40. The Respondent relies on the language of Article 57(1)(f) of GDPR which requires a supervisory authority to “handle” a complaint rather than reach a determination on breach.
41. The Respondent submits in addition that the rights described in Recital 141 are reflected in both Article 78(1) & (2), and the right to a judicial remedy in circumstances where the supervisory authority partially or wholly rejects or dismisses a complaint (the Applicant’s option ‘(b)’) are met though Article 78(1), which provides a right to a judicial remedy against a legally binding decision.
42. The Respondent contends that the application of the Applicant’s definition of an ‘outcome’ would result in two overlapping routes to redress under the DPA, because a complainant would be able to both seek a determination on breach by the Respondent pursuant to ss. 165 & 166 whilst also seeking the same determination from a court under ss. 167- 170. The Respondent submits that this would result in the ‘jurisdictional confusion’ described by the Upper Tribunal in Leighton.
43. The Respondent submits in addition that the creation of a 2 tier scheme of this nature, where an identical determination on breach could be sought from the Respondent and the courts, but the former without incurring costs, would lead to the Respondent being overwhelmed with complaints.
44. The Respondent further submits that application of the Applicant’s definition would curtail her discretion to decide the extent to which any complaint should be investigated, since every complaint would have to be investigated to the extent required in order to establish a breach of data protection rights.
45. In relation to the current application, the Respondent submits that both the 4 & 8 September 2020 letters provided the Applicant with an ‘outcome’ to his complaint, in that both make clear that, Barnet having responded to the Applicant’s complaint, no further action would be taken. The Respondent contrasts this with a situation in which a complainant is left unclear as to whether an investigation of a complaint is ongoing.
46. The Applicant submits in reply that a response to a complaint must engage with the subject matter of the complaint, and that a response which is simply a reply must be inadequate. He relies on Article 63 of the EU Regulation 2018/1725, a provision relating to complaints by data subjects made to the European Data Protection Supervisor, as a relevant comparable framework, under which a failure to respond or inform a complainant of an outcome within three months is deemed ‘a negative decision’.
47. The Applicant rejects the Respondent’s submission that some of the rights set out in Recital 141 are met through Article 78(1). He does so on the basis that this provision contains no reference to ‘complaints’ and because there is no authority for such a proposition. The Applicant submits that the application of Recital 141 to the DPA must lead to a conclusion that the purpose of ss. 165 & 166 is to create an alternative route for determination of breach, to that available in the courts pursuant to ss. 167-170. He contends that Parliament must have intended to create two routes when drafting the DPA, thereby enabling complainant to seek a determination from the Respondent without incurring cost.
Conclusion
48. There is no dispute between the Parties as to whether the Respondent is required to provide an outcome in response to a complaint made under s. 165 or Article 77. The issue is whether the outcome provided must always “either uphold, reject or dismiss [the] complaint, or provide a valid reason for not considering the complaint at all”, including by reaching a determination relating to a breach of a complainant’s rights.
49. When considering this issue the Tribunal must give effect to the statutory language in context, having regard to the relevant statutory purpose, and is bound by any relevant decisions taken by the Upper Tribunal.
50. In context, the language of ss. 165 & 166 is open to misinterpretation, as evidenced by some previous applications to the Tribunal and as acknowledged by the Upper Tribunal in Scranage. It may therefore be helpful to summarise the principles relating to s. 166 confirmed by the Upper Tribunal to date:
a. The purpose of s.166 is to give effect the rights set out in Article 78(2) (Leighton and Scranage).
b. It does not provide a right of appeal against the substantive outcome of the Information Commissioner’s investigation on its merits (Scranage). The Tribunal understands the ‘substantive outcome’ of a complaint in this context to be the Respondent’s final decision in relation to it.
c. “Section 166 is directed towards providing a tribunal-based remedy where the Commissioner fails to address a section 165 complaint in a procedurally proper fashion” (Leighton).
d. This Tribunal’s powers “include making an order that the Commissioner “take appropriate steps to respond to the complaint”, and not to “take appropriate steps to resolve the complaint”, least of all to resolve the matter to the satisfaction of the complainant” (Leighton).
51. The Tribunal has no jurisdiction to make an Order requiring the Commissioner to take action in relation to a complaint once an outcome has been provided to the complainant. Neither does it have jurisdiction to consider the merits of that outcome. As stated above, the Orders available under s.166(2) are purely procedural.
52. The Applicant accepts the limited nature of the Tribunal’s jurisdiction but submits that the Respondent is procedurally required to provide an outcome that upholds, rejects or dismisses his complaint, based on the language of Recital 141.
