Appeal number: QJ/2021/0003
P1
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
Clive Britton Applicant
- and -
Information Commissioner Respondent
Before:
JUDGE LYNN GRIFFIN
Sitting in Chambers on 25 March 2021
Determined on the papers
DECISION
1. This application is made significantly out of time and I refuse to extend
the time limit.
2. In the alternative, Mr Britton’s application is struck out pursuant to rule
8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory
Chamber) Rules 2009, on the grounds that there is no reasonable prospect of it
succeeding.
1
P: paper determination which is not provisional
QJ/2021/0003
MODE OF DETERMINATION
3. A case management hearing was due to be held by the cloud video
platform on 19 March 2021, but Mr Britton indicated that he would not be
attending, in his email of 8 March 2021.
4. The Respondent had also indicated that she did not propose to attend the
hearing.
5. The Tribunal may make a decision without a hearing pursuant to rule 32
where that decision disposes of proceedings under rule 8 (striking out a party's
case). I am satisfied that it is fair and just to proceed in this way.
REASONS
Background to the Application
6. This application is set against a complex history of events beginning in
2013. I do not propose to set them out in this decision in any detail.
7. The application by Mr Britton relates to concerns he raised with the
Respondent about how the Foreign and Commonwealth Office (‘FCO’) had
dealt with his subject access request (SAR). On 6 August 2019 a case was set up
by the Respondent, reference RFA0863692, following receipt of the Applicant’s
e-mails dated 1 and 2 August 2019 about his concerns
The Application to the Tribunal
8. In his notice of application to this Tribunal, dated 6 January 2021, Mr
Britton said he was asking that
“the GRC issues an order to the ICO to investigate this entire case for
possible criminal data breaches, corruption and perversion of the course of
justice and that those in the ICO responsible for reporting any crimes to the
relevant law enforcement agencies do so immediately. I would also like to
request that the GRC reports any data crimes, corruption and perversion of
the course of justice in this case handled by the ICO”
9. Mr Britton said that the outcome he would like was
2
QJ/2021/0003
“disclosure of data relating to crimes committed against Susan Britton and
I by HMPPS.”
10. The Notice of Appeal was stated to be in relation to the Information
Commissioner’s Reference RFA 0863692, but he did not send any
documentation in relation to RFA 08633692 but instead sent a Decision Notice,
reference FS50883623 dated 08 July 2020, in relation to a Freedom of
Information Act request.
11. The Registrar made directions to gather information to determine if the
Tribunal had jurisdiction in this matter2. The Registrar told Mr Britton that
where the Tribunal has no jurisdiction, it must strike out the proceedings
pursuant to Rule 8(2)(a), The Tribunal Procedure (First-tier Tribunal) (General
Regulatory Chamber) Rules 2009. Mr Britton was directed to provide a
Decision Notice in relation to the RFA 0863692 no later than 1 February 2021 or
to explain this Tribunal had jurisdiction to the deal with this matter.
Considering further information provided, the Registrar then formed the view
that the application was made under section 166 Data Protection Act 2018.
12. Section 166 is the only possible way that the Tribunal could have the
power to deal with Mr Britton’s application. The Tribunal has no power to deal
with a challenge to the outcome of a complaint to the Information
Commissioner within the data protection context.
13. Mr Britton provided 23 supporting documents with his notice of appeal;
I have read these, and the subsequent material received from Mr Britton. As he
is a litigant in person, having regard to the Equal Treatment Bench book and to
the overriding objective, I have carefully considered the material to determine
whether there is any other remedy that the Tribunal has power to provide in
relation to his application in this case.
14. Mr Britton has provided documentation in relation to more than one
government department, several public authorities, and individuals. These are
not all relevant to the application he makes about complaint reference RFA
0863692 but form part of the complex factual background.
15. The documents reveal that Mr Britton and his wife have made subject
access requests, Freedom of Information Act requests and complaints to
2
See Registrar’s Case Management Directions of 18 January 2021
3
QJ/2021/0003
different regulators, to the police and to government about their concerns
arising from events which began in 2013. Some of these matters have resulted
in applications to this Tribunal and the Upper Tribunal.
