Appeal number: QJ/2020/0022
P1
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
Information Rights
PAULINE STEWART Applicant
- and -
THE INFORMATION COMMISSIONER Respondent
Before:
JUDGE LYNN GRIFFIN
Sitting in Chambers on 3 March 2021
Determined on the papers, the Applicant having failed to attend the listed
Cloud Video Platform hearing
DECISION
1. The application is struck out under rule 8(3)(c) of the Tribunal Procedure
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009, because there is
no reasonable prospect of the Applicant’s case succeeding.
1
P: paper determination which is not provisional
1
MODE OF HEARING
2. The proceedings were due to be held by video hearing. The Respondent
had indicated that she did not intend to participate in the hearing.
3. The Applicant did not attend the hearing listed today at 10.00 (3 March
2021). There was no contact from the Applicant to explain. The Tribunal clerk
waited in the CVP hearing room until 10.15 when I instructed him to close the
hearing room.
4. The Tribunal has the power to proceed if rule 362 is satisfied. Rule 36 reads
Hearings in a party’s absence
36. If a party fails to attend a hearing the Tribunal may proceed with the hearing
if the Tribunal—
(a) is satisfied that the party has been notified of the hearing or that
reasonable steps have been taken to notify the party of the hearing; and
(b) considers that it is in the interests of justice to proceed with the hearing.
5. Furthermore, the Tribunal may make a decision without a hearing
pursuant to rule 32 where that decision disposes of proceedings under rule 8
(striking out a party's case).
6. The Applicant was sent a notice of hearing on 8 February 2021. This is in
excess of the minimum 14 day notice period required under rule 34. I am
satisfied that rule 36(a) is satisfied.
7. Since that date the Applicant sent the Tribunal an email on 12 February
2021 in which she raised a further complaint with the Tribunal and the
Respondent but gave this case reference in the text. The ICO replied to that
email on 15 February 2021 and on the same day the Applicant sent them a
further email that she copied to the tribunal.
8. The Tribunal chased the Applicant on 24 February 2021 to confirm if she
would be attending the Case Management Hearing on 3/03/21 and indeed the
test connection on the 1/03/21. No reply was received to that communication.
The Applicant did not attend the test of the connection.
9. In her email of 18 January 2021, the Applicant had said she would like a
hearing by telephone. She was at liberty to join the video hearing by telephone
should she have wished to do so as explained in the instructions.
2
The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009
2
10. I consider it is in the interests of justice to proceed to determine the
Respondent’s application. Mrs Stewart has replied to that application at length
in her email of 18 January 2021. There is no indication that adjourning the case
would result in an effective hearing and this would only serve to delay the
resolution of the application. I am satisfied that it is fair and just to proceed in
this way.
REASONS
Background to the Application
11. This application relates to a number of complaints made to the Respondent
by Mrs Stewart that all stem from her concerns about how various public
authorities have calculated her pension entitlement and consequent enquiries
in that regard about her personal data held by those public authorities.
12. The public authorities subject of the Applicant’s complaints to the
Respondent are
a. RFA0924865, Department of Work and Pensions (‘DWP’)
b. RFA0925895, NHS Business Services Authority (‘NHSBSA’)
c. RFA0923646, Home Office
d. RFA0923634, Pensions Ombudsman (the ‘Ombudsman’)
e. RFA0923657, HM Revenue and Customs (‘HMRC’).
f. RFA0867416, NHS Professionals (‘NHSP’)
13. The Applicant states that she believes that a Guaranteed Minimum
Pension (‘GMP’) was wrongly attached to her award of “Industrial Injury
Benefit Award” (sic) and explains she has pursued her concerns for 6 years and
says that “they have not put it right yet”. She refers to a decision of Judge Poole
in her documentation to support her contentions. Although she refers to a
decision of 2020, that decision appears to be a published decision from 2014 of
the Tax Chamber3 in which the judge refused to reinstate Mrs Stewart’s appeal,
that had been previously struck out, because there was no relevant dispute over
which the Tax Chamber had jurisdiction about the correctness of the tax code
that had been applied to part of the Applicant’s pension.
