Appeal number: QJ/2021/0002
P1
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
Susan Britton Applicant
- and -
The Information Commissioner Respondent
Before:
JUDGE LYNN GRIFFIN
Determined on the papers, sitting in Chambers 13 April 2021
DECISION
1. Mrs Britton’s application is struck out pursuant to rule 8(3)(c) of the
Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules
2009, on the grounds that there is no reasonable prospect of it succeeding.
1
P: paper determination which is not provisional
Appeal number QJ/2021/0002
MODE OF HEARING
2. The proceedings were due to be held by the cloud video platform on 13
April 2021. Mrs Britton had indicated that she was not intending to participate.
The Tribunal checked her intention on 12 April 2021, and she confirmed by
email of 13 April 2021 at 07.06 that she would not be attending the hearing. The
Respondent had indicated that she did not propose to attend the hearing.
3. The Tribunal may make a decision without a hearing pursuant to rule 32
where that decision disposes of proceedings under rule 8 (striking out a party's
case).
4. The parties having indicated that they would not be attending and having
read all the documents including, the submissions of the Respondent in her
response and of the Applicant’s emails and attachments2, I am satisfied that it
is fair and just to proceed in this way.
REASONS
Background to the Application
5. There is a complex history of events that form the background to this
application. It is not necessary to set them out in this decision in any detail, but
this application has its origins in Mrs Britton’s experiences in 2013 in
Switzerland, since which time she has determinedly pursued a satisfactory
resolution of her complaints. This has resulted in a number of applications to
this Tribunal and frequent correspondence with various organisations and
public figures; the information she has sent to the Tribunal demonstrates that
she has made complaints to different regulators, to the police and to
government about her concerns. Mrs Britton has worked tirelessly to achieve a
resolution she is content with and says in her email of 14 February 2021 that
she has worked up to ten hours each day since 2013 on the issues. I do not doubt
that this is so.
2
Mrs Britton has written to the tribunal on many occasions since making her application. I have
read each email and their attachments.
2
Appeal number QJ/2021/0002
The Application to the Tribunal
6. In her notice of application to this Tribunal, dated 31 December 2020, Mrs
Britton makes an application as regards the Respondent’s decision notice
reference IC-52453-N8K4. The Applicant said3
“In the absence of an insistence by the GRC that the FCO discloses evidence
that irrefutably exists, I am now required to submit an application about Lord
Ahmad of Wimbledon - who has taken it upon himself to involve himself in my
case, to access data without my permission, to falsely profile me - and to
represent the FCO. I had fully expected a reply well before the 28 days, and I
had fully expected that the GRC would insist that the ICO discloses the results
of its investigation into the FCO, so that there would be no need to submit this
complaint about Lord Ahmad of Wimbledon.
7. In her notice of application Mrs. Britton said that she would like the
following remedy from the Tribunal
“I would therefore, like to request that the GRC issues an order to the ICO to
investigate this entire case for possible criminal data breaches, corruption and
perversion of the course of justice and that those in the ICO responsible for
reporting any crimes to the relevant law enforcement agencies do so
immediately. I would also like to request that the GRC reports any data crimes,
corruption and perversion of the course of justice in this case handled by the
ICO… to the relevant law enforcement agencies.”
8. The application was interpreted by the Tribunal as an application under
section 166 Data Protection Act 2018.
9. Mrs Britton is a litigant in person. Having regard to the Equal Treatment
Benchbook and to the overriding objective, I have carefully considered her
emails to examine whether there is any other remedy that she seeks that the
Tribunal has power to provide.
10. In the response to the application the Information Commissioner invited the
Applicant to withdraw her application because she had received an outcome
to her complaint but in the event she did not do so, the Information
Commissioner has applied for this case to be struck out pursuant to rule 8(3)(a)
3
As written by Mrs Britton
3
Appeal number QJ/2021/0002
of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber)
Rules 2009. It is argued that as there has been an outcome provided to Mrs
Britton, the Tribunal no longer has any power to make an order under s166 and
thus her application has no reasonable prospect of succeeding.
11. The Applicant not having withdrawn her appeal I now consider the
application to strike out these proceedings on the basis that they have no
reasonable prospects of success.
