Appeal number: EA/2021/0140/GDPR
V1
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
Information Rights
ERIC PRIEZKALNS Applicant
- and -
THE INFORMATION COMMISSIONER Respondent
Before:
JUDGE LYNN GRIFFIN
Appearances:
Applicant in person
Determined at a remote hearing by Cloud Video Platform
DECISION
1. The application is struck out under rule 8(3)(c) of the Tribunal Procedure
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009, because there is
no reasonable prospect of the Applicant’s case succeeding.
MODE OF HEARING
2. The proceedings were held by video hearing. The Applicant joined
remotely by video and there was no issue with the quality of communication
that impeded the communication between the judge and the Applicant. The
1
V: video (all remote)
EA/2021/0140/GDPR
Respondent had indicated that she did not intend to participate in the hearing.
The Tribunal was satisfied that it was fair and just to conduct the hearing in
this way.
3. At the end of the hearing, I reserved judgement. This decision is made as
soon as possible after the publication of the decision in Killock & others v
Information Commissioner, see below, which was the Upper Tribunal case that I
had drawn the Applicant’s attention to. I apologise for the length of time that
it has taken to resolve the application.
REASONS
Factual Background to the Application
4. This application relates to a complaint made to the Respondent by Mr
Priezkalns [the Applicant] concerning how an organisation based in the USA
had processed his (and others) personal data by allowing access by the
participants in webinars to the email addresses of every other participant. The
Applicant was provided with over 1,600 email addresses collated by the
organisation which is offering attendance at the webinars internationally. He
had not been warned that his email address would be shared with the other
participants.
5. The Applicant made the complaint to the Respondent on 1 February 2021.
He followed up his complaint on 5 March 2021 and 26 March 2021 as he had
not received any reply apart from an automated email acknowledgement.
Having not received any response on three separate occasions he decided to
make an application to the Tribunal.
The Notice of Application and the Response
6. In his Notice of Application dated 2 June 2021 the Applicant sought an
order under section 166(2) and 166(3) of the Data Protection Act 2018 to direct
a response from the Information Commissioner's Office ("ICO"). He said he
would like the First-tier Tribunal to make an order that the Information
Commissioner provides a written response to his complaint “instead of
choosing to ignore it”.
7. Before making their response to the application the Respondent sent the
Applicant a response to his complaint by email on 16 June 2021. The
2
EA/2021/0140/GDPR
Applicant’s complaint had been allocated case reference IC-86495-Y7L2. The
case officer told the Applicant that there was insufficient evidence of the data
protection concerns but should he provide more material, then the case officer
would contact the organisation to remind them of their obligations.
8. The Applicant wrote to the Respondent on 16 June 2021 to request they
internally review their response to his complaint. He reminded the Respondent
that he had not been asked for any documentation and provided further
evidence
9. The Response dated 24 June 2021 invites the Applicant to withdraw his
application or, if he does not, asks the Tribunal to strike out this application.
10. The Applicant not having withdrawn his application the matter was listed
for hearing of the application to strike out.
11. On 30 June 2021 the Respondent wrote with the outcome of their internal
review of the outcome of the Applicant’s complaint. In their email it was stated
that the documentation provided does not constitute evidence of infringement,
in particular because it was insufficient to ascertain that the organisation was
“offering services to natural people in the UK”. The Respondent said she had
no further scope for regulatory action and drew the Applicant’s attention to
where he might make a complaint.
The Law - The powers of the Tribunal in s166 applications
12. Since the DPA18 came into force a person can apply to this Tribunal for an
“order to progress complaints” under section 166.
13. A data subject has a right to make a complaint to the Commissioner if they
consider that, in connection with the processing of personal data relating to
them, there is an infringement of the General Data Protection Regulations
[GDPR] (now the UKGDPR in effect since 31 December 2020), and/or Parts 3
or 4 of the DPA18: see Article 77 [UK]GDPR, and section 165 (1) & (2) DPA18.
14. Under section 166 DPA18, a data subject has a right to make an application
to the Tribunal if they consider that the Commissioner has failed to take certain
procedural actions in relation to their complaint.
15. Section 166 DPA18 as relevant states:
166 (1) This section applies where, after a data subject makes a complaint
under section 165 or Article 77 of the GDPR, the Commissioner—
3
EA/2021/0140/GDPR
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on
the complaint, or of the outcome of the complaint, before the end of the
period of 3 months beginning when the Commissioner received the
complaint, or
(c) if the Commissioner’s consideration of the complaint is not
concluded during that period, fails to provide the complainant with
such information during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order
requiring the Commissioner—
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the
outcome of the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a
period specified in the order.