3 Pauline Stewart v The Commissioners for her Majesty’s Revenue and Customs [2014]
UKFTT 927 (TC)
3
The Notice of Application and the Response
14. The Notice of Application dated 6 December 2020 the Applicant sought an
order from the Tribunal in the following terms. The Tribunal has interpreted
this as an application under section 166 of the Data Protection Act 2018 to direct
a response from the Information Commissioner's Office ("ICO"). She would like
the First-tier Tribunal to make the following order:
“THE RULE OF LAW/LETTER OF THE LAW is upheld DUE PROCESS.
Equality, maintained. MY DATA CORRECTED ALL MONEY paid and I
receive a CS Pension all back money +IIBA gets a review and all BACK MONEY
LUMP SUMS Paid compensation Against the Pension Ombudsman and
ICO”(sic)
15. The Response dated 14 January 2021 invites the Tribunal to strike out the
Applicant’s application because it has no prospect of success under rule 8(3)(c)
of the Tribunal Rules.
16. I note that in her notice of application and other documents Mrs Stewart
outlines the nature of her disability and the circumstances leading to her ill
health. She is representing herself. As a result, and having regard to the Equal
Treatment Benchbook, I have analysed the Applicant’s submissions with a
view to identifying any remedy this Tribunal may be able to provide beyond
that specifically requested in the Notice of application.
The Law
17. A data subject has a right to make a complaint to the Commissioner if they
consider that in connection with the processing of personal data relating to
them there is an infringement of the General Data Protection Regulation
[GDPR], and/or Parts 3 or 4 of the Data Protection Act 2018 [DPA18]: see
Article 77 GDPR, and section 165 (1) & (2) DPA18.
18. Under section 166 DPA18, a data subject has a right to make an application
to the Tribunal if they consider that the Commissioner has failed to take certain
procedural actions in relation to their complaint.
19. Section 166 DPA18 as relevant states:
(1) This section applies where, after a data subject makes a complaint under
section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
4
(b) fails to provide the complainant with information about progress on the
complaint, or of the outcome of the complaint, before the end of the period
of 3 months beginning when the Commissioner received the complaint, or
(c) if the Commissioner’s consideration of the complaint is not concluded
during that period, fails to provide the complainant with such information
during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order
requiring the Commissioner—
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the
outcome of the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a period
specified in the order.
20. The reference to taking “appropriate steps” in section 166(1)(a) and (2)(a),
includes “investigating the subject matter of the complaint to the extent appropriate”
and “informing the complainant about progress on the complaints”, as set out in
sections 166(4) and 165(5) DPA18.
21. The reference to “provide the complainant with…. the outcome of the
complaint” in s. 166(1)(b) and 2(b) is not qualified with the word appropriate.
22. The Tribunal can only exercise powers given to it by Parliament as set out
in legislation. When considering an application under s. 166 the Tribunal is not
concerned with the merits or strength of the underlying complaint. Section 166
DPA18 does not provide a right of appeal against the substantive outcome of
an investigation into a complaint under s. 165 DPA18. Neither does it allow the
Tribunal to direct to what extent it is appropriate to investigate any complaint;
that is a matter for the Information Commissioner.
23. On an application under s. 166 DPA18 the Tribunal is limited to
considering whether to make an order of the kinds set out in s. 166(2) requiring
the Commissioner to
a. Take appropriate steps to respond to the complaint or
b. Inform the complainant of progress on the complaint or
c. Inform the complainant of the outcome of the complaint.
5
24. Once the Information Commissioner has sent a response to the complaint
there is no longer an order for the Tribunal to make under s.166(2).
25. The powers of the Tribunal in determining such an appeal have been
considered by the Upper Tribunal in Leighton v Information Commissioner (No.2)
[2020] UKUT 23 (AAC) in which Upper Tribunal Judge Wikeley said at
paragraph 31
“Appropriate steps” mean just that, and not an “appropriate outcome”. Likewise,
the FTT’s powers include making an order that the Commissioner “take
appropriate steps to respond to the complaint”, and not to “take appropriate steps
to resolve the complaint”, least of all to resolve the matter to the satisfaction of
the complainant.