The powers of the Tribunal in s166 applications
16. Since the Data Protection Act 2018 came into force a person can apply to
this Tribunal for an “order to progress complaints” under section 166.
17. A data subject has a right to make a complaint to the Commissioner if they
consider that, in connection with the processing of personal data relating to
them, there is an infringement of the General Data Protection Regulations
[GDPR], and/or Parts 3 or 4 of the Data Protection Act 2018: see Article 77
GDPR, and section 165 (1) & (2) Data Protection Act 2018.
18. Under section 166 Data Protection Act 2018, a data subject has a right to
make an application to the Tribunal if they consider that the Commissioner has
failed to take certain procedural actions in relation to their complaint.
19. Section 166 DPA18 as relevant states:
166 (1) This section applies where, after a data subject makes a complaint
under section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on
the complaint, or of the outcome of the complaint, before the end of the
period of 3 months beginning when the Commissioner received the
complaint, or
(c) if the Commissioner’s consideration of the complaint is not
concluded during that period, fails to provide the complainant with
such information during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order
requiring the Commissioner—
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the
outcome of the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order;
4
QJ/2021/0003
(b) to conclude an investigation, or take a specified step, within a
period specified in the order.
20. The Tribunal can only exercise powers given to it by Parliament as set out
in legislation. When considering an application under s.166 the Tribunal is not
concerned with the merits or strength of the underlying complaint.
21. Section 166 Data Protection Act 2018 does not provide a right of appeal
against the substantive outcome of an investigation into a complaint under
s.165 Data Protection Act 2018. Neither does it allow the Tribunal to direct to
what extent it is appropriate to investigate any complaint; that is a matter for
the Information Commissioner.
22. On an application under s.166 Data Protection Act 2018 the Tribunal is
limited to considering whether to make an order of the kinds set out in s.166(2).
Once the Information Commissioner has sent an outcome to the complaint
there is no longer an Order for the Tribunal to make under s.166(2).
23. The powers of the Tribunal in considering such applications have been
considered by the Upper Tribunal. These cases are binding on the First Tier
Tribunal of which the General Regulatory Chamber is a part.
24. In Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC)
Upper Tribunal Judge Wikeley said at paragraph 31
“Appropriate steps” mean just that, and not an “appropriate outcome”.
Likewise, the FTT’s powers include making an order that the Commissioner
“take appropriate steps to respond to the complaint”, and not to “take
appropriate steps to resolve the complaint”, least of all to resolve the matter to
the satisfaction of the complainant.”
25. Further in the case of Scranage v Information Commissioner [2020] UKUT
196 (AAC) the Upper Tribunal went further in saying:
“... there is a widespread misunderstanding about the reach of section 166.
Contrary to many data subjects’ expectations, it does not provide a right of
appeal against the substantive outcome of the Information Commissioner’s
investigation on its merits. Thus, section 166(1), which sets out the
circumstances in which an application can be made to the Tribunal, is
procedural rather than substantive in its focus. This is consistent with the
5
QJ/2021/0003
terms of Article 78(2) of the GDPR (see above). The prescribed circumstances
are where the Commissioner fails to take appropriate steps to respond to a
complaint, or fails to update the data subject on progress with the complaint or
the outcome of the complaint within three months after the submission of the
complaint, or any subsequent three month period in which the Commissioner
is still considering the complaint.”
26. It may be that Mr Britton thought that this Tribunal has the power to
consider an application about the substantive outcome of the Information
Commissioner’s investigation. He is not alone in thinking that, as has been
acknowledged by the Upper Tribunal in the decision in Scranage, but the
Tribunal is limited in its powers to those given by Parliament as interpreted by
the Upper Tribunal.
27. A person who wants a data controller (or processor) to rectify personal
data or otherwise properly comply with the Data Protection Act 2018 or
General Data Protection Regulations in relation to holding personal data must
go to the High Court or a County Court pursuant to section 180 of the Data
Protection Act 2018.
28. This Tribunal does not have an oversight function in relation to the
Information Commissioner’s Office and does not hold them to account for their
internal processes. The Parliamentary and Health Service Ombudsman is the
body which has that function.