The powers of the Tribunal in s166 applications
12. Since the Data Protection Act 2018 came into force a person can apply to this
Tribunal for an “order to progress complaints” under section 166.
13. A data subject has a right to make a complaint to the Commissioner if they
consider that, in connection with the processing of personal data relating to
them, there is an infringement of the General Data Protection Regulations
[GDPR], and/or Parts 3 or 4 of the Data Protection Act 2018: see Article 77
GDPR, and section 165 (1) & (2) Data Protection Act 2018.
14. Under section 166 Data Protection Act 2018, a data subject has a right to
make an application to the Tribunal if they consider that the Commissioner has
failed to take certain procedural actions in relation to their complaint.
15. Section 166 DPA18 as relevant states:
166 (1) This section applies where, after a data subject makes a complaint
under section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on
the complaint, or of the outcome of the complaint, before the end of the
period of 3 months beginning when the Commissioner received the
complaint, or
(c) if the Commissioner’s consideration of the complaint is not
concluded during that period, fails to provide the complainant with
such information during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order
requiring the Commissioner—
(a) to take appropriate steps to respond to the complaint, or
4
Appeal number QJ/2021/0002
(b) to inform the complainant of progress on the complaint, or of the
outcome of the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a
period specified in the order.
16. The Tribunal can only exercise powers given to it by Parliament as set out
in legislation. When considering an application under s.166 the Tribunal is not
concerned with the merits or strength of the underlying complaint.
17. Section 166 Data Protection Act 2018 does not provide a right of appeal
against the substantive outcome of an investigation into a complaint under
s.165 Data Protection Act 2018.
18. On an application under s.166 Data Protection Act 2018 the Tribunal is
limited to considering whether to make an order of the kinds set out in s.166(2).
Once the Information Commissioner has provided an outcome to the complaint
there is no longer an Order for the Tribunal to make under s.166(2).
19. The powers of the Tribunal in considering such applications have been
considered by the Upper Tribunal. These cases are binding on the First Tier
Tribunal of which the General Regulatory Chamber is a part.
20. In Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC) Upper
Tribunal Judge Wikeley said at paragraph 31
“Appropriate steps” mean just that, and not an “appropriate outcome”.
Likewise, the FTT’s powers include making an order that the Commissioner
“take appropriate steps to respond to the complaint”, and not to “take
appropriate steps to resolve the complaint”, least of all to resolve the matter to
the satisfaction of the complainant.”
21. Further in the case of Scranage v Information Commissioner [2020] UKUT 196
(AAC) the Upper Tribunal went further in saying :
“... there is a widespread misunderstanding about the reach of section 166.
Contrary to many data subjects’ expectations, it does not provide a right of
appeal against the substantive outcome of the Information Commissioner’s
investigation on its merits. Thus, section 166(1), which sets out the
5
Appeal number QJ/2021/0002
circumstances in which an application can be made to the Tribunal, is
procedural rather than substantive in its focus. This is consistent with the terms
of Article 78(2) of the GDPR (see above). The prescribed circumstances are
where the Commissioner fails to take appropriate steps to respond to a
complaint, or fails to update the data subject on progress with the complaint or
the outcome of the complaint within three months after the submission of the
complaint, or any subsequent three month period in which the Commissioner is
still considering the complaint.”
22. Many members of the public think that this Tribunal has the power to
consider an application about the substantive outcome of the Information
Commissioner’s investigation, as has been acknowledged by the Upper
Tribunal in the decision in Scranage, but the Tribunal is limited in its powers
to those given by Parliament as interpreted by the Upper Tribunal.
23. A person who wants a data controller (or processor) to rectify personal data
compensate them or otherwise properly comply with the Data Protection Act
2018 or General Data Protection Regulations in relation to personal data must
go to the civil courts4 not a tribunal pursuant to sections 167-169 & 180 of the
Data Protection Act 2018. I express no opinion one way or another about
whether Mrs Britton can do so, or whether she should do so; that is a matter for
her, about which this Tribunal cannot advise her.