16. The powers of the Tribunal in considering such applications have been
considered by the Upper Tribunal. These cases are binding on the First Tier
Tribunal of which the General Regulatory Chamber is a part. The latest decision
is that of Killock and Veal & others v Information Commissioner GI/113/2021 &
others in which the Upper Tribunal reviewed the case law including the
following cases and approved the approach taken therein.
17. In Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC) Upper
Tribunal Judge Wikeley said at paragraph 31
“Appropriate steps” mean just that, and not an “appropriate outcome”.
Likewise, the FTT’s powers include making an order that the Commissioner
“take appropriate steps to respond to the complaint”, and not to “take
appropriate steps to resolve the complaint”, least of all to resolve the matter to
the satisfaction of the complainant.”
18. Further in the case of Scranage v Information Commissioner [2020] UKUT 196
(AAC) the Upper Tribunal went further in saying:
4
EA/2021/0140/GDPR
“... there is a widespread misunderstanding about the reach of section 166.
Contrary to many data subjects’ expectations, it does not provide a right of
appeal against the substantive outcome of the Information Commissioner’s
investigation on its merits. Thus, section 166(1), which sets out the
circumstances in which an application can be made to the Tribunal, is
procedural rather than substantive in its focus. This is consistent with the terms
of Article 78(2) of the GDPR (see above). The prescribed circumstances are
where the Commissioner fails to take appropriate steps to respond to a
complaint, or fails to update the data subject on progress with the complaint or
the outcome of the complaint within three months after the submission of the
complaint, or any subsequent three month period in which the Commissioner is
still considering the complaint.”
19. The Tribunal is limited in its powers to those given by Parliament as
interpreted by the Upper Tribunal. As stated in Killock v IC by Mrs Justice
Farbey
74. The remedy in s.166 is limited to the mischiefs identified in s.166(1). We agree
with Judge Wikeley’s conclusion in Leighton (No 2) that those are all procedural
failings. They are (in broad summary) the failure to respond appropriately to a
complaint, the failure to provide timely information in relation to a complaint
and the failure to provide a timely complaint outcome. We do not need to go
further by characterising s.166 as a “remedy for inaction” which we regard as an
unnecessary gloss on the statutory provision. It is plain from the statutory words
that, on an application under s.166, the Tribunal will not be concerned and has
no power to deal with the merits of the complaint or its outcome.
20. The Upper Tribunal went on to say that the First tier Tribunal should firmly
resist any attempt to divert it towards a decision on the merits of the complaint,
paragraph 74.
21. This Tribunal may consider whether a step is appropriate; the Information
Commissioner’s view on this will not be determinative but should be taken into
account by this Tribunal and accorded due weight given the Commissioner is
an expert regulator in the best position to decide what investigations she
should undertake into any particular issue and how she should do so. This
Tribunal will not interfere with an exercise of regulatory judgement without
good reason. See Killock paras 84 to 86.
5
EA/2021/0140/GDPR
22. The appropriateness of any investigative steps taken is an objective matter
which is within the jurisdiction of this Tribunal. However, as stated in
paragraph 87 of Killock, s.166 is a forward-looking provision, concerned with
remedying ongoing procedural defects that stand in the way of the timely
resolution of a complaint.
23. This Tribunal is tasked with specifying appropriate “steps to respond” and
not with assessing the appropriateness of a response that has already been
given. It will do so in the context of securing the progress of the complaint in
question. It may be possible to wind back the clock and to make an order for an
appropriate step to be taken in response to the complaint under s.166(2)(a).
However, if invited to do so this Tribunal will cast a critical eye to assure itself
that the complainant is not using the s.166 process to achieve a different
complaint outcome.
24. Moreover, the Upper Tribunal said in Killock that if the Commissioner goes
outside her statutory powers or makes any other error of law, it is for the High
Court to correct her on ordinary public law principles in judicial review
proceedings. The assessment of the appropriateness of a response already
given is for the High Court and not this Tribunal. The combination of a
statutory remedy in the Tribunal in relation to procedures and to the
supervision of the High Court in relation to substance provides appropriate
and effective protection to individuals.
25. Furthermore, a person who wants a data controller (or processor) to rectify
personal data, compensate them, or otherwise properly comply with the Data
Protection Act 2018 or General Data Protection Regulations in relation to
personal data must go to the civil courts2 not a tribunal pursuant to sections
167-169 & 180 of the Data Protection Act 2018. I express no opinion one way or
another about whether the Applicant can do so, or whether they should do so;
that is a matter for the Applicant, about which this Tribunal cannot give advice.
26. This Tribunal does not have an oversight function in relation to the
Information Commissioner’s Office and does not hold them to account for their
internal processes. The Parliamentary and Health Service Ombudsman3 is the
body which has that function. The applicant had not made any application by
2
High Court or County Court
3
Parliamentary and Health Service Ombudsman (PHSO)
6
EA/2021/0140/GDPR
the time of the hearing. Again, I express no opinion one way or another about
whether the Applicant can do so, or whether they should do so; that is a matter
for the Applicant, about which this Tribunal cannot give advice.