26. In the case of Scranage v Information Commissioner [2020] UKUT 196 (AAC)
the Upper Tribunal went further in saying:
“... there is a widespread misunderstanding about the reach of section 166.
Contrary to many data subjects’ expectations, it does not provide a right of appeal
against the substantive outcome of the Information Commissioner’s investigation
on its merits. Thus, section 166(1), which sets out the circumstances in which an
application can be made to the Tribunal, is procedural rather than substantive in
its focus. This is consistent with the terms of Article 78(2) of the GDPR (see
above). The prescribed circumstances are where the Commissioner fails to take
appropriate steps to respond to a complaint, or fails to update the data subject on
progress with the complaint or the outcome of the complaint within three months
after the submission of the complaint, or any subsequent three month period in
which the Commissioner is still considering the complaint.”.
27. These decisions of the Upper Tribunal are binding on the First Tier
Tribunal as to the approach that must be taken to applications such as this.
28. Mrs Stewart thought that this Tribunal had the power to consider an
application about the substantive outcome of the Information Commissioner’s
investigation. She is not alone in thinking that, as has been acknowledged by
the Upper Tribunal in the decision in Scranage, but the Tribunal is limited in
its powers to those given by Parliament as interpreted by the Upper Tribunal.
29. A person who wants a data controller (or processor) to rectify personal
data or otherwise properly comply with the Data Protection Act 2018 or
General Data Protection Regulations in relation to holding personal data must
go to the High Court or a County Court pursuant to section 180 of the Data
Protection Act 2018. I express no opinion one way or another about whether
Mrs Stewart can do so or whether she should do so; that is a matter for her
about which this Tribunal cannot advise her.
6
30. This Tribunal does not have an oversight function in relation to the
Information Commissioner’s Office and does not hold them to account for their
internal processes. The Parliamentary and Health Service Ombudsman is the
body which has that function. I express no opinion one way or another about
whether Mrs Stewart can or whether she should raise the issue with the
Ombudsman; again, that is a matter for her about which this Tribunal cannot
advise her.
The Facts
RFA0924865, Department of Work and Pensions (‘DWP’)
31. The Applicant made her complaint to the Commissioner on 18 April 2020.
The Applicant’s complaint related to a Subject Access Request (‘SAR’) she
made to the DWP.
32. The Commissioner sent an initial decision by letter on 29 September 2020
to the effect that the case would not be considered further as it related to historic
matters and did not raise data protection issues.
33. Subsequently a case review was conducted and sent to the Applicant on 7
January 2021. The reviewing officer was satisfied that the Applicant’s
complaint had been dealt with appropriately and in line with the Respondent’s
case handling procedures.
RFA0925895, NHS Business Services Authority (‘NHSBSA’)
34. The Applicant made her complaint to the Commissioner on 22 May 2020.
35. The Applicant’s complaint related to a Subject Access Request (‘SAR’) she
made to NHSBSA to obtain certain documents that she believed would prove
maladministration of her pension. The Applicant alleged a breach of data
protection and the Freedom of Information Act. Her concerns can be
summarised as follows
a. NHSBSA holds inaccurate information relating to her pension
and that NHSBSA should not be the pension provider, but instead
this should be Civil Service Pensions; and,
b. Mrs Stewart had not been provided with documents from the
NHS relating to her 1993/1994 returns, a letter sent from the NHS to
Frimley Park at this time and a letter saying she opted out of the
pension scheme.
36. The Commissioner sent an initial response to the complaint by letter on 22
October 2020 to the effect that NHSBSA had complied with its data protection
obligations. The Applicant swiftly requested a review.
7
37. That case review was conducted, and this was sent to the Applicant on 28
October 2020. The reviewing officer agreed with the explanations provided and
steps taken to resolve the Applicant’s complaint.
RFA0923646, Home Office
38. The Applicant made her complaint to the Commissioner on 19 April 2020.
The Applicant’s complaint related to a Subject Access Request (‘SAR’) she
made to the Home Office and how long they had taken to reply.
39. The Commissioner sent the Applicant a letter on 19 October 2020 to the
effect that having received the correspondence between the Applicant and the
Home Office this would be retained by the ICO intelligence purposes. It was
noted that the Applicant had provided the Home Office with information they
have requested and therefore the ICO expected them to respond to the request
as appropriate in due course. The ICO asked the Home Office to respond to the
SAR.
