Case Reference: EA/2022/0065/GDPR
First-tier Tribunal
General Regulatory Chamber
Information Rights
Heard on: Considered on the papers on 15 December 2022
Decision given on: 16 January 2023
Before
TRIBUNAL JUDGE Stephen Cragg KC
TRIBUNAL MEMBER Jo Murphy
TRIBUNAL MEMBER Naomi Matthews
Between
ROBERT BARTOSIK
Applicant
and
(1) THE INFORMATION COMMISSIONER
Respondents
Decision: Application allowed
The Tribunal’s orders are set out at paragraph 35.
REASONS
MODE OF HEARING
1. The parties and the Tribunal agreed that these matters were suitable for determination on
the papers in accordance with rule 32 Chamber’s Procedure Rules.
© CROWN COPYRIGHT 2022
2. The Tribunal considered an agreed open bundle of evidence consisting of 79 pages.
BACKGROUND
3. On 24 March 2021 the Applicant wrote to Police Scotland (PS) asking for erasure of his
personal data. He was especially concerned about information held about him concerning
his presence at Gorbals police station, as he claimed never to have been in that police
station. On 9 May 2021, the Commissioner received an online Complaint Form together
with additional documentation from the Applicant to support his complaint about the
way PS had handled a request for erasure.
4. On 17 August 2021, the Applicant’s complaint was allocated to an ICO case officer and
a reference number IC-105484-R5W0 was assigned. The case officer sent an email on
the same day to the Applicant asking if he had now received a response to his request for
erasure from PS. Also on 17 August 2021, the Applicant replied confirming he had not
received a response.
5. On the 18 August 2021, the case officer advised PS that it was the Commissioner’s view,
having considered the information available to the case officer in relation to this
complaint at the time, that PS has not complied with its obligations under data protection
law. The reasons for this finding were explained, and the Commissioner requested that
PS ensure that the Applicant should receive a response to his request as soon as possible.
However, on the same day PS responded to the case officer advising they had responded
to the Applicant on 1 and 26 April 2021.
6. The copy of the letter from PS to the Applicant dated 1 April 2021. Essentially, the letter
said that the request for erasure had been denied on the basis that the information ‘is
being processed for the purpose of law enforcement’. The letter goes on:-
Your request references a letter from Police Scotland dated 06/01/2021 Ref:
MI/01270/20. In this letter Chief Inspector MacIntyre discusses statements
made by a Public Enquiry and Support Assistant (PESA) in support of a
Complaint about the Police (CAP) made by yourself.
This CAP (reference: CO/01933/20) was investigated by Police Sergeant James
McFarlane, who provided a formal response to you on 16th December 2020.
Accordingly, the CAP is now resolved and the records of the investigation have
been archived by Professional Standards Department (West).
2
7. We do not need to go further into the details of the case or the police complaint. PS
told the Applicant that the PS record retention operating procedure had been applied,
and this provided for review periods on retention which would be applied. The
Applicant was provided with links to the relevant procedures.
8. Thus, having reviewed the correspondence received from PS and the Applicant the
case officer responded to the Applicant on 18 August 2021 advising that in her view
PS had complied with its obligations under data protection law in this instance, by
responding to the request. Therefore formal regulatory action would not be taken.
9. On 18 August 2021, the Applicant responded to the case officer’s outcome letter
advising he wished to appeal the decision “as the Police keep fake data about my person
in their computer system, fabricated by their PESA” and they had not delivered their
decision to the Applicant earlier than they had to the case officer.
10. On 19 August 2021, the case officer responded to the Applicant providing further detail
as to the Commissioner’s findings and advised that if the Applicant remained unhappy
with the outcome of his complaint, then his case could be reviewed. The case officer
also said:-
… looking at the response provided by PS on 1 April 2021, we are satisfied with
the explanations provided by PS and are of the view that PS is able to legitimately
retain the information held until January 2026.
11. On 2 September 2021, the Applicant responded to the case officer to request a case
review. On 7 September 2021, a reviewing case officer conducted a review of the
Applicant’s case and advised that he was satisfied that the case officer had dealt with
the Applicant’s complaint appropriately and in line with casework processes. It was
explained that although this case review was the final stage of the ICO’s case handling
process, the Applicant was entitled to take his own case to Court under data protection
legislation, irrespective of the ICO’s decision. The Applicant was also advised of his
right to complain about the handling of his complaint to the Parliamentary and Health
Service Ombudsman if he believed that the Commissioner had provided a poor service.
