Appeal number:QJ/2021/0007
V1
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
BRANDON DOLBY Applicant
- and -
INFORMATION COMMISSIONER Respondent
Before:
JUDGE LYNN GRIFFIN
Appearances:
Applicant in person
The Respondent did not attend and was not represented
DECISION
1. The application is struck out pursuant to rule 8(3)(c) of the Tribunal
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009, on
the grounds that there is no reasonable prospect of it succeeding.
1
V: video (all remote)
Appeal number QJ/2021/0007
MODE OF HEARING
2. The proceedings were held by video hearing. The Applicant joined
remotely by telephone and there was no issue with the quality of
communication. The Respondent had indicated that she did not intend to
participate in the hearing. The Tribunal was satisfied that it was fair and just to
conduct the hearing in this way.
3. At the end of the hearing, I reserved judgement. This decision is made as
soon as possible after the publication of the decision in Killock & others v
Information Commissioner, see below. I apologise for the length of time that it
has taken to resolve the application.
REASONS
Background to the Application
4.The background to this application concerns what happened to CCTV that
was captured in a local shop. The shop has stated that they gave it to the police,
however the police say they don’t have it.
5. Mr Dolby believes that the CCTV footage would support his account of
events that occurred in the shop in September 2018, which together with events
in November that year led to police involvement.
The Application to the Tribunal
6. In the notice of application to this Tribunal, dated 15 March 2021 the
Applicant makes an application as regards the Respondent’s case reference
RCC0905820 which is the reference to the case review of the complaint outcome
provided under reference RFA0869556. The Applicant said he was seeking to
raise a right of rectification in relation to data sharing regarding a subject access
request. He wishes the Information Commissioner to investigate to whom
closed circuit TV footage was disclosed and/or whether it was disposed of.
7. In the notice of application, the Applicant said that they would like the
following remedy from the Tribunal
“Compliance orders. To pursue my concern and investigate the data breach.
to establish a footing under section 173 of the DPA 2018 so police can proceed
to prosecute a case.”
2
Appeal number QJ/2021/0007
8. The application was interpreted by the Tribunal as an application under
section 166 Data Protection Act 2018 [DPA18].
9. The Applicant requested an extension of time in which to make his
application due to extenuating circumstance. At the hearing he told me that he
would have applied sooner to the tribunal but was not aware of the possibility.
10. On 18 March 2021 the Registrar made directions as to the resolution of the
application and requiring Mr. Dolby to provide a copy of the decisions he
referred to and the complaints he had made.
11. The Applicant is a litigant in person, due to his health he is a vulnerable
person. Having regard to the Equal Treatment Bench book and to the
overriding objective, I have carefully considered the Applicant’s emails to
examine whether there is any other remedy that they seek that the Tribunal has
power to provide.
12. In the response to the application the Information Commissioner has
applied for
a. the extension of time to be refused given that the application was
made significantly outside the period within which such
applications should be made
b. this case to be struck out pursuant to rule 8(3)(a) of the Tribunal
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules
2009. It is argued that as there has been an outcome provided to the
Applicant, the Tribunal has no power to make an order under s166
and thus the application has no reasonable prospect of succeeding.
The powers of the Tribunal in s166 applications
13. Since the DPA18 came into force a person can apply to this Tribunal for an
“order to progress complaints” under section 166.
14. A data subject has a right to make a complaint to the Commissioner if they
consider that, in connection with the processing of personal data relating to
them, there is an infringement of the General Data Protection Regulations
3
Appeal number QJ/2021/0007
[GDPR] (now the UKGDPR in effect since 31 December 2020), and/or Parts 3
or 4 of the DPA18: see Article 77 [UK]GDPR, and section 165 (1) & (2) DPA2018.
15. Under section 166 DPA18, a data subject has a right to make an application
to the Tribunal if they consider that the Commissioner has failed to take certain
procedural actions in relation to their complaint.
16. Section 166 DPA18 as relevant states:
166 (1) This section applies where, after a data subject makes a complaint
under section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on
the complaint, or of the outcome of the complaint, before the end of the
period of 3 months beginning when the Commissioner received the
complaint, or
(c) if the Commissioner’s consideration of the complaint is not
concluded during that period, fails to provide the complainant with
such information during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order
requiring the Commissioner—
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the
outcome of the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a
period specified in the order.
17. The powers of the Tribunal in considering such applications have been
considered by the Upper Tribunal. These cases are binding on the First Tier
Tribunal of which the General Regulatory Chamber is a part. The latest decision
is that of Killock and Veal & others v Information Commissioner GI/113/2021
& others in which the Upper Tribunal reviewed the case law including the
following cases and approved the approach taken therein.