40. Subsequently a case review was conducted and this was sent to the
Applicant on 17 December 2020. The reviewing officer was satisfied that the
Applicant’s complaint had been dealt with appropriately and in line with the
Respondent’s case handling procedures. The review concluded as follows
“It is clear that the Home Office is now trying to find the data you are
entitled to. Ms Brewster has informed you that this case is now closed. If
you remain unhappy with the Home Office Response when you receive
it, please raise it with them and ask them to rectify their response to
resolve your concerns. If they fail to do so, you may submit a new
complaint to the ICO.”
RFA0923634, Pensions Ombudsman (the ‘Ombudsman’)
41. The Applicant made her complaint to the Commissioner on 18 April 2020.
The Applicant’s complaint related to the accuracy of information held by other
organisations, such as NHS pensions, about which she had complained to the
Ombudsman in an attempt to obtain documents. She also alleged
maladministration.
42. The Commissioner sent an initial letter on 26 August 2020 to check their
understanding of the nature of Mrs Stewart’s complaint. The on 21 September
2020 the ICO wrote saying that once it had received a response from NHSBSA
a view would be provided but that the Applicant’s wider concerns about the
handling of her pension and appeals to the Ombudsman could not be
commented on by the ICO.
8
RFA0923657, HM Revenue and Customs (‘HMRC’).
43. The Applicant made her complaint to the Commissioner on 30 April 2020.
The Applicant’s complaint related to her concerns about how her data had been
handled by HMRC. The respondent summarised these concerns as that HMRC
had
a. Failed to provide Mrs Stewart with a full response to her subject access
request (‘SAR’);
b. Failed to ensure the security of her personal data when providing Mrs
Stewart with a SAR disclosure bundle; and,
c. Processed factually incorrect personal data in relation to Mrs Stewart.
44. The Commissioner sent an initial decision by letter on 22 July 2020 dealing
with each of these issues and requesting further information from the
Applicant.
45. Subsequently a case review was conducted and this was sent to the
Applicant on 7 January 2021. The reviewing officer was satisfied that the
Applicant’s complaint had been dealt with appropriately and in line with the
Respondent’s case handling procedures. The case review pointed out that the
Applicant had not sent the ICO the information it requested and therefore as
previously notified no further action would be taken but that if the Applicant
were to reply to the review with the response to the original email the case
officer would be asked to consider that response and any actions that were
needed but until then the outcome remained that the ICO had insufficient
information to proceed with Mrs Stewart’s case.
RFA0867416, NHS Professionals (‘NHSP’)
46. The Applicant’s made a Freedom of Information Act request to the ICO on
21 May 2020 for a list of resolved cases and what the results were. The ICO
understood this to be with this reference number, RFA0867416, in mind.
47. The Applicant’s complaint RFA0867416 had been resolved in 2017 and the
case result recorded as “Concern to be raised with DC”. The original complaint
appears to have related to a Subject Access Request (‘SAR’) she made to NHSP.
48. The Commissioner sent a letter on 11 June 2020 explaining that the ICO
did not retain any of the documents relating to complaint reference
RFA0867416 and explaining the process. The letter also provided the links to
the published data sets where the Applicant could find the result of her case.
9
49. Subsequently a case review was conducted and was sent to the Applicant
on 20 August 2020. The reviewing officer was satisfied that reasonable searches
for Mrs Stewart’s personal data in relation to case RFA0667416 had been made
and confirmed the ICO no longer held the information requested.
