Appeal number: EA/2021/0117
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
Information Rights
Tahirah Pirmohamed Applicant
- and -
Information Commissioner Respondent
Before:
JUDGE LYNN GRIFFIN
Appearances:
Applicant in person
DECISION
Ms Pirmohamed’s application is struck out pursuant to rule 8(3)(c) of the
Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules
2009, on the grounds that there is no reasonable prospect of it succeeding.
REASONS
The Application to the Tribunal
1. The proceedings were held by video hearing on 21 September 2021; the
decision was given at that hearing. This is a written version of the decision that
was delivered orally at the hearing. The Respondent had indicated that she did
not intend to participate in the hearing. The Tribunal was satisfied that it was
fair and just to conduct the hearing in this way.
2. On 3 December 2019 the Applicant complained to the Information
Commissioner about an organization that she said held inaccurate personal
data about her and had shared that data with a third party. The Applicant’s
complaint was allocated case reference RFA0895327.
3. After corresponding with the applicant and the organisation the respondent
wrote to the applicant on 11 September 2020. The case officer stated that she
did not consider it appropriate or necessary to pursue further action with
Babcock, and confirmed that she had provided Babcock with advice regarding
their wider information rights practices, the case officer expressed her
conclusion that she was satisfied that Babcock were putting things right.
4. On 13 November 2020 the Applicant submitted a request for a case review.
5. On 18 December 2020 the respondent acknowledged receipt of the request
for a case review which was allocated case reference IC-71083-G9B0.
6. On 16 January 2021 and 27 January 2021 the Applicant wrote to the case
officer to request a response to her request for a case review.
7. On 30 April 2021 the applicant sent her notice of application to the tribunal
8. On 13 May 2021 an ICO reviewing officer wrote to the Applicant with a
response to her case review request. The reviewing officer stated that she had
reviewed the points raised by the Applicant and had reviewed the relevant
information held regarding the concern. The reviewing officer said that she was
satisfied that the complaint was handled appropriately and in line with case
handling procedures. The reviewing officer said that, having reviewed the
matter, she agreed with the case officer’s explanations provided to the
applicant and agreed with the steps taken by the case officer.
2
9. In the notice of application the Applicant said that they would like the
following remedies from the Tribunal
a. Investigation into the GDPR breach
b. Holding inaccurate personal and medical data without consent
c. Passing this inaccurate data to a third party without consent
d. Failure to investigate this matter when raised
e. Dismissing their obligation to adhere to GDPR
f. Fine for the organisation
g. Compensation for the failures and breach
10. The application was interpreted by the Tribunal as an application under
section 166 Data Protection Act 2018 [DPA18].
11. In the response to the application the Information Commissioner invited the
Applicant to withdraw her application because she had received a response to
her request for a case review but in the event she did not do so,] the Information
Commissioner has applied for this case to be struck out pursuant to rule 8(3)(a)
of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber)
Rules 2009. It was argued that as there has been an outcome provided to the
Applicant, the Tribunal no longer has any power to make an order under s166
and thus her application has no reasonable prospect of succeeding.
12. The Applicant not having withdrawn her appeal I considered the
application to strike out these proceedings on the basis that they have no
reasonable prospects of success.
13. At the hearing Ms Pirmohamed explained that she felt she had done
everything she could as regards the organisation and that she felt the
respondent’s approach had been dismissive of her concerns about her personal
data. She noted that the respondent had only provided the response to the case
review after she had contacted the tribunal. She did not agree with the outcome
of the respondent’s investigation or the method with which they reached it.
The powers of the Tribunal in s166 applications
14. Since the DPA18 came into force a person can apply to this Tribunal for an
“order to progress complaints” under section 166.
3
15. Under section 166 DPA18, a data subject has a right to make an application
to the Tribunal if they consider that the Commissioner has failed to take certain
procedural actions in relation to their complaint.
16. Section 166 DPA18 as relevant states:
166 (1) This section applies where, after a data subject makes a complaint
under section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on
the complaint, or of the outcome of the complaint, before the end of the
period of 3 months beginning when the Commissioner received the
complaint, or
(c) if the Commissioner’s consideration of the complaint is not
concluded during that period, fails to provide the complainant with
such information during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order
requiring the Commissioner—
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the
outcome of the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a
period specified in the order.
