FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
(INFORMATION RIGHTS) Appeal Reference: QJ/2020/0296/GDPR/V
CVP Remote Hearing
On 2 December 2020
Before
UPPER TRIBUNAL JUDGE O’CONNOR
Between
SUSAN MILNE
Applicant
and
THE INFORMATION COMMISSIONER
Respondent
Representation:
For the Applicant: In person
For the Respondent: No attendance
DECISION
Introduction
1. The hearing was undertaken, without technical difficulties, using the Cloud Video
Platform. The respondent gave notice that she intended to rely solely on her
written Response and did not wish to take part in this oral hearing, or any oral
hearing in the future. The applicant attended the hearing. I am satisfied that it was
fair and just to conduct the hearing in this way and that the applicant was able to
fully participate in the proceedings.
Background
2. On 27 March 2020, the applicant made a complaint (now referenced IC-54399-
R4Z9) to the Information Commissioner (“ICO”) in relation to a company named
1
Hamilton Parkers (“Hamilton”). The complaint was resubmitted on 23 May 2020
because the applicant had not, at that time, received an acknowledgment from the
ICO that the complaint had been received. In her complaint the applicant asserts
that Hamilton failed to delete her personal data, despite a request in this regard
having been made by the applicant to Hamilton.
3. The applicant has had previous occasion to make a complaint to the ICO about
Hamilton. On that occasion, in 2018, the ICO found that Hamilton had not
complied with its data protection obligations.
4. Having not received a substantive response to her complaint from the ICO, the
applicant lodged the instant application with the Tribunal on 12 October 2020.
5. The Tribunal Registrar issued Case Management Directions on 20 October 2020,
inter alia, listing the matter for a Case Management Hearing. Paragraph 9 of the
Registrar’s Directions states as follows:
“…
9. It is possible that the Judge presiding over the Case Management Hearing
will be able to make a final determination of the application. …”
6. On 3 November 2020, the ICO responded to the applicant’s complaint. Having first
apologised for the delay in responding and then explaining the role of the ICO, the
letter of the 3 November goes on to state as follows:
“Our view
We have considered the information available in relation to this complaint and we
are of the view that Hamilton Parkers have not complied with their Data Protection
obligations. This is because you received a further email from the organisation on
24 March 2020. This is subsequent to Hamilton Parkers confirming that your
personal data was no longer held by the organisation. We consider this to be an
infringement of the legislation.
Further action required
We have written to Hamilton Parkers regarding their failing information rights
practices. We have told them they should now review your erasure request and
ensure that all personal data relating to you is erased within 14 calendar days.
We have asked the organisation to provide further detail to the ICO regarding this
incident. In addition we have requested that Hamilton Parkers undertake a review
of their security policies, and take action to demonstrate to the ICO that the
organisations data protection practices will improve.
We keep a record of all the complaints made with us about the way organisations
process personal information. The information we gather from complaints may
form the basis for action in the future where appropriate. Thank you for bringing
this matter to our attention.”
2
7. The respondent also provided a written Response to the instant application on 3
November 2020 i.e. the same date as her response to the applicant. Paragraph 3 of
the ICO’s Response states:
“The Commissioner opposes the application and invites the Tribunal to strike it out
under rule 8(3)c of the First-tier Tribunal (General Regulatory Chamber) Rules 2009.
In the alternative, the Application should be dismissed on the basis that the
Commissioner has now taken steps to resolve the complaint ”
8. The applicant lodged a lengthy Reply on 9 November 2020, in which, amongst
other things, she states:
“I now await the outcome of the Commissioner’s request to the company, for further
information in relation to its data protection practices and how it dealt with my
request to erase my personal data.”
Law
9. So far as material, the Data Protection Act 2018 (“2018 Act”) provides that:
“165 Complaints by data subjects
(1) Articles 57(1)(f) and (2) and 77 of the GDPR (data subject’s right to
lodge a complaint) confer rights on data subjects to complain to the
Commissioner if the data subject considers that, in connection with
personal data relating to him or her, there is an infringement of the
GDPR.
