FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
(INFORMATION RIGHTS) Appeal Reference: QJ/2020/0314/GDPR
CVP Remote Hearing
On 16 December 2020
Before
UPPER TRIBUNAL JUDGE O’CONNOR
Between
DALE LEE BLAYLOCK
Applicant
and
THE INFORMATION COMMISSIONER
Respondent
Representation:
For the Applicant: In person
For the Respondent: No attendance
DECISION
Introduction
1. The hearing was undertaken, without technical difficulties, using the Cloud Video
Platform. The respondent gave notice that she intended to rely solely on her
written Response and did not wish to take part in the instant, or any future, oral
hearing. The applicant attended the hearing. I am satisfied that it was fair and just
to conduct the hearing in this way and that the applicant was able to fully
participate in the proceedings.
The Complaints
2. The applicant has made many complaints to the Information Commissioner
(“ICO”). The primary focus of these complaints has been (i) Cumbria Constabulary
(ii) Fusehill Medical Practice and (iii) Cumbria, Northumberland, Tyne and Wear
1
NHS Foundation Trust (“the Trust”). The instant application relates only to the
complaints regarding the Trust.
3. In her response to the instant application, dated 17 November 2020, the ICO
identifies two complaints made by the applicant in relation to the Trust,
respectively dated 17 August 2020 and 30 August 2020. It is said that the complaint
of the 30 August is a repeat of the earlier complaint. The ICO provides a reference
number (IC-53642-Q3V2) for, what I assume, to be these complaints.
4. The papers lodged by the applicant with the Tribunal contain not only the
complaint of 30 August 2020, but also complaints made by the applicant to the ICO
regarding the Trust, on 9 June and 6 July 2020.
5. I note that the 9 June complaint was referenced by the Registrar at paragraph 5.1.2
of her Case management Directions of 3 November, with the observation that this
will be treated as a complaint made to the ICO for the purposes of the instant
application if it was made in 2020. The applicant advanced nothing further in
relation to this complaint and, given the absence of evidence, I cannot be satisfied
that this complaint was made in 2020.
6. The Registrar did not identify the 6 July complaint, nor is this referred to in the
ICO’s Response. Nevertheless, the evidence before me clearly establishes that the
applicant made a complaint to the ICO on 6 July 2020 in relation to the Trust (such
complaint being headed “Article 16 right to rectification request”).
7. In summary, I therefore conclude that the applicant made complaint to the ICO
regarding the Trust on 6 July, 17 August, and 30 August 2020 - the latter complaint
being a repeat of the 17 August complaint.
The Case Management Directions
8. As already alluded to, the Tribunal Registrar issued Case Management Directions
on 3 November 2020, inter alia, listing the matter for a Case Management Hearing.
Paragraph 8 of the Registrar’s Directions state as follows:
“It is possible that the Judge presiding over the Case Management Hearing
will be able to make a final determination of the application. …”
The ICO’s Response
9. Paragraph 22 of the ICO’s response to the instant proceedings states:
“On 16 November 2020 an ICO officer wrote to the Applicant to advise that this
matter had been allocated to a case officer, who will review the matter and contact
the Applicant in due course [Annex 4].”
10. Annex 4 to the Response contains a letter to the applicant from the ICO, dated 16
November 2020. It is headed with a case reference number that relates to the
applicant’s complaint about Cumbria Police, and it is to that complaint that the
substantial part of the letter relates. This letter does, however, also refer to the
2
complaint about the Trust (IC-53642-Q3V2) but only by (i) stating that a case
reference number had been set up in relation to such complaint (ii) asserting that
the case “has now been allocated” and (iii) indicating that another case officer would
contact the applicant separately in relation to the complaint.
11. No information is provided in the letter as to the dates of the complaint that is
being referenced, the nature or substance of such complaint, the timeline for any
further contact with the applicant and what action if any the ICO intends to take
in relation to the complaint.
12. The applicant states, and I accept, that he has had no further communication from
the ICO in relation to the complaints against the Trust, since the letter of the 16
November 2020.
Law
13. So far as material, the Data Protection Act 2018 (“2018 Act”) provides that:
“165 Complaints by data subjects
(1) Articles 57(1)(f) and (2) and 77 of the GDPR (data subject’s right to
lodge a complaint) confer rights on data subjects to complain to the
Commissioner if the data subject considers that, in connection with
personal data relating to him or her, there is an infringement of the
GDPR.
(2) A data subject may make a complaint to the Commissioner if the data
subject considers that, in connection with personal data relating to him
or her, there is an infringement of Part 3 or 4 of this Act.
(3) The Commissioner must facilitate the making of complaints under
subsection (2) by taking steps such as providing a complaint form which
can be completed electronically and by other means.
(4) If the Commissioner receives a complaint under subsection (2), the
Commissioner must—
(a) take appropriate steps to respond to the complaint,
(b) inform the complainant of the outcome of the complaint,
(c) inform the complainant of the rights under section 166, and
(d) if asked to do so by the complainant, provide the complainant
with further information about how to pursue the complaint.
(5) The reference in subsection (4)(a) to taking appropriate steps in
response to a complaint includes—
3
(a) investigating the subject matter of the complaint, to the extent
appropriate, and
(b) informing the complainant about progress on the complaint,
including about whether further investigation or co-ordination
with another supervisory authority or foreign designated
authority is necessary.
(6) …
(7) In this section—
…
“supervisory authority” means a supervisory authority for the purposes
of Article 51 of the GDPR or Article 41 of the Law Enforcement Directive
in a member State other than the United Kingdom.