18. In Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC) Upper
Tribunal Judge Wikeley said at paragraph 31
4
Appeal number QJ/2021/0007
“Appropriate steps” mean just that, and not an “appropriate outcome”.
Likewise, the FTT’s powers include making an order that the Commissioner
“take appropriate steps to respond to the complaint”, and not to “take
appropriate steps to resolve the complaint”, least of all to resolve the matter to
the satisfaction of the complainant.”
19. Further in the case of Scranage v Information Commissioner [2020] UKUT 196
(AAC) the Upper Tribunal went further in saying:
“... there is a widespread misunderstanding about the reach of section 166.
Contrary to many data subjects’ expectations, it does not provide a right of
appeal against the substantive outcome of the Information Commissioner’s
investigation on its merits. Thus, section 166(1), which sets out the
circumstances in which an application can be made to the Tribunal, is
procedural rather than substantive in its focus. This is consistent with the terms
of Article 78(2) of the GDPR (see above). The prescribed circumstances are
where the Commissioner fails to take appropriate steps to respond to a
complaint, or fails to update the data subject on progress with the complaint or
the outcome of the complaint within three months after the submission of the
complaint, or any subsequent three month period in which the Commissioner is
still considering the complaint.”
20. The Tribunal is limited in its powers to those given by Parliament as
interpreted by the Upper Tribunal. As stated in Killock v IC by Mrs Justice
Farbey
74. The remedy in s.166 is limited to the mischiefs identified in s.166(1). We agree
with Judge Wikeley’s conclusion in Leighton (No 2) that those are all procedural
failings. They are (in broad summary) the failure to respond appropriately to a
complaint, the failure to provide timely information in relation to a complaint
and the failure to provide a timely complaint outcome. We do not need to go
further by characterising s.166 as a “remedy for inaction” which we regard as an
unnecessary gloss on the statutory provision. It is plain from the statutory words
that, on an application under s.166, the Tribunal will not be concerned and has
no power to deal with the merits of the complaint or its outcome.
21. The Upper Tribunal went on to say that the First tier Tribunal should firmly
resist any attempt to divert it towards a decision on the merits of the complaint,
paragraph 74.
5
Appeal number QJ/2021/0007
22. This Tribunal may consider whether a step is appropriate; the Information
Commissioner’s view on this will not be determinative but should be taken into
account by this Tribunal and accorded due weight given the Commissioner is
an expert regulator in the best position to decide what investigations she
should undertake into any particular issue and how she should do so. This
Tribunal will not interfere with an exercise of regulatory judgement without
good reason. See Killock paras 84 to 86.
23. The appropriateness of any investigative steps taken is an objective matter
which is within the jurisdiction of this Tribunal. However, as stated in
paragraph 87 of Killock, s.166 is a forward-looking provision, concerned with
remedying ongoing procedural defects that stand in the way of the timely
resolution of a complaint. This Tribunal is tasked with specifying appropriate
“steps to respond” and not with assessing the appropriateness of a response
that has already been given. It will do so in the context of securing the progress
of the complaint in question. It may be possible to wind back the clock and to
make an order for an appropriate step to be taken in response to the complaint
under s.166(2)(a). However, if invited to do so this Tribunal will cast a critical
eye to assure itself that the complainant is not using the s.166 process to achieve
a different complaint outcome.
24. Moreover, the Upper Tribunal said in Killock that if the Commissioner goes
outside her statutory powers or makes any other error of law, it is for the High
Court to correct her on ordinary public law principles in judicial review
proceedings. The assessment of the appropriateness of a response already
given is for the High Court and not this Tribunal. The combination of a
statutory remedy in the Tribunal in relation to procedures and to the
supervision of the High Court in relation to substance provides appropriate
and effective protection to individuals.
25. Furthermore, a person who wants a data controller (or processor) to rectify
personal data, compensate them, or otherwise properly comply with the Data
Protection Act 2018 or General Data Protection Regulations in relation to
personal data must go to the civil courts2 not a tribunal pursuant to sections
167-169 & 180 of the Data Protection Act 2018. I express no opinion one way or
2
High Court or County Court
6
Appeal number QJ/2021/0007
another about whether the Applicant can do so, or whether they should do so;
that is a matter for the Applicant, about which this Tribunal cannot give advice.
26. This Tribunal does not have an oversight function in relation to the
Information Commissioner’s Office and does not hold them to account for their
internal processes. The Parliamentary and Health Service Ombudsman3 is the
body which has that function. The Applicant has already made such an
application, see below.
