ICO the Applicant sent another e-mail
to the Commissioner, on 24 January 2021, which said he would like to include
additional information in relation to the subject access request (“SAR”) and
secondly that DCA transferred his personal information to a third party
organisation without his knowledge. He sent an email chasing a response on
17 February 2021.
8. The complaint was later allocated case reference IC-79571-N6L1 by the
Respondent.
The Application to the Tribunal
9. In the notice of application to this Tribunal, dated 8 March 2021 the
Applicant asked for assistance in receiving a response from the ICO, none
having been received by him at that time.
10. The Applicant said that he would like the following remedy from the
Tribunal “... a ruling on the behaviour of the organisation from the ICO”. He
acknowledges in his submissions that he is not seeking to overturn the decision
but asks the tribunal to “... ensure the Commissioner fairly considered the complaint
and did so against all its established frameworks to the appropriate extent intended by
the statute.”
11. The application was interpreted by the Tribunal as an application under
section 166 Data Protection Act 2018.
12. The Applicant is a litigant in person. Having regard to the Equal Treatment
Benchbook and to the overriding objective, I have carefully considered the
documents to examine whether there is any other remedy that the Tribunal has
power to provide.
13. In the response to the application the Information Commissioner invited the
Applicant to withdraw the application because he had received an outcome to
her complaint.
14. That outcome was provided on 18 March 2021 and dealt with both aspects
of the concerns raised in the initial complaint to the Respondent and his later
email of 24 January 2021. This outcome was reconsidered in the light of further
3
Appeal number EA/2021/0072/GDPR
material provided by the Applicant but was not altered, see the respondent’s
email of 24 March 2021.
15. In the event the applicant did not withdraw his application, the
Information Commissioner has applied for this case to be struck out pursuant
to rule 8(3)(a) of the Tribunal Procedure (First-tier Tribunal) (General
Regulatory Chamber) Rules 2009. It is argued that as there has been an outcome
provided to the Applicant, the Tribunal no longer has any power to make an
order under s166 and thus the application has no reasonable prospect of
succeeding.
16. The Applicant not having withdrawn his appeal, I now consider the
application to strike out these proceedings on the basis that they have no
reasonable prospects of success.
The powers of the Tribunal in s166 applications
17. Since the Data Protection Act 2018 came into force a person can apply to this
Tribunal for an “order to progress complaints” under section 166.
18. A data subject has a right to make a complaint to the Commissioner if they
consider that, in connection with the processing of personal data relating to
them, there is an infringement of the General Data Protection Regulations
[GDPR], and/or Parts 3 or 4 of the Data Protection Act 2018: see Article 77
GDPR, and section 165 (1) & (2) Data Protection Act 2018.
19. Under section 166 Data Protection Act 2018, a data subject has a right to
make an application to the Tribunal if they consider that the Commissioner has
failed to take certain procedural actions in relation to their complaint.
20. Section 166 DPA18 as relevant states:
166 (1) This section applies where, after a data subject makes a complaint
under section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on
the complaint, or of the outcome of the complaint, before the end of the
period of 3 months beginning when the Commissioner received the
complaint, or
4
Appeal number EA/2021/0072/GDPR
(c) if the Commissioner’s consideration of the complaint is not
concluded during that period, fails to provide the complainant with
such information during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order
requiring the Commissioner—
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the
outcome of the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a
period specified in the order.
21. The Tribunal can only exercise powers given to it by Parliament as set out
in legislation. When considering an application under s.166 the Tribunal is not
concerned with the merits or strength of the underlying complaint.
22. Section 166 Data Protection Act 2018 does not provide a right of appeal
against the substantive outcome of an investigation into a complaint under
s.165 Data Protection Act 2018. Mr White does not seek that remedy in any
event.
23. On an application under s.166 Data Protection Act 2018 the Tribunal is
limited to considering whether to make an order of the kinds set out in s.166(2).
Once the Information Commissioner has provided an outcome to the complaint
there is no longer an Order for the Tribunal to make under s.166(2).
24. The powers of the Tribunal in considering such applications have been
considered by the Upper Tribunal. These cases are binding on the First Tier
Tribunal of which the General Regulatory Chamber is a part.
25. In Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC) Upper
Tribunal Judge Wikeley said at paragraph 31
“Appropriate steps” mean just that, and not an “appropriate outcome”.
Likewise, the FTT’s powers include making an order that the Commissioner
“take appropriate steps to respond to the complaint”, and not to “take
5
Appeal number EA/2021/0072/GDPR
appropriate steps to resolve the complaint”, least of all to resolve the matter to
the satisfaction of the complainant.”