24. This Tribunal does not have an oversight function in relation to the
Information Commissioner’s Office and does not hold them to account for their
internal processes. The Parliamentary and Health Service Ombudsman is the
body which has that function. I express no opinion one way or another about
whether she can or whether she should raise the issue with the Ombudsmen;
again, that is a matter for her, about which this Tribunal cannot advise her.
The Facts
25. On 16 August 2020 the Applicant sent the Respondent an e-mail and in this
and subsequent e-mails she complained about Lord Ahmad, acting in this
capacity as Minister responsible for Transparency and Data at the Foreign and
Commonwealth Office (‘FCO’).
4
High Court or County Court
6
Appeal number QJ/2021/0002
26. On 26 August 2020 the Respondent’s case officer set up case reference IC-
52453-N8K4 to address the Applicant’s complaint that Lord Ahmad accessed
her personal data without her permission. Mrs Britton’s belief appears to stem
from when an MP had contacted FCO on her behalf, and on 9 April 2020 Lord
Ahmad responded for FCO, explaining to the MP that the Applicant had
contacted various individuals/organisations and that the FCO believed it had
provided all of the personal data it is able to provide in relation to the
Applicant’s requests.
27. On 26 August 2020 the case officer provided a response to the complaint
made by the Applicant. He told Mrs Britton that he was of the view that she
had not raised any data protection concerns the Commissioner needed to
pursue. The case officer explained this was because he did not share the
Applicant’s view that Lord Ahmad has accessed the Applicant’s personal data
unlawfully. The case officer explained Lord Ahmad responded to an MP’s
enquiries, made at the Applicant’s request and that Lord Ahmad’s comments
regarding the different individuals/organisations to whom the Applicant had
complained appeared to be based on information the Applicant had sent to the
FCO in the course of the Applicant’s dealings with FCO, and records held by
the FCO of the Applicant’s correspondence with them.
28. The applicant requested a case review of the outcome to her complaint and
after some delay due to administrative oversight and the volume of material to
consider the result of the case review was provided on 3 November 20205. The
reviewing case officer had
a) reviewed the information relating to the data protection complaint
and considered the points the Applicant had raised;
b) considered whether the complaint was dealt with reasonably;
c) considered whether the matter was handled in line with the
Commissioner’s casework processes; and
d) considered whether there are any outstanding matters for the
Commissioner to pursue.
29. Thereviewing case officer referred to the Applicant’s initial e-mail
complaint and request that the Commissioner “investigate[s] alleged criminal
5
There is no dispute that this was received by the Applicant as it forms part of the
email chains sent to the Tribunal for the purposes of this application, such as the email of
22/02/2021
7
Appeal number QJ/2021/0002
data breaches as well as failures to disclose information on investigations it (the
Commissioner) has conducted” and told the Applicant that she could see that
in the case officer’s email to the Applicant of 26 August, the case officer had
acknowledged the Applicant’s concerns about Lord Ahmad.
30. The reviewing case officer noted that the Applicant was dissatisfied with
the way the case officer had handled the Applicant’s complaint about Lord
Ahmad. However, the reviewing case officer, having considered all the
correspondence available, as well as the case officer’s view, confirmed she was
upholding the decision the case officer had reached, and was satisfied that the
case officer had provided the Applicant with the correct outcome.
31. In concluding the case review the reviewing case officer stated that she
considered that the case officer had handled the Applicant’s complaint
reasonably and in accordance with the Commissioner’s casework processes.
32. The Applicant was informed by the case review officer, that if she remained
dissatisfied following this case review, then she would have a right under
Articles 79 and 82 of the GDPR to undertake proceedings through the courts if
she was of the view that her information rights had been infringed. The
Applicant was also advised of her right to refer the Commissioner to The
Parliamentary and Health Service Ombudsman (PHSO) if she thought that she
had been provided with a poor service.
Analysis
33. In an email of 23 February 2021, the Applicant says that the Tribunal
appears to her to be “grasping at straws” to strike out “substantively evidenced
allegations” of data breaches. However, this submission does not recognise the
scope of this Tribunal’s powers; this Tribunal has no power to consider the
substance of allegations of data breaches made by a data subject or to provide
any remedy.
