First-tier Tribunal
General Regulatory Tribunal
Information Rights
IN THE MATTER OF AN APPLICATION TO THE FIRST-TIER TRIBUNAL
(INFORMATION RIGHTS) UNDER SECTION 166 OF THE DATA PROTECTION
ACT 2018
Case No. EA/2022/0255/GDPR
NCN: [2023] UKFTT 00606 (GRC)
BETWEEN:
LYNSEY HUMPHRIES
Applicant
-and-
THE INFORMATION COMMISSIONER
Respondent
APPLICATION ON BEHALF OF THE RESPONDENT TO STRIKE OUT THE
APPLICATION
______________________
Heard by: Determination on the papers.
Heard on: 10 July 2023.
Heard by: Judge Brian Kennedy KC.
Decision given on: 10 July 2023.
Result: These proceedings are struck out pursuant to rule 8(3)(c) of the
Tribunal Procedure (First- tier Tribunal) (General Regulatory Chamber) Rules
2009 on the grounds that there is no reasonable prospect of it succeeding.
1
REASONS
Introduction:
1. The Tribunal has considered this matter on the papers and is satisfied that it
does not defeat the interests of justice to do so pursuant to rule 32(3) of the
Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules
2009 (“the 2009 Rules”).
Factual Background:
2. By way of a Notice of Application received by the Tribunal on 27 December
2022, the Applicant brought this appeal based on an assertion that that the
Respondent has failed to properly deal with the complaint. On 11 October 2021,
the Applicant submitted an online Complaint Form together with attachments
about Stockport Metropolitan Borough Council (“SMBC”) (the “Complaint”). The
Applicant made multiple allegations about SMBC in the Complaint, including
that SMBC held inaccurate information relating to the Applicant. The Complaint
was allocated case reference IC-134358-J3P7. The detailed History and
Chronology are set out in Paragraphs 15 to 34 of the formal Response dated
10 February 2023 wherein the Respondent has set out the relevant factual
matrix and exchanges between the parties from 11 October 2021 to 8 February
2023 which it is not necessary to repeat here save that on 12 January 2023,
the Commissioner received an email from the Tribunal attaching a Notice of
Appeal from the Applicant. Upon receipt of this, the Commissioner proactively
sought to conduct a case review of the handling of the Complaint. On 8
February 2023, the Commissioner wrote to the Applicant with the results of the
case review of the Complaint. The Commissioner held that the case handler
who dealt with the Complaint has appropriately explained the Commissioner’s
position on complaints about accuracy. However, the service the Applicant
received from the Commissioner relating to phone call response times fell
below what the Commissioner expects. For this reason, the Commissioner
apologised and ensured that it would not happen again in the future.
2
3. In effect the appellant seeks these issues to be considered by the Tribunal
pursuant to section 166 of the Data Protection Act 2018 (“2018 Act”).
Legal Background
4. Article 77(1) of the GDPR gives every data subject the right to complain to a
supervisory authority (in the domestic context, the Information Commissioner)
if they consider that the processing of their personal data infringes their GDPR
rights. The relevant provisions of section 165 of the 2018 Act accordingly
provide as follows: - “165 Complaints by data subjects: -
(1) Articles 57(1)(f) and (2) and 77 of the GDPR (data subject's right to lodge a
complaint) confer rights on data subjects to complain to the Commissioner if the
data subject considers that, in connection with personal data relating to him or her,
there is an infringement of the GDPR.
(2) A data subject may make a complaint to the Commissioner if the data subject
considers that, in connection with personal data relating to him or her, there is an
infringement of Part 3 or 4 of this Act.
(3) The Commissioner must facilitate the making of complaints under subsection (2) by
taking steps such as providing a complaint form which can be completed electronically
and by other means.
(4) If the Commissioner receives a complaint under subsection (2), the Commissioner
must—
(a) take appropriate steps to respond to the complaint,
(b) inform the complainant of the outcome of the complaint,
(c) inform the complainant of the rights under section 166, and
(d) if asked to do so by the complainant, provide the complainant with further
information about how to pursue the complaint.