(2) A data subject may make a complaint to the Commissioner if the data
subject considers that, in connection with personal data relating to him
or her, there is an infringement of Part 3 or 4 of this Act.
(3) The Commissioner must facilitate the making of complaints under
subsection (2) by taking steps such as providing a complaint form which
can be completed electronically and by other means.
(4) If the Commissioner receives a complaint under subsection (2), the
Commissioner must—
(a) take appropriate steps to respond to the complaint,
(b) inform the complainant of the outcome of the complaint,
(c) inform the complainant of the rights under section 166, and
(d) if asked to do so by the complainant, provide the complainant
with further information about how to pursue the complaint.
3
(5) The reference in subsection (4)(a) to taking appropriate steps in
response to a complaint includes—
(a) investigating the subject matter of the complaint, to the extent
appropriate, and
(b) informing the complainant about progress on the complaint,
including about whether further investigation or co-ordination
with another supervisory authority or foreign designated
authority is necessary.
(6) …
(7) In this section—
…
“supervisory authority” means a supervisory authority for the purposes
of Article 51 of the GDPR or Article 41 of the Law Enforcement Directive
in a member State other than the United Kingdom.
166 Orders to progress complaints
(1) This section applies where, after a data subject makes a complaint
under section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress
on the complaint, or of the outcome of the complaint, before the end
of the period of 3 months beginning when the Commissioner
received the complaint, or
(c) if the Commissioner’s consideration of the complaint is not
concluded during that period, fails to provide the complainant with
such information during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an
order requiring the Commissioner—
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the
outcome of the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a
period specified in the order.
4
(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a)
as it applies for the purposes of section 165(4)(a)” (emphasis added)
10. The extent to which it is appropriate to investigate any complaint is a matter for
the respondent (the ICO) to determine. The limited nature of the Tribunal’s
jurisdiction in this context has been confirmed by the Upper Tribunal, most
recently in Scranage v Information Commissioner [2020] UKUT 196 (AAC) in
which Upper Tribunal Judge Wikeley observed at paragraph 6:
“.. there is a widespread misunderstanding about the reach of section 166. Contrary
to many data subjects’ expectations, it does not provide a right of appeal against the
substantive outcome of the Information Commissioner’s investigation on its merits.
Thus, section 166(1), which sets out the circumstances in which an application can
be made to the Tribunal, is procedural rather than substantive in its focus. This is
consistent with the terms of Article 78(2) of the GDPR (see above). The prescribed
circumstances are where the Commissioner fails to take appropriate steps to
respond to a complaint, or fails to update the data subject on progress with the
complaint or the outcome of the complaint within three months after the
submission of the complaint, or any subsequent three month period in which the
Commissioner is still considering the complaint.” (emphasis added)
11. The Tribunal can make an Order requiring the respondent to investigate or
conclude an investigation of a complaint if she has not done so (the ‘appropriate
steps’ referred to in s. 166(2)(a)), or to provide the complainant with an update,
including an update as to outcome if there has been one (section 166(2)(b)).
Discussion
12. The lodging of the instant application by the applicant was in time - see rule
22(6)(f) of the Tribunal Procedure (General Regulatory Chamber) Rules 2009
(“2009 Rules”).
13. As indicated above, the respondent chose not to attend the hearing of the 2
December 2020, despite the indication in the Registrar’s Directions that the
application could be finally disposed of at that hearing. The Registrar’s Directions
did not limit that final disposal to one which favoured the respondent. As can be
seen from that which follows, I have decided to accede to the applicant’s
application and make an order under section 166(2) of the 2018 Act. Nothing new
arose at the hearing which was not foreshadowed in the applicant’s written
submissions to the Tribunal or communications to the ICO and, consequently,
having considered all the circumstances of the case in conjunction with the 2009
Rules, and in particular rule 2 thereof, I conclude that it is fair and just to determine
this application in the applicant’s favour (for the reasons given below) despite the
ICO’s absence from the hearing.