27. The Tribunal has a discretion whether to extend time under rule 5(3)(a). The
relevant case law in deciding whether to exercise that discretion is set out in
the Upper Tribunal’s decisions in Data Select Limited v HMRC [2012] UKUT
187 (TCC) and Leeds City Council v HMRC [2014] UKUT 0350 (TCC) and BPP
University College of Professional Studies v HMRC [2014] UKUT 496 (TCC) in
which the Data Select principles were applied. See also Killock & others where
this approach was approved.
28. The proper course for a tribunal in considering this type of application is to
follow the principles, as described by Morgan J in Data Select at paragraph 34
[34] … Applications for extensions of time limits of various kinds are
commonplace and the approach to be adopted is well established. As a
general rule, when a court or tribunal is asked to extend a relevant time
limit, the court or tribunal asks itself the following questions: (1) what is
the purpose of the time limit? (2) how long was the delay? (3) is there a
good explanation for the delay? (4) what will be the consequences for the
parties of an extension of time? and (5) what will be the consequences for
the parties of a refusal to extend time. The court or tribunal then makes its
decision in the light of the answers to those questions.
The Facts
29. On 28 August 2019 the Applicant sent the Respondent a complaint about
how he said his personal data had been dealt with, specifically with reference
to the CCTV footage taken in a local shop.
30. The Applicant’s concerns have been the subject substantial correspondence
with the Information Commissioner given Case Reference Numbers
3
Parliamentary and Health Service Ombudsman (PHSO)
7
Appeal number QJ/2021/0007
RFA0869556 and RCC0905820; the latter of which is the reference for the case
review.
31. On 17 October 2019 a case officer wrote to Mr Dolby explaining that the
exact nature of the complaint was unclear, after which he provided further
information.
32. On 25 October 2019 the case officer provided a response to the complaint
made by the Applicant under reference number RFA0869556. He told the
Applicant that in his opinion there was no immediate cause for concern and set
out the transparency requirements in in Part 3 DPA18 for law enforcement
purposes. He offered to consider the matter further over the phone if the
matters raised were not resolved to Mr Dolby’s satisfaction.
33. Mr Dolby responded on 25 January 2020 as he wished to appeal the outcome
provided to him.
34. After some correspondence about what the Applicant was dissatisfied
about. The applicant requested a case review of the outcome to their complaint.
The result of the case review was provided on 7 February 2020 and given case
reference RCC0905820. The reviewing case officer had
a) reviewed the information relating to the data protection concerns
and considered the points the Applicant had raised;
b) considered whether the complaint was dealt with reasonably;
c) considered whether the matter was handled in line with the
Commissioner’s casework processes and case handling
procedures; and
d) considered whether there are any outstanding matters for the
Commissioner to pursue and informed Mr Dolby that before they
could progress the matter further, the ICO would need to see
supporting documentary evidence of
i. his claim that the police had collected the CCTV footage two
days before he was informed that they did not hold that
material
ii. the submission of a subject access request or the raising of a
concern with the police.
35. The reviewing case officer confirmed she agreed with the explanations
provided by the case officer and the steps taken.
8
Appeal number QJ/2021/0007
36. The Applicant was informed by the case review officer, that if he remained
dissatisfied following this case review, then she would have a right under to
undertake proceedings through the courts. The Applicant was also advised of
the right to refer the Commissioner to The Parliamentary and Health Service
Ombudsman (PHSO) if he thought that he had been provided with a poor
service.
37. On 27 April 2020 Mr. Dolby provided more information to the
Commissioner and the Respondent wrote to Mr. Dolby under Case Reference
Number RFA0869556 to say that due to further information provided by him
they had a better understanding of his concerns. They set out their conclusions
as to the most likely explanation of events and explained they do not act on
behalf of complainants and would not pursue allegations of dishonesty without
evidence to support such suspicions.
38. Mr. Dolby then wrote to the Commissioner on several occasions expressing
his dissatisfaction with the outcome of his complaint. In response he was
advised about his rights to complain about the level of service provided to the
PHSO and reminded of the previous steps taken by the ICO.
39. On 5 August 2020 under reference RCC0905820 the Information
Commissioner wrote to Mr Dolby again setting out the limits of the role of the
Information Commissioner and her office as to what they will investigate,
noting that Mr Dolby had sent a considerable volume of correspondence to the
Commissioner. The Team Manager stated they did not believe there was any
cause for concern arising form the facts as explained by Mr Dolby and so they
would not be raising matters with the shop. As to the police the Team Manager
set out how Mr Dolby could go about raising the matter in the correct was with
the police themselves. The letter stated the matter was closed and no further
correspondence would be responded to.