26. Further in the case of Scranage v Information Commissioner [2020] UKUT 196
(AAC) the Upper Tribunal went further in saying :
“... there is a widespread misunderstanding about the reach of section 166.
Contrary to many data subjects’ expectations, it does not provide a right of
appeal against the substantive outcome of the Information Commissioner’s
investigation on its merits. Thus, section 166(1), which sets out the
circumstances in which an application can be made to the Tribunal, is
procedural rather than substantive in its focus. This is consistent with the terms
of Article 78(2) of the GDPR (see above). The prescribed circumstances are
where the Commissioner fails to take appropriate steps to respond to a
complaint, or fails to update the data subject on progress with the complaint or
the outcome of the complaint within three months after the submission of the
complaint, or any subsequent three month period in which the Commissioner is
still considering the complaint.”
27. The Tribunal does not have the power to consider the fairness or adequacy
of the process once an outcome to the complaint has been provided. The
Tribunal is not empowered to undertake a judicial review of the decision-
making process. That may be a remedy available from the courts, but it is not
for the Tribunal to advise the Applicant whether that is a course open to him
and he should take independent legal advice about whether he can or should
make any such application.
28. A person who wants a data controller (or processor) to rectify personal data,
compensate them, or otherwise properly comply with the Data Protection Act
2018 or General Data Protection Regulations in relation to personal data must
go to the civil courts2 not a tribunal pursuant to sections 167-169 & 180 of the
Data Protection Act 2018. I express no opinion one way or another about
whether the Applicant can do so, or whether he should do so; that is a matter
for him, about which this Tribunal cannot advise him.
29. This Tribunal does not have an oversight function in relation to the
Information Commissioner’s Office and does not hold them to account for their
2
High Court or County Court
6
Appeal number EA/2021/0072/GDPR
internal processes. The Parliamentary and Health Service Ombudsman3 is the
body which has that function. I express no opinion one way or another about
whether she can or whether she should raise the issue with the Ombudsmen;
again, that is a matter for her, about which this Tribunal cannot advise her.
Analysis
30. The legal principles limiting the powers of the Tribunal in this case, can be
distilled as follows; once an outcome to his complaint was provided to the
Applicant then the Tribunal has no further power to direct steps be taken, the
complaint reinvestigated or to consider whether the outcome provided was
correct as a matter of law or fact.
31. The Applicant was provided with a response to his complaint on 18 March
2021 and this outcome was reconsidered in the light of further information he
provided. The Applicant does not agree with the outcome; he seeks a review of
the fairness of the process. This Tribunal has no power to consider an appeal
against the Information Commissioner’s substantive findings whether that be
the conclusion reached or the way in which that decision was taken by the
Information Commissioner.
Conclusion
32. Turning to s166 DPA18, and this application, the Respondent has
considered the Applicant’s complaint in case reference IC-79571-N6L1, and
informed him of the outcome.
33. The Applicant is not satisfied with that outcome and wishes it to be subject
to procedural review but it is, nonetheless, an outcome.
34. This Tribunal has no power to make a decision about the merits of that
outcome, whether it be right or wrong. Neither does the Tribunal have power
to examine whether there should be further or different steps to those taken by
the Commissioner. This is the case regardless of the nature of the complaint
made or its evidential basis.
35. Furthermore, the Tribunal does not have any power to supervise or
mandate the performance of the Commissioner’s functions.
3
Parliamentary and Health Service Ombudsman (PHSO)
7
Appeal number EA/2021/0072/GDPR
36. There is subsequently no basis for the Tribunal to make an order under
section 166(2) DPA18.
37. Having considered whether this tribunal could provide the Applicant with
any other remedy I have concluded that while there may be a remedy available
from the courts or PHSO (about which I make no conclusions or give any
indication) having considered the nature of the issues raised by the Applicant
there is no other remedy available from this Tribunal in relation to the
application made on 8 March 2021.
38. In order for this application to proceed there must be a realistic prospect of
its success. For the reasons set out above, I have concluded that this Tribunal
would not be able to provide the outcome sought and that therefore the
application is hopeless, or in other words has no reasonable prospect of success.
39. I know this decision will be a disappointment to Mr White however, this
Tribunal can only act within the scope of its power and cannot provide him
with the remedy he seeks.
40. Having taken account of all relevant considerations, I strike out this
application pursuant to 8(3)(c) of the Tribunal Procedure (First-tier Tribunal)
(General Regulatory Chamber) Rules 2009 because there is no reasonable
prospect of the application succeeding.
Date: 28 May 2021
Lynn Griffin
Tribunal Judge
© CROWN COPYRIGHT 2021
8