166 Orders to progress complaints
(1) This section applies where, after a data subject makes a complaint
under section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress
on the complaint, or of the outcome of the complaint, before the end
of the period of 3 months beginning when the Commissioner
received the complaint, or
(c) if the Commissioner’s consideration of the complaint is not
concluded during that period, fails to provide the complainant with
such information during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an
order requiring the Commissioner—
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the
outcome of the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a
period specified in the order.
(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a)
as it applies for the purposes of section 165(4)(a)” (emphasis added)
4
14. The extent to which it is appropriate to investigate any complaint is a matter for
the respondent (the ICO) to determine. The limited nature of the Tribunal’s
jurisdiction in this context has been confirmed by the Upper Tribunal, most
recently in Scranage v Information Commissioner [2020] UKUT 196 (AAC) in
which Upper Tribunal Judge Wikeley observed at paragraph 6:
“.. there is a widespread misunderstanding about the reach of section 166. Contrary
to many data subjects’ expectations, it does not provide a right of appeal against the
substantive outcome of the Information Commissioner’s investigation on its merits.
Thus, section 166(1), which sets out the circumstances in which an application can
be made to the Tribunal, is procedural rather than substantive in its focus. This is
consistent with the terms of Article 78(2) of the GDPR (see above). The prescribed
circumstances are where the Commissioner fails to take appropriate steps to
respond to a complaint, or fails to update the data subject on progress with the
complaint or the outcome of the complaint within three months after the
submission of the complaint, or any subsequent three month period in which the
Commissioner is still considering the complaint.” (emphasis added)
15. The Tribunal can make an Order requiring the respondent to investigate or
conclude an investigation of a complaint if she has not done so (the ‘appropriate
steps’ referred to in s. 166(2)(a)), or to provide the complainant with an update,
including an update as to outcome if there has been one (section 166(2)(b)).
Discussion
16. The lodging of the instant application by the applicant was in time - see rule
22(6)(f) of the Tribunal Procedure (General Regulatory Chamber) Rules 2009
(“2009 Rules”).
17. As indicated above, the respondent chose not to attend the hearing of the 16
December 2020, despite the indication in the Registrar’s directions that the
application could be finally disposed of at that hearing. The Registrar’s directions
did not limit that final disposal to one which favoured the respondent.
18. As can be seen from that which follows, I have decided to accede to the applicant’s
application and make an order under section 166(2) of the 2018 Act. Nothing arose
at the hearing which was not foreshadowed in the applicant’s written submissions
to the Tribunal or communications to the ICO and, consequently, having
considered all the circumstances of the case in conjunction with the 2009 Rules,
and in particular rule 2 thereof, I conclude that it is fair and just to determine this
application in the applicant’s favour (for the reasons given below) despite the
ICO’s absence from the hearing.
19. Turning then to the substance of my decision. It is not in dispute that the applicant
made at least one complaint to the ICO of a type which is captured within section
165(2) of the 2018 Act. Whilst the ICO acknowledges that a complaint was made
on 17 August (and repeated on 30 August 2020), I also find that a complaint was
made on 6 July 2020.
5
20. The issue before me is whether, given the letter of 16 November, there is now any
basis upon which the Tribunal could make an order under 166(2) of the 2018 Act
in this matter. I conclude not only can the Tribunal make such an order, but that it
should do so.
21. Taking the ICO’s Response and letter of 16 November 2020 together, it is clear that
the ICO has not taken cognisance of the 6 July 2020 complaint about the Trust.
Whilst the Response identifies a complaint made by the applicant on 6 July, that
complaint is said to relate to Cumbria Police and not the Trust. As such, it cannot
be said on the evidence before me that the ICO has taken any steps to respond to
the complaint of 6 July.
22. Furthermore, I do not accept that simply communicating the fact that the ICO has
allocated a case reference number and a case officer to the applicant’s complaints
of 17 August and 30 August, constitutes the ICO taking appropriate steps to
respond to those complaints. The term ‘appropriate steps’ is defined as including
those matters set out in section 165(5) of the 2018 Act. Although the definition
therein is not exhaustive, it would be remarkable if the actions of the ICO in the
instant case were seen to be ‘appropriate steps’ for the purpose of section 165.
23. As at the date of the hearing before the FtT, more than 5 months had passed since
the complaint of the 6 July and nearly 4 months had passed since the compliant of
17 August. Despite this, the applicant has still not been informed as to whether
any action (by way of investigation or otherwise) is to be taken by the ICO in
relation to the complaints. If this is not a case to which the reach of section 166
extends, then it is difficult to see in what circumstances the remedy can be
deployed.
24. I find that the ICO has not taken appropriate steps to respond to the complaints.
Decision
25. For the reasons given above, I accede to the applicant’s application and make the
following Order under section 166(2) of the 2018 Act:
(i) The Information Commissioner must, within 21 calendar days of
the date that this Decision is sent to her by the Tribunal, inform
the applicant as to whether she is going to investigate the
applicant’s complaints about the Trust of 6 July 2020, 17 August
2020, and 30 August 2020.
(ii) If the Commissioner is to investigate any or all of these
complaints, she must inform the applicant of the progress of the
investigation no less frequently than every 21 calendar days
thereafter, until such time as there is an outcome to the complaints.
signed
M O’Connor Dated: 20 December 2020
Upper Tribunal Judge O’Connor Date promulgated: 20 December 2020
6