27. In considering an application to strike out the test to be applied was
considered in the Upper Tribunal’s decision in HMRC v Fairford Group (in
liquidation) and Fairford Partnership Limited (in liquidation) [2014] UKUT 0329
(TCC), in which it is stated at paragraph 41 that
“…an application to strike out in the FTT under rule 8(3)(c) should be considered in a
similar way to an application under CPR 3.4 in civil proceedings (whilst recognising
that there is no equivalent jurisdiction in the First-tier to summary judgement under
Part 24). The Tribunal must consider whether there is a realistic, as opposed to a
fanciful (in the sense of it being entirely without substance) prospect of succeeding on
the issue at a full hearing…The Tribunal must avoid conducting a “mini-trial”. As
Lord Hope observed in Three Rivers the strike out procedure is to deal with cases that
are not fit for a full hearing at all.”
Submissions
28. The Tribunal is grateful to the parties for their written submissions
provided for the hearing and to the Applicant for his oral submissions. Having
read the bundle, read all the written submissions, and heard oral submissions,
I reserved judgment on the application.
29. The Applicant disagrees with the Commissioner that there is no need for
further consideration. He makes the following points to support his application
under s.166 which are summarised here with no disrespect to the helpful way
in which they were presented to me at the hearing
a. The Commissioner has not investigated the complaint adequately or
at all
b. The Commissioner has failed to investigate the subject matter of his
complaint to the extent appropriate; he submits that the
investigation was superficial and not performed in accordance
with the Respondent’s powers or duties
c. The response to his complaint was only provided due to the
intervention of the Tribunal and was not performed in a timely
manner
7
EA/2021/0140/GDPR
Analysis and Conclusions
30. Turning to s166 DPA18, the Respondent has considered the Applicant’s
complaint in case reference IC-86495-Y7L2 and informed him of the outcome;
albeit regrettably after the application was lodged with this Tribunal.
31. As pointed out in the case of Killock the Commissioner has the
institutional competence and is in the best position to decide what
investigations she should undertake into any particular issue, and how she
should conduct those investigations, her decisions about these matters will be
informed not only by the nature of the complaint itself but also by a range of
other factors such as her own regulatory priorities, other investigations in the
same subject area and her judgment on how to deploy her limited resources
most effectively. The Tribunal cannot simply substitute its own view.
32. In any event the Upper Tribunal have clearly stated that s166 is a provision
that is concerned with remedying ongoing defects that impede resolution of a
complaint rather than assessing the appropriateness of an outcome of a
complaint.
33. The Applicant is not satisfied with the outcome he was provided with on
16 June 2021 [and later confirmed on internal review] because he says the
investigation was not adequate and wishes it to be reconsidered but it is an
outcome, nonetheless. To draw from and apply the principles in the Killock
case he is seeking to turn back the clock in order to potentially change the
outcome and that is not permitted.
34. This Tribunal has no power to decide about the merits of that outcome,
whether it be right or wrong. This is the case regardless of the nature of the
complaint made or the strength of its evidential basis. The quality, adequacy or
merits of the complaints made by the Applicant about the outcome fall outside
the scope of s.166 and thus outside the jurisdiction of this Tribunal.
35.Furthermore, the Tribunal does not have any power to supervise or
mandate the performance of the Commissioner’s functions as explained above.
36. There is subsequently no basis for the Tribunal to make an order under
section 166(2) DPA18. By the time of this application Mr Priezkalns had
received all that which this Tribunal could order under s166(2) DPA18. He
remains dissatisfied with the service of the Information Commissioner, but his
concerns go to the underlying merits of the outcome rather than the forward-
looking procedural matters that this Tribunal may deal with.
37. Having considered whether this Tribunal could provide the Applicant
with any other remedy I have concluded that while there may be a remedy
8
EA/2021/0140/GDPR
available from the Civil Courts (about which I make no conclusions or give any
indication) having considered the nature of the issues raised there is no other
remedy available from this Tribunal in relation to his application.
38. In order for this application to proceed there must be a realistic prospect
of its success. For the reasons set out above, I have concluded that this
application is hopeless, or in other words has no reasonable prospect of success.
39. Having taken account of all relevant considerations, I strike out this
application pursuant to 8(3)(c) of the Tribunal Procedure (First-tier Tribunal)
(General Regulatory Chamber) Rules 2009 because there is no reasonable
prospect of the application succeeding.
Tribunal Judge Lynn Griffin
11 January 2022
Promulgated : 11 January 2022
9