3
12. That might have been the end of the matter but things took a further turn when the
Applicant received another letter from PS dated 15 February 2022. It stated that there
was ‘new information’ as follows:-
Police Scotland Information Assurance are now in possession of a new, ratified,
statement from the Public Enquiry and Support Assistant (PESA) at Gorbals
Police Station, dated 8th February 2022, where the PESA acknowledges that
they had never seen you, either within or without the station, and explains how
this mis-identification has occurred.
This statement corroborates your assertions, made above.
13. PS still relied on processing of the information for the purposes of law enforcement,
but additional explanation was also supplied as follows, to the effect that additional
restrictions would now be placed on the processing of the information:-
The new PESA statement provides information which may affect the outcome
of the CAP resolution and, accordingly, this has been presented to Professional
Standards Department (West) for them to determine whether or not the CAP
should be subject to re-investigation.
The statement you requested be deleted forms part of the official record of CAP
CO/01933/20, as will the new statement received from the PESA.
However, the original (incorrect statement) is now of only very specific worth
(should the CAP be re-investigated, for example) and meets the criteria for
personal information which should be subject to restrictions in processing
detailed in DPA 2018 s47 (2). Accordingly, the original PESA statement, dated
14th December 2020, will be subject to restrictions in processing, meaning that
it can only be used as evidence in the re-investigation of CAP/01933/20 (should
that be implemented).
14. On 15 March 2022, the Commissioner received further correspondence from the
Applicant, addressing this change in position by PS:-
The Information Assurance in their decision dated 15/02/2022 Ref: DPR21034
informed me that instead of data erasure they restrict processing my personal
data under Section 47 (2) of DPA 2018 (att. 4). I believe, that Information
Assurance breached:
1) Section 41 (2) Safeguards: archiving of DPA 2018 , because processing my
personal data in this case is not allowed, because it is likely to cause substantial
damage or substantial distress to me;
2) Section 48 (2) Rights under section 46 or 47: supplementary of DPA 2018,
because they issued their decision dated 15/02/2022 outside "applicable time
period", which is 1 month as defined in Section 54 (2) of DPA 2018. Therefore
4
I ask you to investigate these breaches of DPA 2018 and issued directions to
Information Assurance.
15. On 16 March 2022, the case officer advised the Applicant that he had reviewed this
latest correspondence and considered that its content duplicated that of his complaint
of 9 May 2021, as an outcome and case review had already been provided, the case
officer did not intend to reopen the case, as follows:-
I have considered your complaint of 15 March 2022 and consider that its content
duplicates that of your complaint of 09 May 2021.
An outcome has been provided to your initial complaint and this outcome has
also been reviewed following your request for a Case Review.
I do not intend in covering old ground, your case is closed and it is not intended
that it will be re-opened.
THE APPLICATION AND RESPONSE
16. By way of a Notice of Application dated 16 March 2022 (the same day as the
Commissioner’s correspondence), the Applicant made an application to the Tribunal
under s166(2) Data Protection Act 2018 (DPA). The grounds of appeal read:-
The ICO refused my new complaint submitted yesterday and based on new
circumstances as Information Assurance (a body about which I've complained
to ICO) have challenged (sic)1 totally their primary decision after their wider
investigation in the matter and confirmed that fake data was used against me by
Police Scotland. They decided to restrict process that data under Section 47 (2)
of DPA 2018. Therefore, the ICO's decision is unfair and unjust. They just show
total ignorance of law.
With reference to previous ICO's decision after my review request dated
02/09/2021 I believe that ICO's decision dated 07/09/2021 is void because
there is no right to review under UK's law (as far as I know).
17. In response, the Commissioner argued that as any appeal in relation to the first
complaint should have been filed by 7 November 2021, and it was not filed until 16
March 2022, then the appeal should not be allowed to proceed. In any event there was
no realistic prospect of success.
18. The Commissioner’s response to the substantive appeal was as follows:-
1
We think this should read ‘changed’.
5
It is clear from the chronology of this investigation that there has been no such
failing. By considering the Applicant’s complaint, liaising with the controller, and
providing the Applicant with an outcome and a case review of that outcome, the
Commissioner has clearly taken appropriate steps to respond to the Applicant’s
complaint within the requirements of the legislation. As the Commissioner has
taken steps to comply with the procedural requirements set out in section 166(1)
of the DPA18, there is subsequently no basis for the Tribunal to make an order
under section 166(2) DPA18.
19. On 22 July 2022 the Registrar considered the Commissioner’s application to strike out
the appeal on the basis that it was out of time and there was no reasonable prospect of
success in any event. The Registrar’s ruling includes the following in relation to the
complaint of 9 May 2021:-
11. The Applicant suggests that the Commissioner did not show any evidence
that Information Assurance sent a first reply on 01 April 2021. There is evidence
of this document presented in these proceedings.