The Response to the Complaint RFA 0863692
29. On 6 August 2019 the Respondent set up a case reference RFA0863692
following receipt of the Applicant’s e-mails dated 1 and 2 August 2019 relating
to his concerns about how the Foreign and Commonwealth Office (‘FCO’) had
dealt with his SAR.
30. The Information Commissioner took the following steps in relation to Mr
Britton’s complaint reference RFA 0863692.
a) On 15 August 2019 a case officer was allocated to the case and an e-mail
sent to the Applicant in relation to his concern about the FCO’s response
of 1 August 2019 regarding his SAR. The case officer set out her
understanding that the Applicant would like to know whether he is
entitled to be told the identity of the individual at the FCO who disclosed
information to the Cabinet Office and that the Applicant had not
6
QJ/2021/0003
received any of the information requested in his SAR. Mr Britton was
told that
i. the FCO claimed to have investigated the Applicant’s concerns
and had reassured the Applicant that he had been provided with
all the information held.
ii. it was the Commissioner’s view that the response he received
from the FCO addressed his concerns about outstanding personal
data and as an evidence-based regulator, the Commissioner was
not able to dispute when a Controller says they do not hold
information, unless there is sufficient evidence to suggest
otherwise.
iii. under a subject access request an individual is entitled only to see
the personal information a Controller holds about them. In
certain circumstances it is acceptable for a Controller to provide
third party information in response to a SAR, such as if the
information is already known to the individual or the
organisation has gained consent from the third party to disclose
their data, however they are not legally obligated to disclose third
party data in any case.
iv. there was no further action the ICO could take regarding the
Applicant’s data protection concern at that time. However, if the
Applicant had further outstanding concerns regarding the SAR
to the FCO, he was invited to provide further detail.
b) On 15 August 2019 the Applicant responded to the case officer advising
he still had several outstanding concerns over the FCO’s handling of his
data and it had still not provided the data the Applicant has requested.
c) On 16 August 2019 the case officer responded to Mr Britton’s request for
clarity about whether the Commissioner considered the Applicant’s e-
mail of 1 August 2019 sent by the ‘Internal CO’ to be in violation of s170
of the Data Protection Act 2018. It was the Commissioner’s view that
the e-mail sent did not appear to be a violation of the provision because
there was insufficient evidence to suggest that the Applicant’s personal
data was unlawfully shared to the Cabinet Office by an individual at the
FCO. The case officer also explained that the Cabinet Office had
7
QJ/2021/0003
confirmed that reference to the Applicant in that e-mail was a typo, and
that the Applicant’s data does not actually appear in that e-mail. The
case officer concluded that the FCO have complied with their data
protection obligations in the handing of the Applicant’s subject access
request and the Commissioner considered this matter closed.
d) On 16 August 2019 the Applicant e-mailed to say he would be appealing
the decision of the Commissioner to the GRC.
e) On 29 August 2019 the case officer reiterated that the Commissioner’s
view and advised the Applicant that he had the right to take legal action
regardless of the Commissioner’s view. The case officer highlighted that
if the Applicant was interested in pursuing his rights under Articles 79
and 82, he should seek independent legal advice. Finally, the case officer
advised the Applicant that he was entitled to request a case review.
f) On 31 August 2019 the Applicant e-mailed the case officer requesting a
review of his case.
g) On 9 September 2019 the case officer responded providing a further
explanation of her findings and offering to set up a case review if the
Applicant remained dissatisfied.
h) On 10 September 2019 the Applicant e-mailed to acknowledge the e-
mail of 9 September 2019. The Applicant stated his view that the case
officer had “not fully grasped” his complaints and he would be making
an appeal to the GRC.
The Respondent’s submissions
31. The Information Commissioner submits
a) Rule 22(6)(f) Tribunal Rules requires that the notice of appeal in an
application under section 166(2) of the Data Protection Act 2018 is
received within 28 days of the expiry of six months from the date
on which the Commissioner received the complaint. The complaint
given reference RFA0863692 was made on 1 August 2019. This
Notice of Appeal was submitted on 7 January 2021. It is therefore
significantly out of time and should be struck out.