34. The legal principles limiting the powers of the Tribunal in this case, can be
distilled as follows; once an outcome to her complaint was provided to Mrs
Britton then the Tribunal has no further power to direct steps be taken, the
complaint reinvestigated or to consider whether the outcome provided was
correct as a matter of law or fact.
8
Appeal number QJ/2021/0002
35. Mrs Britton was provided with a response to her complaint on 26 August
2020 and this outcome was reviewed and upheld under the Respondent’s case
review process on 3 November 2020. The Applicant does not agree with the
outcome, but this Tribunal has no power to consider an appeal against the
Information Commissioner’s substantive findings.
36. The Tribunal has no power to do what Mrs Britton is asking for; there is no
power to investigate a data subject’s allegations of accessing data without
permission, or to profile her in an inaccurate way. This Tribunal’s jurisdiction
does not extend to the investigation of Mrs Britton’s allegations nor the
reporting of any data crimes, corruption and perversion of the course of justice
subsequent to such an investigation.
37. This Tribunal has no power to order the ICO to
a) investigate a case for possible criminal data breaches, corruption
or perversion of the course of justice
b) provide evidence of the extent of their investigation for the
purposes of transparency or otherwise
c) justify the decisions taken whilst responding to Mrs. Britton’s
allegations of data breach.
38. On 10 March 2021 Mrs Britton wrote to the tribunal asking that the Tribunal
direct that she was provided with all the evidence of data held but not disclosed
by the FCO. Mrs Britton may have made a subject access request but that is not
within the scope of this appeal and neither is any Freedom of Information Act
request such as that referred to in Mrs Britton’s email of 11 March 20216.
39. I note the Applicant also alleges in her emails that she has been defamed.
Actions for defamation are dealt with in the courts and not this Tribunal. I
express no opinion one way or another about whether she can, or whether she
should, pursue such an action; again, that is a matter for Mrs Britton about
which this Tribunal cannot advise her.
40. Further, in her email of 9 March 2021 there is reference to an application
being made to the North London Magistrates’ Court about which Mrs Britton
has been asked to provide concise particulars. For the avoidance of doubt this
6
IC-39289-C1M6
9
Appeal number QJ/2021/0002
tribunal has no power to investigate any criminal allegation, which are entirely
within the remit of the criminal courts.
Conclusion
41. Turning to s166 DPA18, and this application, the Respondent has
considered the Applicant’s complaint in case reference IC-52453-N8K4, taken
steps as outlined above and informed her of the outcome.
42. The Applicant is not satisfied with that outcome and wishes it to be
reconsidered but it is, nonetheless, an outcome.
43. This Tribunal has no power to make a decision about the merits of that
outcome, whether it be right or wrong. Neither does the Tribunal have power
to examine whether there should be further or different steps to those taken by
the Commissioner. This is the case regardless of the nature of the complaint
made or its evidential basis.
44. Furthermore, the Tribunal does not have any power to supervise or
mandate the performance of the Commissioner’s functions.
45. There is subsequently no basis for the Tribunal to make an order under
section 166(2) DPA18.
46. Having considered whether this tribunal could provide the Applicant with
any other remedy I have concluded that while there may be a remedy available
from the courts (about which I make no conclusions or give any indication)
having considered the nature of the issues raised by Mrs Britton there is no
other remedy available from this Tribunal in relation to the application made
on 31 December 2020.
47. In order for Mrs. Britton’s application of 31 December 2020 to proceed there
must be a realistic prospect of its success. For the reasons set out above, I have
concluded that this Tribunal would not be able to provide Mrs. Britton with the
outcome(s) she seeks and that therefore the application is hopeless, or in other
words has no reasonable prospect of success.
10
Appeal number QJ/2021/0002
48. I know this decision will be a disappointment to Mrs. Britton however, this
Tribunal can only act within the scope of its power and cannot provide her with
the remedy she seeks.
49. Having taken account of all relevant considerations, I strike out this
application pursuant to 8(3)(c) of the Tribunal Procedure (First-tier Tribunal)
(General Regulatory Chamber) Rules 2009 because there is no reasonable
prospect of the application succeeding.
Date: 13 April 2021
Lynn Griffin
Tribunal Judge
Promulgated Date: 14 April 2021
© CROWN COPYRIGHT 2021
11