Appeal number: EA/2021/0172/GDPR
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
Information Rights
MOHAMED AHMED Applicant
- and -
THE INFORMATION COMMISSIONER Respondent
Before:
JUDGE LYNN GRIFFIN
Sitting in Chambers on 27 July 2021
DECISION
The application is struck out under rule 8(2) of the Tribunal Procedure (First-
tier Tribunal) (General Regulatory Chamber) Rules 2009, because the Tribunal
does not have jurisdiction to deal with the proceedings and declines to
transfer the case to another court or tribunal.
REASONS
Background to the Application
1. This application relates to a complaint made by the Applicant to the
Respondent about the data handling of Greater Manchester Police [GMP].
The Notice of Application and the Response
2. By Notice of Application dated 8 July 2021 the Applicant sought the
Applicant seeks the following remedies
A) I would like the ICO to write me a confirmation that:
1- GMP has breached my data protection act for not responding to my complaint
within the lawful timeframe.
1
2- GMP has breached my Data protection rights for disclosing false/inaccurate/
fabricated information to a third party about me.
3- GMP has breached my Data protection rights for disclosing my [sensitive]
personal information to a third party without my consent or permission.
B) I would like also the ICO to take the appropriate action set by the law against
the GMP's data breach.
3. In directions dated 9 July 2021 Registrar Bamawo set out the Tribunal’s
powers to make an order under section 166(2) and 166(3) of the Data Protection
Act 2018 to direct a response from the Information Commissioner's Office
("ICO") and invited the applicant to make submissions as to what power he
believes this Tribunal has the to deal with this matter or make the order he
seeks, by no later than 23 July 2021. Thereafter the Registrar warned the
Applicant that the Tribunal may strike out the application.
4. The Tribunal has not received any submissions from the Applicant.
The Law
5. A data subject has a right to make a complaint to the Commissioner if they
consider that in connection with the processing of personal data relating to
them there is an infringement of the General Data Protection Regulation
[GDPR], and/or Parts 3 or 4 of the Data Protection Act 2018 [DPA18]: see
Article 77 GDPR, and section 165 (1) & (2) DPA18.
6. Under section 166 DPA18, a data subject has a right to make an application
to the Tribunal if they consider that the Commissioner has failed to take certain
procedural actions in relation to their complaint.
7. Section 166 DPA18 as relevant states:
(1) This section applies where, after a data subject makes a complaint under
section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on the
complaint, or of the outcome of the complaint, before the end of the period
of 3 months beginning when the Commissioner received the complaint, or
(c) if the Commissioner’s consideration of the complaint is not concluded
during that period, fails to provide the complainant with such information
during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order
requiring the Commissioner—
2
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the
outcome of the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a period
specified in the order.
8. The reference to taking “appropriate steps” in section 166(1)(a) and (2)(a),
includes “investigating the subject matter of the complaint to the extent appropriate”
and “informing the complainant about progress on the complaints”, as set out in
sections 166(4) and 165(5) DPA18.
9. The reference to “provide the complainant with…. the outcome of the
complaint” in s. 166(1)(b) and 2(b) is not qualified with the word appropriate.
10. The Tribunal can only exercise powers given to it by Parliament as set out
in legislation. When considering an application under s. 166 the Tribunal is not
concerned with the merits or strength of the underlying complaint. Section 166
DPA18 does not provide a right of appeal against the substantive outcome of
an investigation into a complaint under s. 165 DPA18.
11. On an application under s. 166 DPA18 the Tribunal is limited to
considering whether to make an order of the kinds set out in s. 166(2) requiring
the Commissioner to
a. Take appropriate steps to respond to the complaint or
b. Inform the complainant of progress on the complaint or
c. Inform the complainant of the outcome of the complaint.
12. Those three steps are the steps that should be taken by the Commissioner
on receipt of a complaint. The second and third steps involve only the giving
of information.
13. Once the Information Commissioner has sent an outcome to the complaint
there is no longer an order for the Tribunal to make under s.166(2).
14. The powers of the Tribunal in determining such an appeal have been
considered by the Upper Tribunal in Leighton v Information Commissioner (No.2)
[2020] UKUT 23 (AAC) in which Upper Tribunal Judge Wikeley said at
paragraph 31
3
“Appropriate steps” mean just that, and not an “appropriate outcome”. Likewise,
the FTT’s powers include making an order that the Commissioner “take
appropriate steps to respond to the complaint”, and not to “take appropriate steps
to resolve the complaint”, least of all to resolve the matter to the satisfaction of
the complainant.