17. The powers of the Tribunal in considering such applications have been
considered by the Upper Tribunal. These cases are binding on the First Tier
Tribunal of which the General Regulatory Chamber is a part. 1
18. In Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC) Upper
Tribunal Judge Wikeley said at paragraph 31
“Appropriate steps” mean just that, and not an “appropriate outcome”.
Likewise, the FTT’s powers include making an order that the Commissioner
“take appropriate steps to respond to the complaint”, and not to “take
1
The latest decision is that of Killock and Veal & others v Information Commissioner & others, published
since the decision was given in this case in which the Upper Tribunal reviewed the case law including
the following cases and approved the approach taken therein.
4
appropriate steps to resolve the complaint”, least of all to resolve the matter to
the satisfaction of the complainant.”
19. Further in the case of Scranage v Information Commissioner [2020] UKUT 196
(AAC) the Upper Tribunal went further in saying :
“... there is a widespread misunderstanding about the reach of section 166. Contrary to
many data subjects’ expectations, it does not provide a right of appeal against the
substantive outcome of the Information Commissioner’s investigation on its merits.
Thus, section 166(1), which sets out the circumstances in which an application can be
made to the Tribunal, is procedural rather than substantive in its focus. This is
consistent with the terms of Article 78(2) of the GDPR (see above). The prescribed
circumstances are where the Commissioner fails to take appropriate steps to respond to
a complaint, or fails to update the data subject on progress with the complaint or the
outcome of the complaint within three months after the submission of the complaint, or
any subsequent three month period in which the Commissioner is still considering the
complaint.”
20. The Tribunal is limited in its powers to those given by Parliament as
interpreted by the Upper Tribunal. The First tier Tribunal does not have power
to make a decision on the merits of the complaint, and this Tribunal will not
interfere with an exercise of regulatory judgement without good reason.
21. Furthermore, a person who wants a data controller (or processor) to rectify
personal data, compensate them, or otherwise properly comply with the Data
Protection Act 2018 or General Data Protection Regulations in relation to
personal data must go to the civil courts2 not a tribunal pursuant to sections
167-169 & 180 of the Data Protection Act 2018. I express no opinion one way or
another about whether the Applicant can do so, or whether they should do so;
that is a matter for the Applicant, about which this Tribunal cannot give advice.
22. This Tribunal does not have an oversight function in relation to the
Information Commissioner’s Office and does not hold them to account for their
internal processes. The Parliamentary and Health Service Ombudsman3 is the
body which has that function. I express no opinion one way or another about
whether this applicant can or whether they should raise the issue with the
2
High Court or County Court
3
Parliamentary and Health Service Ombudsman (PHSO)
5
Ombudsmen; again, that is a matter for the applicant, about which this Tribunal
cannot advise her.
Analysis and conclusions
23. The Applicant was provided with an outcome to their complaint on 11
September 2020 and this outcome was reviewed and upheld under the
Respondent’s case review process on 13 May 2021. The Applicant does not
agree with the outcome, but as explained at the hearing, this Tribunal has no
power to consider an appeal against the Information Commissioner’s
substantive findings.
24. The Tribunal has no power to do what the Applicant is asking for; by the
time of this application Ms Pirmohamed had received all that which this
tribunal could order under s166(2) DPA18.
25. This Tribunal has no power to make a decision about the merits of that
outcome, whether it be right or wrong. This is the case regardless of the nature
of the complaint made or its evidential basis. The quality, adequacy or merits
of the outcome fall outside the scope of s.166 and outside the jurisdiction of this
Tribunal. Furthermore, the Tribunal does not have any power to supervise or
mandate the performance of the Commissioner’s functions.
26. There is subsequently no basis for the Tribunal to make an order under
section 166(2) DPA18.
27. Having considered whether this tribunal could provide the Applicant with
any other remedy I have concluded that while there may be a remedy available
from the courts (about which I make no conclusions or give any indication)
there is no other remedy available from this Tribunal in relation to this
application.
28. In order for this application to proceed there must be a realistic prospect of
its success. For the reasons set out above, I have concluded that this Tribunal
would not be able to provide the outcome(s) sought and that therefore the
application is hopeless, or in other words has no reasonable prospect of success.
29. Having taken account of all relevant considerations, and heard from the
applicant orally I decided to strike out this application pursuant to 8(3)(c) of
6
the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber)
Rules 2009 because there was no reasonable prospect of the application
succeeding.
Tribunal Judge Lynn Griffin
28 September 2022
Promulgation Date - 30 September
2022
7