53. I am not persuaded by the Applicant’s arguments for the following reasons:
i. The Applicant submits that Recital 141 gives rise to three circumstances in which there is a right to a judicial remedy in relation to the handling of a complaint:
a. Where no action is taken;
b. Where a complaint is partially or wholly rejected or dismissed; and
c. Where no action is taken in circumstances where action is necessary in order to protect the rights of the data subject.
ii. The Applicant rejects the Respondent’s submission that the right summarised at (b) refers only to decisions made under Article 78(1), relying on the fact that only Article 78(2) refers to “complaints”. However, there is nothing in the language of Article 78(2) that reflects the Applicant’s right (c), which appears to describe enforcement proceedings and in any event goes significantly beyond informing a complainant of an ‘outcome’. I therefore conclude that Article 78(2) cannot be intended to capture and reflect all of the rights described in Recital 141 in relation to the handling of complaints. When reaching this conclusion I note, in passing, that the purpose of s.166 is to give effect to the rights set out in Article 78(2), rather than those described in Recital 141.
iii. As to whether the Applicant’s summarised right (b) is intended to be captured and reflected by Article 78(2), I note that this right arises in circumstances where a complaint has been wholly or partially dismissed. It is difficult to understand how the exercise of a right to a judicial remedy in such a circumstance where a complaint has been partially dismissed could be properly characterised as a procedural issue, as opposed to an appeal against a substantive outcome. Therefore, irrespective of the applicable Article(s) of the GDPR, I am bound to conclude that the appropriate judicial remedy available under domestic law in the Applicant’s summarised right (b) must be found somewhere other than in s.166, possibly by way of judicial review.
iv. Although the Respondent submits that summarised right (b) is captured by Article 78(1), I note that this provision only applies to legally binding decisions by the supervisory authority. As there is nothing before me to suggest that the Respondent’s determination of a complaint is in any way legally binding, I am not convinced by the Respondent’s suggestion, but have not had the benefit of detailed submission on this issue. Alternative explanations are that summarised right (b) is captured by a wholly different Article, or that that the right is captured by Article 78(2) but the effective judicial remedy is made available under domestic law by a provision other than s.166. Again, this might be by way of judicial review, but this is not a matter I need to determine.
v. The other basis upon which the Applicant seeks to argue that an outcome must encompass a determination of the complaint is by reference to Article 63 of the EU Regulation 2018/1725. However, there is no similar default presumption contained in the GDPR and no reference in any relevant GDPR Recital or Article relating to a supervisory authority having an obligation to determine every complaint. The requirement is that the complaint is investigated to the extent appropriate.
vi. I therefore conclude that there is no requirement that an outcome provided under s. 165(4)(b) must include a determination of whether a complainant’s rights under the DPA or GDPR have been breached.
vii. The absence of such a requirement is reflected in the Upper Tribunal decision in Leighton, which makes a clear distinction between responding to a complaint and resolving it. The Applicant’s submission that ‘resolve’ in this context should be understood as referring to taking action or enforcement proceedings is misconceived. The resolution of a complaint does not always require enforcement. I am satisfied that the distinction made by the Upper Tribunal in Leighton is between an order requiring the Respondent to take action in response to a complaint, which is a procedural matter within the Tribunal’s jurisdiction, and an order requiring the respondent to resolve a complaint by determining it, which is not.
viii. This is because such an order would to interfere with the discretion afforded to the Respondent in Recital 141 and s.165, to determine the extent to which it is appropriate to investigate any complaint. This wide margin of discretion must be incompatible with an obligation to determine in each case whether a complainant’s rights have been breached. This is also why the Applicant’s second ground in support of his application, relating to the extent to which his complaint has been investigated, also fails to succeed. It is clear from correspondence that the Respondent has considered the Applicant’s complaint and has investigated it to the extent to which she considers it appropriate, in this case through application of her ‘pushback’ policy.
54. Having reached these conclusions, I have then considered whether the Applicant has received an ‘outcome’ in relation to his complaint as at the date of this decision, by considering whether he has been informed of the Respondent’s ‘final decision’. I have concluded that he has received such an outcome. Although the language used in the Respondent’s July letter was suboptimal, since it left the Applicant without a clear understanding of the extent to which his complaint remained under consideration, I am satisfied that the language of the 4 and 8 September letters, and the 8 October review letter, left the Applicant in no doubt as to the Respondent’s final decision in respect of his complaint.
55. Accordingly, I conclude that there is no longer a basis for making an Order under s. 166(2) DPA on the facts of this case. The Application is therefore dismissed..
(Signed)
JUDGE MOIRA MACMILLAN DATE: 1 June 2021
(Amended under the slip rule - 19 October 2021)
BAILII: