Appeal number: EA/2021/0153
P1
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
Information Rights
STUART FYFE Applicant
- and -
THE INFORMATION COMMISSIONER Respondent
Before:
JUDGE LYNN GRIFFIN
Sitting in Chambers on 6 August 2021
Determined on the papers with the consent of both parties. References to
numbers in square brackets such as [78] are to the page numbers in the
open bundle of documents.
DECISION
1. The application is struck out under rule 8(3)(c) of the Tribunal Procedure
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009, because there is
no reasonable prospect of the Applicant’s case succeeding.
1
P: paper determination which is not provisional
1
MODE OF HEARING
2. The Tribunal may make a decision without a hearing pursuant to rule 32
where that decision disposes of proceedings under rule 8 (striking out a party's
case).
3. Neither party has requested a hearing and both parties have had the
opportunity to respond to the other’s submissions. I am satisfied that it is fair
and just to proceed in this way.
REASONS
Factual Background to the Application
4. This application relates to a complaint made to the Respondent on 7
December 2020 by Mr Fyfe (the Applicant) which was given reference IC-
79887-M4C9.
5. The Applicant’s concern related to Cambridgeshire Constabulary [the
Police] and whether they were storing inaccurate information about him. [78]
The factual background goes back to 2014 and arising from circumstances
connected a planning dispute. It is not necessary to set out the detail of that
background.
6. The Applicant has explained that the circumstances have already given
rise to
a. proceedings in the High Court for judicial review of the planning
consent at issue in 20142
b. unsuccessful County Court proceedings in 2016-7 with reference
to the Data Protection Act 2018 to compel the Police to provide
details of the alleged complaint
c. a complaint by the Applicant to the Independent Office for Police
Conduct [IOPC] in 2018 which resulted in an investigation by the
Police. The Applicant has told the Tribunal that the investigation
found that the substance of the complaint made about the Applicant
had been recorded inaccurately. This was the third investigation by
the police which resulted in them identifying that the reference for
the incident file had been wrongly typed and so led to them believing
they held no further information
2
The outcome of which is not known but is not relevant to this decision
2
d. judicial review proceedings against the IOPC in relation to an
earlier decision not to investigate the Applicant’s complaint that
were conceded by the IOPC
e. a finding in 2018 by the Information Commissioner that the data
had been processed unlawfully3.
The Notice of Application and the Response
7. In his Notice of Application dated 17 June 2021 the Applicant sought an
order under section 166(2) and 166(3) of the Data Protection Act 2018 [DPA 18]
to direct a response from the Information Commissioner's Office ("ICO"). He
would like the First-tier Tribunal to make the following order:
“I wish the Tribunal to overturn the ICO decision notice and issue a substantive
decision or order another investigation which considers the facts.”
The Law
8. A data subject has a right to make a complaint to the Commissioner if they
consider that in connection with the processing of personal data relating to
them there is an infringement of the General Data Protection Regulation
[GDPR], and/or Parts 3 or 4 of the Data Protection Act 2018 [DPA18]: see
Article 77 GDPR, and section 165 (1) & (2) DPA18.
9. Under section 166 DPA18, a data subject has a right to make an application
to the Tribunal if they consider that the Commissioner has failed to take certain
procedural actions in relation to their complaint.
10. Section 166 DPA18 as relevant states:
(1) This section applies where, after a data subject makes a complaint under
section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on the
complaint, or of the outcome of the complaint, before the end of the period
of 3 months beginning when the Commissioner received the complaint, or
(c) if the Commissioner’s consideration of the complaint is not concluded
during that period, fails to provide the complainant with such information
during a subsequent period of 3 months.
3
This decision has not been seen by the tribunal but it is not necessary to do so for the purposes
of this decision
3
(2) The Tribunal may, on an application by the data subject, make an order
requiring the Commissioner—
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the
outcome of the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a period
specified in the order.
11. The reference to taking “appropriate steps” in section 166(1)(a) and (2)(a),
includes “investigating the subject matter of the complaint to the extent appropriate”
and “informing the complainant about progress on the complaints”, as set out in
sections 166(4) and 165(5) DPA18.
12. The reference to “provide the complainant with…. the outcome of the
complaint” in s. 166(1)(b) and 2(b) is not qualified with the word appropriate.
13. The Tribunal can only exercise powers given to it by Parliament as set out
in legislation. When considering an application under s. 166 the Tribunal is not
concerned with the merits or strength of the underlying complaint. Section 166
DPA18 does not provide a right of appeal against the substantive outcome of
an investigation into a complaint under s. 165 DPA18.
14. On an application under s. 166 DPA18 the Tribunal is limited to
considering whether to make an order of the kinds set out in s. 166(2) requiring
the Commissioner to
a. Take appropriate steps to respond to the complaint or
b. Inform the complainant of progress on the complaint or
c. Inform the complainant of the outcome of the complaint.
15. Those three steps are the steps that should be taken by the Commissioner
on receipt of a complaint. The second and third steps involve only the giving
of information.
16. Once the Information Commissioner has sent an outcome to the complaint
there is no longer an order for the Tribunal to make under s.166(2).
17. The powers of the Tribunal in determining such an appeal have been
considered by the Upper Tribunal in Leighton v Information Commissioner (No.2)
4
[2020] UKUT 23 (AAC) in which Upper Tribunal Judge Wikeley said at
paragraph 31
“Appropriate steps” mean just that, and not an “appropriate outcome”. Likewise,
the FTT’s powers include making an order that the Commissioner “take
appropriate steps to respond to the complaint”, and not to “take appropriate steps
to resolve the complaint”, least of all to resolve the matter to the satisfaction of
the complainant.
18. In the case of Scranage v Information Commissioner [2020] UKUT 196 (AAC)
the Upper Tribunal went further in saying:
“... there is a widespread misunderstanding about the reach of section 166.
Contrary to many data subjects’ expectations, it does not provide a right of appeal
against the substantive outcome of the Information Commissioner’s investigation
on its merits. Thus, section 166(1), which sets out the circumstances in which an
application can be made to the Tribunal, is procedural rather than substantive in
its focus. This is consistent with the terms of Article 78(2) of the GDPR (see
above). The prescribed circumstances are where the Commissioner fails to take
appropriate steps to respond to a complaint, or fails to update the data subject on
progress with the complaint or the outcome of the complaint within three months
after the submission of the complaint, or any subsequent three month period in
which the Commissioner is still considering the complaint.”.
19. These decisions of the Upper Tribunal are binding on the First Tier
Tribunal as to the approach that must be taken to applications such as this.
20. Mr Fyfe thought that this Tribunal had the power to consider an
application about the substantive outcome of the Information Commissioner’s
investigation. He is not alone in thinking that, as has been acknowledged by
the Upper Tribunal in the decision in Scranage, but the Tribunal is limited in
its powers to those given by Parliament as interpreted by the Upper Tribunal.
21. A person who wants a data controller (or processor) to rectify personal
data or otherwise properly comply with the Data Protection Act 2018 or
General Data Protection Regulations in relation to holding personal data must
go to the High Court or a County Court pursuant to section 180 of the Data
Protection Act 2018. I cannot advise the Applicant whether he can or should
make such an application as that is not the function of the Tribunal.
22. This Tribunal does not have an oversight function in relation to the
Information Commissioner’s Office and does not hold them to account for their
internal processes. The Parliamentary and Health Service Ombudsman is the
body which has that function. I cannot advise the Applicant whether he can or
should make an application to the PHSO.
5
23. In considering an application to strike out the test to be applied was
considered in the Upper Tribunal’s decision in HMRC v Fairford Group (in
liquidation) and Fairford Partnership Limited (in liquidation) [2014] UKUT
0329 (TCC), in which it is stated at paragraph 41 that
“…an application to strike out in the FTT under rule 8(3)(c) should be considered
in a similar way to an application under CPR 3.4 in civil proceedings (whilst
recognising that there is no equivalent jurisdiction in the First-tier to summary
judgement under Part 24). The Tribunal must consider whether there is a
realistic, as opposed to a fanciful (in the sense of it being entirely without
substance) prospect of succeeding on the issue at a full hearing…The Tribunal
must avoid conducting a “mini-trial”. As Lord Hope observed in Three Rivers
the strike out procedure is to deal with cases that are not fit for a full hearing at
all.”
The Facts
24. The Respondent took the following steps in relation to the complaint made
to her on 7 December 2020 by the Applicant. [78] The complaint was that the
Police had refused to rectify inaccurate data held on their system about him
and were still unlawfully processing the data.
a. On 9 December 2020 a case officer acknowledged the Applicant’s
e-mail. The Applicant was asked to provide copies of any
correspondence with the Police. [79]
b. On 22 December 2020 the Applicant sent an e-mail to the case
officer attaching copies of communication with the Police. [81 – 86]
c. On 1 April 2020 an ICO case officer sent an e-mail to the
Applicant to advise that the complaint had been assigned case
reference IC-79887-M4C9. The case officer ask the applicant whether
he had provided the Police with a copy of the IOPC’s outcome – a
document and whether the Applicant was willing to share a copy of
this report with the case officer in order. [87-8]
d. On 7 April 2020 the Applicant sent an e-mail to the case officer in
which he stated that the Police were “fully aware of the IOPC
decision notice”. The Applicant did not enclose a copy of the
outcome letter. [89]
e. On 21 April 2021 the case officer wrote to the Applicant
acknowledging his e-mail stating he was of the view that the Police
had complied with their Data Protection obligations because the
Police were correct in advising that they are unable to erase the
disputed information because the record reflects the incident as it
was reported at the time. [90 – 91]
6
f. On 21 April 2021 the Applicant sent e-mails expressing his
disagreement with the case officer’s decision. [92-94]
g. On 22 April 2021 the case officer sent an e-mail to the Applicant
explaining that the issues he had raised would be passed to a
reviewing officer who would send a response within 30 calendar
days. [95]
h. On 27 April 2021 the Applicant sent an e-mail to the case officer
outlining further considerations for the reviewing officer to consider.
[96]
i. On 13 May 2021 a reviewing officer sent an e-mail to the
Applicant. The reviewing officer stated that she was of the opinion
that the case officer had dealt with the complaint appropriately and
there was no further action that could be taken in the matter unless
further information was provided. The Applicant was advised of his
right to contact the Parliamentary and Health Service Ombudsman
if he was dissatisfied with the handling of his case by the
Commissioner. [ 97 – 95]
j. On 13 May 2021 the Applicant sent an e-mail expressing his
disagreement with the decision. [100]
k. On 16 May 2021 the Applicant sent an e-mail to the reviewing
officer in which he repeats his disagreement with the decision and
stating he will send “documentary proof” across for consideration.
[101]
l. On 19 May 2021 the reviewing officer acknowledged the
Applicant’s recent e-mails and asked the Applicant to provide some
additional information in order for him to consider the concern as
there was insufficient evidence provided by the Applicant to
demonstrate that the information being processed by the Police was
inaccurate. [102-3]
m. On 19 May 2021 the Applicant sent an e-mail to the reviewing
officer saying he had sent further material by special delivery to
enable the ICO to assess the matter further. [104] Those documents
were received on 24 May 2021 [106-171]
n. On 1 June 2021 the case officer sent an e-mail to the Applicant
acknowledging the additional supporting documents but setting out
that the position was unchanged and that the record of information
reflects the incident that was reported at the time as explained
previously. [172]
o. On 1 June 2021 the Applicant responded setting out his
disagreement with the decision. [173-4]
7
p. On 2 June 2021 the reviewing officer acknowledged the
Applicant’s e-mails and advised the Applicant that he had now
exhausted the case review process and no further consideration of
the issues raised would be undertaken. [175]
q. On 3 June 2021 the Applicant sent an e-mail to the reviewing
officer again setting out his disagreement with the decision. [177]
r. On 8 June 2021 the reviewing officer sent an e-mail to the
Applicant explaining that the Commissioner’s view in relation to this
case has been provided based on the information provided. The
Applicant was advised again of his right to contact the Parliamentary
and Health Service Ombudsman if he was dissatisfied with the
handling of his case by the Commissioner.[178]
25. I note that on 23 February 2021 the Police wrote to the Applicant to tell
him that they had taken steps to ensure the original and inaccurate record
would not be shared and that a duplicate file had been created to redacting the
allegation the Applicant complains about. [50]