(5) The reference in subsection (4)(a) to taking appropriate steps in response to a
complaint includes—
(a) investigating the subject matter of the complaint, to the extent appropriate, and
(b) informing the complainant about progress on the complaint, including about
whether further investigation or co-ordination with another supervisory authority or
foreign designated authority is necessary.”
3
5. Section 166 of the 2018 Act reads:
“The powers of the Tribunal in considering such applications have been considered by
the Upper Tribunal. These cases are binding on the First Tier Tribunal of which the
General Regulatory Chamber is a part.”
6. In Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC) Upper
Tribunal Judge Wikeley said at paragraph 31-“Appropriate steps” mean just that,
and not an “appropriate outcome”. Likewise, the FTT’s powers include making an
order that the Commissioner “take appropriate steps to respond to the complaint”, and
not to “take appropriate steps to resolve the complaint”, least of all to resolve the
matter to the satisfaction of the complainant.”
7. Further in the case of : Scranage v Information Commissioner [2020] UKUT 196
(AAC) the Upper Tribunal went further saying :
“... there is a widespread misunderstanding about the reach of section 166. Contrary
to many data subjects’ expectations, it does not provide a right of appeal against the
substantive outcome of the Information Commissioner’s investigation on its merits.
Thus, section 166(1), which sets out the circumstances in which an application can be
made to the Tribunal, is procedural rather than substantive in its focus. This is
consistent with the terms of Article 78(2) of the GDPR (see above). The prescribed
circumstances are where the Commissioner fails to take appropriate steps to respond
to a complaint, or fails to update the data subject on progress with the complaint or the
outcome of the complaint within three months after the submission of the complaint, or
any subsequent three month period in which the Commissioner is still considering the
complaint.”
Conclusion:
8. The Tribunal is limited in its powers to those given by Parliament as interpreted
by the Upper Tribunal. The First tier Tribunal does not have power to make a
decision on the merits of the complaint, and this Tribunal will not interfere with
an exercise of regulatory judgement without good reason.
4
9. Furthermore, a person who wants a data controller (or processor) to rectify
personal data, compensate them, or otherwise properly comply with the Data
Protection Act 2018 or General Data Protection Regulations in relation to
personal data must go to the civil courts not a tribunal pursuant to sections 167-
169 & 180 of the Data Protection Act 2018. This Tribunal express no opinion
one way or another about whether the Applicant can do so, or whether they
should do so; that is a matter for the Applicant, about which this Tribunal cannot
give advice.
10. This Tribunal does not have an oversight function in relation to the Information
Commissioner’s Office and does not hold them to account for their internal
processes. The Parliamentary and Health Service Ombudsman 3 is the body
which has that function. I express no opinion one way or another about whether
this applicant can or whether they should raise the issue with the Ombudsmen;
again, that is a matter for the applicant, about which this Tribunal cannot advise
her.
11. The outcome to the complaint was reviewed and upheld under the
Respondent’s case review process. The Applicant does not agree with the
outcome, but this Tribunal has no power to consider an appeal against the
Information Commissioner’s substantive findings.
12. This Tribunal has no power to make a decision about the merits of that outcome,
whether it be right or wrong. This is the case regardless of the nature of the
complaint made or its evidential basis. The quality, adequacy or merits of the
outcome fall outside the scope of s.166 and outside the jurisdiction of this
Tribunal. Furthermore, the Tribunal does not have any power to supervise or
mandate the performance of the Commissioner’s functions.
13. There is accordingly no basis for the Tribunal to make an order under section
166(2) DPA18.
14. Having considered whether this Tribunal could provide the Applicant with any
other remedy it is clear that while there may be a remedy available from other
5
courts (about which no conclusions can be given herein) there is no other
remedy available from this Tribunal in relation to this application.
15. In order for this application to proceed there must be a realistic prospect of its
success. For the reasons set out above, this Tribunal would not be able to
provide the outcome(s) sought and that therefore the application is hopeless,
or in other words has no reasonable prospect of success.
16. Having considered all the above the Tribunal has therefore decided to strike out
this application pursuant to 8(3)(c) of the Tribunal Procedure (First-tier Tribunal)
(General Regulatory Chamber) Rules 2009 because there was no reasonable
prospect of the application succeeding.
Brian Kennedy KC 10 July 2023.
6