14. Turning then to the substance of my decision. First, it is not in dispute that the
applicant made a complaint to the ICO of a type which is captured within section
5
165(2) of the 2018 Act. I conclude that such complaint was made was the 27 March
2020.
15. The respondent investigated but failed to inform the applicant of the progress of
her complaint until the letter of 3 November 2020. In such circumstances, the
applicant was undoubtedly justified in making the instant application to the First-
tier Tribunal.
16. The issue before me is whether, given the letter of 3 November, there is now any
basis upon which the Tribunal could make an order under 166(2) of the 2018 Act
in this matter. I conclude not only can the Tribunal make such an order, but that it
should do so.
17. The applicant submits, both in writing and at the hearing, that she cannot
determine whether the ICO’s letter of 3 November is said, by the ICO, to constitute
an outcome to her complaint or, alternatively, whether the investigation of her
complaint is still ongoing and that she is to receive either further details of the
progress of her complaint or, indeed, an outcome of the complaint. Having
carefully considered the terms of the letter of 3 November 2020, I find myself in
exactly the same position as the applicant.
18. First, I observe that the letter of 3 November 2020 does not state that it constitutes
the ‘outcome’ of the applicant’s complaint, or that the applicant’s complaint has
been “closed”. The fact that there is ongoing engagement by the ICO with
Hamilton does not prevent the ICO ‘closing’ the applicant’s complaint if the
outcome of the compliant has been communicated to her. In such circumstances,
the absence of a statement in the letter of 3 November that it constitutes the
outcome of the applicant’s complaint or that the complaint has been closed by the
ICO is supportive, although far from determinative, of the fact that (i) the
applicant’s complaint has not been closed and (ii) that an outcome of the complaint
has not been communicated to the applicant.
19. Second, when the first two paragraphs under the heading “Further action
required” of the 3 November letter are read together, it is apparent that the ICO’s
investigation of Hamilton was still ongoing as of the 3 November 2020. An analysis
of the further information that ICO requires from Hamilton includes confirmation
that the applicant’s data has been erased. This, it seems to me, can be derived from
a fair reading of the first paragraph under that heading when read in conjunction
with the first sentence of the following paragraph. Although I accept that much of
the information that is required by the ICO from Hamilton is not information that
is likely to be provided to the applicant, confirmation by Hamilton to the ICO that
the applicant’s data has been erased does not fall within that category –
particularly in the unusual circumstances of this case in which Hamilton has
previously failed to comply with an order that the applicant’s data be erased.
20. In my view, when the entirety of the letter of the 3 November is duly analysed, it
cannot be determined whether it is said, by the ICO, to provide the ‘outcome’ to
the applicant’s complaint. A fair reading of the 3 November letter leaves open the
possibility that it does not. It is important for the applicant that have clarity on
this issue because such information is, amongst other things, relevant to any
6
consideration she may have of taking proceedings in a different forum in relation
to the matters which form the substance of the complaint.
Decision
21. For the reasons given above, I accede to the applicant’s application and make the
following Order under section 166(2) of the 2018 Act:
The Information Commissioner must, within 14 days of the date that this
Decision is sent to her by the Tribunal:
(i) Inform the applicant as to whether the letter of the 3 November
2020 constitutes the outcome of her complaint made on 27 March
2020:
(ii) If the letter of 3 November does not constitute an outcome to the
complaint of 27 March 2020 then, on the same occasion that this is
communicated to the applicant, the Information Commissioner
must inform the applicant of the progress of such complaint. She
must, thereafter, inform the applicant of the progress of her
compliant no less frequently than every 28 days, until such time as
there is an outcome to the complaint.
Dated: 5 December 2020
Promulgated: 09 December 2020
signed
M O’Connor
Upper Tribunal Judge O’Connor
7