First-tier Tribunal
General Regulatory Tribunal
Information Rights
IN THE MATTER OF AN APPLICATION TO THE FIRST-TIER TRIBUNAL
(INFORMATION RIGHTS) UNDER SECTION 166 OF THE DATA PROTECTION
ACT 2018
Case No. EA/2022/0383/GDPR
BETWEEN:
EDUARDO CORTES
Applicant
-and-
THE INFORMATION COMMISSIONER
Respondent
APPLICATION ON BEHALF OF THE RESPONDENT TO STRIKE OUT THE
APPLICATION
______________________
Heard by: Determination on the papers.
Heard on: 10 July 2023.
Heard by: Judge Brian Kennedy KC.
Decision given on: 13 July 2023.
Result: These proceedings are struck out pursuant to rule 8(3)(c) of the
Tribunal Procedure (First- tier Tribunal) (General Regulatory Chamber) Rules
2009 on the grounds that there is no reasonable prospect of it succeeding.
1
REASONS
Introduction:
1. The Tribunal has considered this matter on the papers and is satisfied that it
does not defeat the interests of justice to do so pursuant to rule 32(3) of the
Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules
2009 (“the 2009 Rules”).
Factual Background:
2. By way of a Notice of Application received by the Tribunal on 18 November
2022, the Applicant brought this appeal under section 166(2) of the Data
Protection Act 2018 (“DPA18”). On 17 August 2022 the Applicant submitted a
Complaint Form to the Commissioner, together with some supporting evidence,
about the way in which Kingston Hospital Foundation Trust (“the Trust”) had
handled personal information. This was acknowledged by the Commissioner
on 17 August 2022, when the Applicant was advised of the right to apply to the
Tribunal in the event that the Commissioner failed to take appropriate steps to
respond to his complaint or did not provide information about the progress or
outcome his complaint within three months.
3. The Complaint had been allocated case reference IC-187387-S4L2. On 4
November 2022 an ICO case officer wrote to the Applicant with an outcome,
noting that the concerns raised did not relate to the handling of the Applicant’s
own personal information. The case officer explained that he would review the
complaint but as the concerns related to the handling of third-party personal
information, he would not be providing the Applicant with any further response
or further information relating to the complaint. Upon receiving the outcome, the
Applicant expressed concern that there had been a misunderstanding and it
was his documentation that was erased by the Trust. Later that same day the
case officer responded to the Applicant providing clarity and explained that
personal data was information that related to an identified or identifiable
individual and that on this occasion it was noted that the information the
Applicant had raised concerns about were notes concerning the care of a
2
patient, which he had input into. The case officer went onto add that as the
notes related the care of the patient, this would be considered as being their
personal data and not that of the Applicant. The Applicant may have input into
the notes, the notes would not concern him and therefore would not be
considered his personal information.
4. The Commissioner argues that it is apparent that the Applicant is of the view
that their information rights continue to be infringed by, in this instance, the
Trust. Notwithstanding any conclusion reached by the Commissioner, if the
Applicant wishes to seek an order of compliance against the Data Controller for
breach of their data rights, the correct route, argues the Commissioner, is for
them to do so by way of separate civil proceedings in the County Court or High
Court under section 167 of the DPA18.
5. In terms of the Applicant’s claim for costs, the Commissioner argues that this is
misconceived. There are limited circumstances under which such an order can
be granted in accordance with Rule 10 of the Tribunal Rules, to instances of
wasted costs, and unreasonable behaviour. The Commissioner submits that
neither ground is applicable here and the claim for costs should accordingly fail.
6. The Applicant also suggests that the Commissioner failed to inform him of his
rights under section 166 DPA18 as is required under section 165(4)(c) of the
DPA18. The Commissioner denies this and submits this information was
provided in the acknowledgement of the Applicant’s complaint, something
which the Applicant appears to acknowledge at paragraph 2 of his grounds of
appeal. Section 165(4)(c) does not require that this information be provided
when the outcome of the complaint is provided. In any event, the Commissioner
submits that in effect the appellant seeks these issues to be considered by the
Tribunal pursuant to section 166 of the Data Protection Act 2018 (“the 2018
Act”) and he argues there is no order to be made in this respect under section
166DPA18.
3
Legal Background:
7. Article 77(1) of the GDPR gives every data subject the right to complain to a
supervisory authority (in the domestic context, the Information Commissioner)
if they consider that the processing of their personal data infringes their GDPR
rights. The relevant provisions of section 165 of the 2018 Act accordingly
provide as follows: - “165 Complaints by data subjects: -
(1) Articles 57(1)(f) and (2) and 77 of the GDPR (data subject's right to lodge a
complaint) confer rights on data subjects to complain to the Commissioner if the
data subject considers that, in connection with personal data relating to him or her,
there is an infringement of the GDPR.