40. Mr Dolby made a complaint to the PHSO about the Information
Commissioner. On 20 November 2020 the PHSO wrote to Mr Dolby with the
outcome to his complaint stating that no further action would be taken as the
ICO had given its view and they could see any evidence that the ICO had not
done what it should have in terms of assessing the case, gathering evidence,
and giving Mr Dolby its view.
Submissions
9
Appeal number QJ/2021/0007
41. Mr Dolby submitted orally that he did not contend that the outcome was
incorrect and also said he was not seeking rectification albeit that was what he
asked for in his application. He said he wanted a response to his complaint
under the same case reference number.
Analysis
42. Having considered the 5 principles set out in Data Select I have concluded
on balance that notwithstanding the delay the prejudice to the Respondent in
the admission of this application out of time does not outweigh the prejudice
that would be caused to this applicant and the interests of justice if I were not
to admit it. The reasons include the need for finality and the extensive
correspondence in this case conducted over years and given the applicant is a
vulnerable person. The extension of time is granted, and the application
admitted.
43. Turing to the application itself, Mr Dolby is seeking an order of compliance
and “rectification” as set out in his documentation. These are not remedies that
this Tribunal can give him, and he would have to apply to the civil courts to
obtain such relief. I cannot advise him whether to do so and he should seek
independent legal advice before doing so given the nature of embarking on any
litigation.
44. The outcome received was clearly in relation to his complaint even if it had
a different reference number.
45. The Commissioner has taken steps to comply with the obligations placed
on them within DPA18. They have sought further information from the
Applicant and have clarified the scope of their power to act and the extent to
which the Commissioner has decided to exercise her regulatory functions in
this case. It was only after protracted correspondence that the Commissioner
stated that no further response would be given. This is not a case where the
Commissioner has failed to take any steps or acted contrary to the legislation
or her own guidance such that this Tribunal should intervene to make an order
for steps to be taken.
46. The Applicant was provided with a response to their complaint on 25
October 2019 and this outcome was reviewed and upheld under the
Respondent’s case review process on 7 February 2020. The Applicant does not
10
Appeal number QJ/2021/0007
agree with the outcome, but this Tribunal has no power to consider an appeal
against the Information Commissioner’s substantive findings.
47. The Applicant is not satisfied with that outcome and wishes it to be
reconsidered but it is, nonetheless, an outcome. He is seeking to turn back the
clock in order to change the outcome and that is not permitted.
48. This Tribunal has no power to decide about the merits of that outcome,
whether it be right or wrong. This is the case regardless of the nature of the
complaint made or its evidential basis. The quality, adequacy or merits of the
complaints made by Mr Dolby about the outcome fall outside the scope of s.166
and outside the jurisdiction of this Tribunal.
49. The Tribunal has no power to do what the Applicant is asking for; there is
no power to investigate a data subject’s allegations of dishonesty, interference
with or loss of data. This Tribunal’s jurisdiction does not extend to providing
rectification or compliance.
50. By the time of this application Mr Dolby had received all that which this
Tribunal could order under s166(2) DPA18. He remains dissatisfied with the
service of the Information Commissioner and of the shop concerned and the
police, but these are matters that go to the underlying merits of the outcome
rather than the procedural matters which this Tribunal may deal with.
Conclusion
51. Accordingly, for the reasons set out above, there is no basis for the Tribunal
to make an order under section 166(2) DPA18.
52. Having considered whether this tribunal could provide the Applicant with
any other remedy I have concluded that while there may be a remedy available
from the courts (about which I make no conclusions or give any indication)
having considered the nature of the issues raised by Mr Dolby there is no other
remedy available from this Tribunal in relation to his application.
53. In order for this application to proceed there must be a realistic prospect of
its success. For the reasons set out above, I have concluded that this Tribunal
would not be able to provide the outcome(s) sought and that therefore the
application is hopeless, or in other words has no reasonable prospect of success.
11
Appeal number QJ/2021/0007
54. I know this decision will be a disappointment to Mr. Dolby however, this
Tribunal can only act within the scope of its power and cannot provide him
with the remedies he seeks.
55. Having taken account of all relevant considerations, I strike out this
application pursuant to 8(3)(c) of the Tribunal Procedure (First-tier Tribunal)
(General Regulatory Chamber) Rules 2009 because there is no reasonable
prospect of the application succeeding.
Tribunal Judge Lynn Griffin
7 December 2021
Promulgation Date: 8 December 2021
12