Submissions
26. The Tribunal is grateful to the parties for their written submissions.
27. The Applicant submits that the Information Commissioner’s investigation
was incomplete and “cursory” and not in accordance with a previous
indication that it would be investigated [10 & 12]. He submits that the
respondent demonstrated bias towards him by failing to investigate as they
had all the required information and that their decision was unreasonable as it
took none of the evidence he had provided into account. He submits that the
Tribunal should order that the outcome of the complaint to the Respondent is
overturned and that another investigation is undertaken.
28. The Response dated 16 July 2021 [179] invites the Tribunal to strike out the
Applicant’s application because the tribunal has no jurisdiction to overturn the
Respondent’s decision notice, nor to order another investigation. In any event
it is suggested that there is no reasonable prospects of success as the
Commissioner has considered the evidence provided and advised the
Applicant of her findings in accordance with her statutory duties. The
Respondent submits that there is therefore no basis on which to make an order
under section 166(2) DPA18 in relation to that complaint.
29. The Respondent further submits that should the Applicant believe he has
grounds he could take his concern to the courts4.
4
i.e. the County Court or High Court – not the Tribunal
8
30. There is no dispute that the Respondent has provided the Applicant with
the outcome to her investigation. The Applicant disagrees with the outcome
and says that the Respondent placed too much weight on what she was told by
the Police and not enough weight on the material he provided. He says that the
Respondent did not make any investigation and relied on what they were told
by the Police. He submits that the Upper Tribunal authorities relied upon by
the Respondent do not prevent the Tribunal examining the extent of the
Respondent’s investigation and whether she has taken appropriate steps
31. Mr Fyfe asked that the tribunal consider the Respondent’s duties to inform
him about his appeal rights. He submits that the Respondents failed to inform
him of his appeal rights and this was a breach of their duty to do so. He submits
a. The ICO has a duty under section 165 (4) (c) DPA2018 , to inform
the complainant of their rights under section 166 of the same act.
b. This was not done in his case; he was not told of his right to
complain to the Parliamentary Health Service Ombudsman
c. The fact that he informed the Respondent he would appeal to the
tribunal did not negate their duty to inform him of his rights as
required by section 165(4)(c)
Conclusions
32. The Respondent has considered the Applicant’s complaint in case
reference IC-79887-M4C9, taken steps as outlined above and informed him of
the outcome.
33. The Applicant is not satisfied with that outcome and wishes it to be
reconsidered and his complaint reinvestigated but it is an outcome nonetheless.
34. This Tribunal has no power to make a decision about the merits of that
outcome, whether it be right or wrong, nor to compare it to any other decision
of the Commissioner. Neither does the Tribunal have power to examine
whether there should be further or different steps to those taken by the
Commissioner.
35.Furthermore, the Tribunal does not have any power to supervise or
mandate the performance of the Commissioner’s functions under schedule 13
DPA18.
36. There is subsequently no basis for the Tribunal to make an order under
section 166(2) DPA18.
37. In order for this application to go forward there must be a realistic, as
opposed to a fanciful or unrealistic, prospect of its success.
9
38. For the reasons set out above, I have concluded that this Tribunal would
not be able to provide the Applicant with the order he seeks and that therefore
the application has no reasonable prospect of success. In other words it is
hopeless.
39. Having taken account of all relevant considerations, I strike out this
application pursuant to 8(3)(c) of the Tribunal Procedure (First-tier Tribunal)
(General Regulatory Chamber) Rules 2009 because there is no reasonable
prospect of the application succeeding.
Tribunal Judge Lynn Griffin
2 September 2021
Promulgated Date: 7 September 2021
© CROWN COPYRIGHT 2021
10