15. In the case of Scranage v Information Commissioner [2020] UKUT 196 (AAC)
the Upper Tribunal went further in saying:
“... there is a widespread misunderstanding about the reach of section 166.
Contrary to many data subjects’ expectations, it does not provide a right of appeal
against the substantive outcome of the Information Commissioner’s investigation
on its merits. Thus, section 166(1), which sets out the circumstances in which an
application can be made to the Tribunal, is procedural rather than substantive in
its focus. This is consistent with the terms of Article 78(2) of the GDPR (see
above). The prescribed circumstances are where the Commissioner fails to take
appropriate steps to respond to a complaint, or fails to update the data subject on
progress with the complaint or the outcome of the complaint within three months
after the submission of the complaint, or any subsequent three month period in
which the Commissioner is still considering the complaint.”.
16. These decisions of the Upper Tribunal are binding on the First Tier
Tribunal as to the approach that must be taken to applications such as this.
17. Mr Ahmed thought that this Tribunal had the power to consider an
application about the substantive outcome of the Information Commissioner’s
investigation. He is not alone in thinking that, as has been acknowledged by
the Upper Tribunal in the decision in Scranage, but the Tribunal is limited in
its powers to those given by Parliament as interpreted by the Upper Tribunal.
18. A person who wants a data controller (or processor) to rectify personal
data or otherwise properly comply with the Data Protection Act 2018 or
General Data Protection Regulations in relation to holding personal data must
go to the High Court or a County Court pursuant to section 180 of the Data
Protection Act 2018.
19. This Tribunal does not have an oversight function in relation to the
Information Commissioner’s Office and does not hold them to account for their
internal processes. The Parliamentary and Health Service Ombudsman is the
body which has that function.
The Facts
20. The chronology is as follows
• 23 November 2020, complaint made to the Greater Manchester Police
4
• 16 February 2021, GMP respond to complaint.
• 23 April 2021, the Information Commissioner’s Office (‘ICO’)
acknowledge the Applicant’s complaint on the GMP’s handling of his
data complaint.
• 20 May 2021, the ICO inform the Applicant of the outcome of its
investigation and conclude the matter.
• (No date indicated). The Applicant makes a complaint to the ICO in
relation to how the ICO handled his complaint.
• 10 June 2021, the ICO informs the Applicant of the outcome of its review
to his complaint again the ICO; the Applicant is advised on what further
steps he may take if dissatisfied by the review.
21. The case review was completed and by letter dated 10 June 2021 the
Applicant was provided with an outcome to that case review. The reviewing
officer was satisfied that the previous case officer had handled the matter
reasonably and in line with casework processes.
22. The Applicant disagrees with the Commissioner that there is no need for
further consideration.
Analysis and Conclusions
23. Turning to s166 DPA18, the Respondent has considered the Applicant’s
complaint in case reference IC-78174-G4B3, taken steps as outlined above and
informed him of the outcome.
24. The Applicant is not satisfied with that outcome and wishes it to be
reconsidered but it is an outcome, nonetheless.
25. This Tribunal has no power to make a decision about the merits of that
outcome, whether it be right or wrong, nor to compare it to any other decision
of the Commissioner. Neither does the Tribunal have power to examine
whether there should be further or different steps to those taken by the
Commissioner.
26.Furthermore, the Tribunal does not have any power to supervise or
mandate the performance of the Commissioner’s functions [under schedule 13
DPA18.]
27. There is subsequently no basis for the Tribunal to make an order under
section 166(2) DPA18.
5
28. Rule 8(2) states
8(2) The Tribunal must strike out the whole or a part of the proceedings if the
Tribunal— (a) does not have jurisdiction in relation to the proceedings or that
part of them; and (b) does not exercise its power under rule 5(3)(k)(i) (transfer to
another court or tribunal) in relation to the proceedings or that part of them.
29. For the reasons set out above, I have concluded that this Tribunal would
not be able to provide the Applicant with the orders he seeks and that therefore
the Tribunal does not have the jurisdiction (power) to deal with his application.
30. Although it may be that a civil court [High Court or County Court] has
power to deal with all or part of the application I decline to exercise the power
to transfer this case, as to do so would commit the Applicant to litigation that
should only be embarked upon as a matter of personal choice having had the
opportunity to take independent legal advice and considered all of the
circumstances. This Tribunal cannot advise him whether or not he can or
should make any application to a court.
31. Having taken account of all relevant considerations, I strike out this
application pursuant to 8(2) of the Tribunal Procedure (First-tier Tribunal)
(General Regulatory Chamber) Rules 2009.
Tribunal Judge Lynn Griffin
27 July 2021
© CROWN COPYRIGHT 2021
6