12. The Applicant suggests that the Commissioner did not investigate any issue
in his review request dated 02 September 2021. I note the Information
Commissioner’s Lead Case Officer reviewed this matter and provided a
response on 07 September 2021.
13. I am satisfied that the Commissioner has taken all appropriate steps in this
to comply with his statutory obligation as evidenced in letters dated 18 August
2021 and 19 August 2021. However, for the reasons stated below I am not of
the view that this forms the substance of the Applicant’s application before this
Tribunal.
20. The Registrar went on to consider the events of March 2022 as follows:-
14. The Applicant suggests that the Commissioner did not investigate the new
complaint of 15 March 2022 in relation to Information Assurance issued a new
second decision dated 15 February 2022.
…
17. With regard to what is said in the Commissioner’s response and the Lead
Case Officer’s letter dated 16 March 2022 it appears that this complaint was
conflated with the complaint on 09 May 2021. It seems to me that one approach
would have been treat it as a separate complaint, assign it a separate case
reference identifier and proceed to consider it on that basis. I repeat that I have
not seen the actual complaint and so make this observation in absence of such.
19. It seems to me from the information before me that this Tribunal is able to
consider whether the Commissioner has taken appropriate steps to respond,
inform of the progress, or provide an outcome to the complaint of 15 March
2022.
6
20. I find that in the circumstances the Tribunal has the power to consider an
order under section 166(2) of the DPA 2018 directing the Commissioner to
progress the complaint.
21. On that basis the Registrar did not strike out the appeal. However, somewhat
surprisingly in the context of these comments, the Commissioner filed further
submissions on 22 August 2022 which simply stated:-
1. The Commissioner advises that the Applicant’s second complaint is a duplicate
of his original complaint of 9 May 2021 [copy complaint together with
attachments attached]. It was handled by Police Scotland under the same
reference and relates to the same erasure request.
2. The Commissioner will not therefore be assigning a new case reference. The
Commissioner’s Response dated 4 May 2022 outlines everything in detail.
22. Finally, the Applicant responded to this on 23 August 2022:-
1. My second complaint dated 15/03/2022 is not a duplicate of complaint dated
09/05/2021, what is clearly stated in the details of that complaint (a copy sent
to the Tribunal on 27/07/2022). Because the Information Assurance issued a
new decision in my case dated 15/02/2022 I've made a new complaint to ICO
in that matter. That complaint shall be investigated by ICO.
2. Therefore, I apply under Section 166 of DPA 2018 to the Tribunal for the
orders to investigate that complaint by ICO in a proper manner and a proper
time.
LEGAL BACKGROUND
23. A data subject has a right to make a complaint to the Commissioner if they consider that
the processing of personal data relating to them infringes the General Data Protection
Regulation (“GDPR”), and/or Parts 3 or 4 of the Data Protection Act 2018 (DPA) see
section 165(2) DPA
24. Under section 166 DPA, a data subject has a right to make an application to the Tribunal
if the Commissioner has failed to take certain procedural actions in relation to their
complaint. Section 166 DPA states as follows:-
(1) This section applies where, after a data subject makes a complaint under
section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on
the complaint, or of the outcome of the complaint, before the end of the
period of 3 months beginning when the Commissioner received the
complaint, or
7
(c) if the Commissioner’s consideration of the complaint is not concluded
during that period, fails to provide the complainant with such information
during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order
requiring the Commissioner—
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the
outcome of the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order.
(b) to conclude an investigation, or take a specified step, within a period
specified in the order.
(4) …
25. Case law establishes that an application under s166 DPA is not concerned with the merits
of the underlying complaint or intended to provide a right of challenge to the substantive
outcome of the Commissioner’s investigation into that complaint. This was most recently
confirmed in the case of R (Delo) v Information Commissioner [2022] EWHC 3046 (Admin),
decided two weeks before we considered this application. In that case Mostyn J said:-
129. In Killock and Veale v ICO (Information rights - Freedom of Information - exceptions:
practice and procedure) [2021] UKUT 299 (AAC) Farbey J and UTJ De Waal held
at [74]:
“The remedy in s.166 is limited to the mischiefs identified in s.166(1). We
agree with Judge Wikeley’s conclusion in Leighton (No 2) that those are
all procedural failings. They are (in broad summary) the failure to respond
appropriately to a complaint, the failure to provide timely information in
relation to a complaint and the failure to provide a timely complaint
outcome. We do not need to go further by characterising s.166 as a
“remedy for inaction” which we regard as an unnecessary gloss on the
statutory provision. It is plain from the statutory words that, on an
application under s.166, the Tribunal will not be concerned and has no
power to deal with the merits of the complaint or its outcome. We reach
this conclusion on the plain and ordinary meaning of the statutory
language but it is supported by the Explanatory Notes to the Act which
regard the s.166 remedy as reflecting the provisions of Article 78(2) which
are procedural. Any attempt by a party to divert a Tribunal from the
procedural failings listed in s.166 towards a decision on the merits of the
complaint must be firmly resisted by Tribunals”
130. I fully agree with this…
131…..if an outcome has been pronounced, I would rule out any attempt by the
data subject to wind back the clock and to try by sleight of hand to achieve a
8
different outcome by asking for an order specifying an appropriate responsive
step which in fact has that effect.