Submissions
50. The Commissioner submits that the application to the Tribunal should be
struck out as having no reasonable prospects of success. In her response the
Respondent submitted that
a. the Tribunal does not have the power to alter the conclusion
reached by the Commissioner on a complaint. Neither does the
Tribunal have an oversight role over the Commissioner’s exercise of
her functions or internal processes. The relief available from the
Tribunal on an application under section 166 is limited solely to that
set out in section 166(2).
b. In relation to the following complaints the Applicant had been
provided with an outcome to her complaint
i.RFA0924865, Department of Work and Pensions (‘DWP’)
ii.RFA0925895, NHS Business Services Authority
(‘NHSBSA’)
c. As regards RFA0923646, relating to the Home Office the
Applicant had been provided with an outcome but was at liberty to
make a new complaint to the ICO if the Home Office failed to deal
with the Applicant’s concerns as they had been asked to do by the
ICO. The Applicant was also informed about the option to raise the
matters through the courts, and recommended that the Applicant
seeks independent legal advice before pursuing such course of
action.
d. In relation to RFA0923634, Pensions Ombudsman (the
‘Ombudsman’) the Commissioner had explained that the
Ombudsman’s role in the complaint was to review information
provided to it for an appeal and that any concerns about the accuracy
of information would not fall to the Ombudsman to resolve.
Moreover that the ICO could not comment on the wider concern
about the handling of the Applicant’s appeal by the Ombudsman or
her pension
e. So far as RFA0923657, HM Revenue and Customs (‘HMRC’) is
concerned if the Applicant responds with the requested information,
the case officer will consider the Applicant’s response and any
actions needed.
10
f. The Applicant’s FOIA request in relation to RFA0867416, NHS
Professionals (‘NHSP’) had been considered, searches undertaken
and confirmation provided to the Applicant that the ICO no longer
held the requested information.
51. The Applicant objects to the Commissioner’s request to strike out. She
makes the following points to support her application continuing. She submits
that
a. The Commissioner has failed to take certain procedural action and
demonstrated non -adherence to the rule of law and the letter of
the law
b. The Commissioner has failed to investigate the subject matter of her
complaints to the extent appropriate. In particular by not using her
powers under FOIA “against” the Home Office for not complying
within one month and by not enforcing breaches of FOIA, GDPR
and DPA 18 and the code of practice to obtain the Applicant’s data
c. The Commissioner’s request to strike out her application deprives
her of the right to due process given to her by the Magna Carta as
a free person and UK Citizen.
52. The Applicant contended that “a data breach has and did occur in all the
complaints leaving me being owed thousands in pension and Industrial Injury
benefit and the compensation I seek would be that the ICO WOULD request
the ratification of my data to allow me to get the monies owed to me”(sic).
Conclusion
53. Turning to s166 DPA18, as set out above the Respondent has considered
the Applicant’s complaints, taken steps as outlined above and informed her of
the outcome to each complaint and the steps she needs to take in order for
further progress to be made.
54. The Applicant is not satisfied with the outcomes of her complaints and
wishes the Tribunal to reconsider them, but this Tribunal has no power to make
a decision about the merits of the outcome of her complaints, whether they be
right or wrong. Neither does the Tribunal have power to examine whether
there should be further or different steps to those taken by the Commissioner.
55. Furthermore, the Tribunal does not have any power to supervise or
mandate the performance of the Commissioner’s functions, nor to order the
rectification of data.
56. There is subsequently no basis for the Tribunal to make an order under
section 166(2) DPA18.
11
57. Moreover, the Tribunal does not have any power to award compensation
to this Applicant whether from the Pensions Ombudsman or the ICO. Neither
can I make any order in relation to the calculation of her pension entitlement
or her industrial injury payments.
58. This Applicant has not been deprived of any right to due process. She may
have remedies available to her in other Courts or Tribunals or supervisory
Ombudsmen but this Tribunal cannot advise her about that.
59. In order for this application to go forward there must be a realistic, as
opposed to a fanciful or unrealistic, prospect of its success as explained by Lord
Woolf MR in Smith v Cosworth Casting Processes Ltd [1997] 1 WLR 1538.
60. For the reasons set out above, I have concluded that this Tribunal would
not be able to provide the Applicant with the orders she seeks and that
therefore the application has no reasonable prospect of success.
61. Having taken account of all relevant considerations, I strike out this
application pursuant to 8(3)(c) of the Tribunal Procedure (First-tier Tribunal)
(General Regulatory Chamber) Rules 2009 because there is no reasonable
prospect of the application succeeding.
Date of Decision:3 March 2021
Dated Promulgated: 08 March 2021
Lynn Griffin
Tribunal Judge
© CROWN COPYRIGHT 2021
12
13