(2) A data subject may make a complaint to the Commissioner if the data subject
considers that, in connection with personal data relating to him or her, there is an
infringement of Part 3 or 4 of this Act.
(3) The Commissioner must facilitate the making of complaints under subsection (2) by
taking steps such as providing a complaint form which can be completed electronically
and by other means.
(4) If the Commissioner receives a complaint under subsection (2), the Commissioner
must—
(a) take appropriate steps to respond to the complaint,
(b) inform the complainant of the outcome of the complaint,
(c) inform the complainant of the rights under section 166, and
(d) if asked to do so by the complainant, provide the complainant with further
information about how to pursue the complaint.
(5) The reference in subsection (4)(a) to taking appropriate steps in response to a
complaint includes—
(a) investigating the subject matter of the complaint, to the extent appropriate, and
(b) informing the complainant about progress on the complaint, including about
whether further investigation or co-ordination with another supervisory authority or
foreign designated authority is necessary.”
4
8. Section 166 of the 2018 Act reads:
“The powers of the Tribunal in considering such applications have been considered by
the Upper Tribunal. These cases are binding on the First Tier Tribunal of which the
General Regulatory Chamber is a part.”
9. In Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC) Upper
Tribunal Judge Wikeley said at paragraph 31-“Appropriate steps” mean just that,
and not an “appropriate outcome”. Likewise, the FTT’s powers include making an
order that the Commissioner “take appropriate steps to respond to the complaint”, and
not to “take appropriate steps to resolve the complaint”, least of all to resolve the
matter to the satisfaction of the complainant.”
10. Further in the case of : Scranage v Information Commissioner [2020] UKUT 196
(AAC) the Upper Tribunal went further saying :
“... there is a widespread misunderstanding about the reach of section 166. Contrary
to many data subjects’ expectations, it does not provide a right of appeal against the
substantive outcome of the Information Commissioner’s investigation on its merits.
Thus, section 166(1), which sets out the circumstances in which an application can be
made to the Tribunal, is procedural rather than substantive in its focus. This is
consistent with the terms of Article 78(2) of the GDPR (see above). The prescribed
circumstances are where the Commissioner fails to take appropriate steps to respond
to a complaint, or fails to update the data subject on progress with the complaint or the
outcome of the complaint within three months after the submission of the complaint, or
any subsequent three month period in which the Commissioner is still considering the
complaint.”
Conclusion:
11. The Tribunal is limited in its powers to those given by Parliament as interpreted
by the Upper Tribunal. The First tier Tribunal does not have power to make a
decision on the merits of the complaint, and this Tribunal will not interfere with
an exercise of regulatory judgement without good reason.
5
12. Furthermore, a person who wants a data controller (or processor) to rectify
personal data, compensate them, or otherwise properly comply with the Data
Protection Act 2018 or General Data Protection Regulations in relation to
personal data must go to the civil courts not a tribunal pursuant to sections 167-
169 & 180 of the Data Protection Act 2018. This Tribunal express no opinion
one way or another about whether the Applicant can do so, or whether they
should do so; that is a matter for the Applicant, about which this Tribunal cannot
give advice.
13. This Tribunal does not have an oversight function in relation to the Information
Commissioner’s Office and does not hold them to account for their internal
processes. The Parliamentary and Health Service Ombudsman is the body
which has that function. This Tribunal expresses no opinion one way or another
about whether this applicant can or whether they should raise the issue with the
Ombudsmen; again, that is a matter for the applicant, about which this Tribunal
cannot advise.
14. The Applicant does not agree with the outcome of the handling of his complaint,
but this Tribunal has no power to consider an appeal against the Information
Commissioner’s substantive findings.
15. This Tribunal has no power to make a decision about the merits of that outcome,
whether it be right or wrong. This is the case regardless of the nature of the
complaint made or its evidential basis. The quality, adequacy or merits of the
outcome fall outside the scope of s.166 and outside the jurisdiction of this
Tribunal. Furthermore, the Tribunal does not have any power to supervise or
mandate the performance of the Commissioner’s functions.
16. There is accordingly no basis for the Tribunal to make an order under section
166(2) DPA18.
17. Having considered whether this Tribunal could provide the Applicant with any
other remedy while there may be a remedy available from other courts (about
which no conclusions can be given herein) there is no other remedy available
from this Tribunal in relation to this application.
6
18. For this application to proceed there must be a realistic prospect of its success
and for the reasons set out above, this Tribunal would not be able to provide
the outcome(s) sought and that therefore the application is hopeless, or in other
words has no reasonable prospect of success.
19. Having considered all the above the Tribunal has therefore decided to strike out
this application pursuant to 8(3)(c) of the Tribunal Procedure (First-tier Tribunal)
(General Regulatory Chamber) Rules 2009 because there is no reasonable
prospect of the application succeeding.
Brian Kennedy KC 10 July 2023.
7