26. We note that the passages cited from the Killock case (and now approved by the High
Court) have been cited by the Commissioner in the present case, and the law is now clear
as to the scope of an appeal under s166 DPA.
DISCUSSION AND DECISION
27. It seems to us that the key to this case is deciding whether the second complaint (as the
Applicant calls it) to the Commissioner was a new complaint or, as the Commissioner
would have it, simply a repeat of the first complaint. In essence, the Commissioner has
declined to deal with this complaint at all. The Commissioner says in terms that the
Commissioner will ‘not…be assigning a new case reference’. In legal terms, the
Applicant’s complaint is that for the purposes of s166(1)(a) DPA the Commissioner has
failed ‘to take appropriate steps to respond to the complaint’.
28. It seems to us that the correspondence from the Applicant on 15 March 2022 was indeed
raising a new complaint and not simply a repeat of the May 2021 complaint. In May 2021
the Applicant was raising the issue that PS had not responded within the statutory time
limit to his request for erasure, and also complaining about the decision of PS to retain
the information about the Applicant’s presence in a particular police station (taken on the
basis that he had, in fact, been in the police station). The Commissioner dealt with this
complaint properly by establishing that PS had responded to the request. The
Commissioner also reached a conclusion on the complaint (we say nothing about whether
it was right or wrong) that ‘we are satisfied with the explanations provided by PS and are
of the view that PS is able to legitimately retain the information held until January 2026’.
29. However, with the PS letter of 15 February 2022 the factual position changed quite
dramatically. The position of PS was that the information held, in the form of a statement
stating that the Applicant had been in the police station, was simply incorrect but,
nevertheless, PS had further decided not to erase the information but to process it for
limited purposes.
30. It seems to us that the Applicant was perfectly entitled to make a new complaint to the
Commissioner about that changed set of circumstances, and the new decision not to erase.
9
It cannot be said that it was simply a repeat of the first complaint: now PS were seeking
to retain personal information about the Applicant that they had accepted to be incorrect.
31. We say absolutely nothing about whether PS are entitled to take this stance, and that is
not our role in an appeal brought under s166 DPA. As the UT said in Killock (now
endorsed in Delo),
‘It is plain from the statutory words that, on an application under s.166, the Tribunal
will not be concerned and has no power to deal with the merits of the complaint or its
outcome’.
32. However, in our view, deciding erroneously not to consider a complaint at all has got
nothing to do with the ‘merits of the complaint or its outcome’. As the Commissioner
says, the complaint was not even given a new case reference. As the case officer said on
16 March 2022, ‘your case is closed and it is not intended that it will be re-opened’.
33. Thus, we make findings of fact that the letter of 15 March 2022 was a new complaint by
the Applicant in the circumstances outlined above, and that the Commissioner failed to
consider the complaint at all.
34. On that basis it seems to us clear that this is a case which comes within s166(1)(a) DPA
and the Commissioner has failed ‘to take appropriate steps to respond to the complaint’.
35. In conclusion:-
(a) To the extent that the application raises issues about the way in which the
Commissioner dealt with the complaint of 9 May 2021, the application is dismissed
as the Commissioner took appropriate steps to respond to the complaint.
(b) In relation to the complaint (as we have found it to be) of 15 March 2022, the
application is granted, as the Commissioner has failed to take appropriate to respond
to the complainant.
(c) The Tribunal makes an order that:-
(i) The Commissioner takes appropriate steps to respond to the
Applicant’s complaint, by registering and considering the complaint, in
line with the Commissioner’s functions.
10
(ii) The Commissioner informs the Applicant within 28 days of the date of
this decision of the progress of the complaint, and of the date an
outcome will be provided (if not already done).
(d) The Tribunal notes that it has no other powers to order an investigation, or to award
the Applicant compensation (as requested in the appeal notice).
Signed: Recorder Stephen Cragg KC
Sitting as a judge of the First-tier Tribunal
Date: 16 January 2023.
Promulgated: 16 January 2023.
11