8
QJ/2021/0003
b) The application has no prospect of success and the Tribunal is
invited to strike out the application under rule 8(3)(c) of the
Tribunal Rules.
c) In the alternative, it is submitted that the Application should be
dismissed on the basis that the Applicant has received a
substantive response in relation to his complaint.
Ruling
32. The Tribunal has a discretion under Rule 5 to regulate its own procedure
which includes the extension of time for compliance with any other rule under
rule 5(3)(a). Although Mr Britton makes no explicit application for an extension
of time, it is implied in the making of the application.
33. Therefore, I have considered the relevant case law in deciding whether to
exercise that discretion. That is the Upper Tribunal’s decisions in Data Select
Limited v HMRC [2012] UKUT 187 (TCC) and Leeds City Council v HMRC [2014]
UKUT 0350 (TCC) and BPP University College of Professional Studies v HMRC
[2014] UKUT 496 (TCC) in which the Data Select principles were applied.
34. The proper course for a tribunal in considering this type of application is
to follow the principles, as described by Morgan J in Data Select at paragraph
34 where he said
[34] … Applications for extensions of time limits of various kinds are
commonplace and the approach to be adopted is well established. As a general
rule, when a court or tribunal is asked to extend a relevant time limit, the court
or tribunal asks itself the following questions: (1) what is the purpose of the time
limit? (2) how long was the delay? (3) is there a good explanation for the delay?
(4) what will be the consequences for the parties of an extension of time? and (5)
what will be the consequences for the parties of a refusal to extend time. The court
or tribunal then makes its decision in the light of the answers to those questions.
35. Applying those five principles, I have concluded that
a) The purpose of the time limit for bringing an appeal to the Tribunal is
to preserve the important principle of finality. The Respondent was
entitled to regard the matter as closed.
b) The delay was significant. The notice of appeal was received over 11
months outside the specified time limit.
9
QJ/2021/0003
c) There is no explanation for the delay given by Mr Britton.
d) Granting an extension of time would allow Mr Britton to bring his case
but that must be weighed against the resource (time and financial)
implications to the Respondent of re-opening a matter that was
reasonably regarded as concluded. As well as the detriment to the
consistent application of the tribunal rules.
e) A refusal to grant an extension of time will mean that Mr Britton will
lose his opportunity to make an application, but this must be seen in
the context of all the circumstances and in particular the limitations on
this Tribunal’s ability to deal with his application.
36. This Tribunal has no power to order the ICO to investigate this entire case
for possible criminal data breaches, corruption, and perversion of the course of
justice, nor to order those in the ICO responsible for reporting any crimes to the
relevant law enforcement agencies do so.
37. This Tribunal’s jurisdiction does not extend to the investigation of Mr
Britton’s allegations nor the reporting of any data crimes, corruption and/or
perversion of the course of justice after such an investigation.
38. The Respondent has provided an outcome to the complaint made by Mr
Britton on 1 August 2019 reference RFA 0863692 and has completed a review
of that outcome. Thus, there is no order under s166 Data Protection Act that
can be made. In other words, the application brought by Mr Britton to this
Tribunal is hopeless because of the limitations on the Tribunal set out above.
39. Therefore, even if I were to grant an extension of time to bring this
application it would immediately be struck out as having no reasonable
prospects of success.
Conclusion
40. The application is made significantly out of time and I refuse to extend
time for it to be made.
41. In any event, in order for Mr Britton’s application to proceed there must
be a realistic prospect of its success. For the reasons set out above, I have
concluded that this Tribunal would not be able to provide Mr Britton with the
outcome(s) he seeks and that therefore the application is hopeless, or in other
10
QJ/2021/0003
words has no reasonable prospect of success. This Tribunal can only act within
the scope of its power and cannot provide Mr Britton with the remedy he seeks.
42. Having taken account of all relevant considerations, I strike out this
application pursuant to 8(3)(c) of the Tribunal Procedure (First-tier Tribunal)
(General Regulatory Chamber) Rules 2009 because there is no reasonable
prospect of the application succeeding.
Tribunal Judge Lynn Griffin
Date of Decision: 25 March 2021
Date Promulgated: 26 March 2021
© CROWN COPYRIGHT 2021
11