UKFTT-GRC 2024 1125 [2024] UKFTT 1125 (GRC) InformationRights 0.26.16 b71ac5257239d7fda9dc0d88a99715f7ccaf260bc0dae1e3e5075071c3e2e008 6.0.2
Neutral citation number: [2024] UKFTT 001125 (GRC)
Case Reference: FT/EA/2024/0099/GDPR
First-tier Tribunal
General Regulatory Chamber
Information Rights
Decided without a hearing
Decision given on: 17 December 2024
Before
JUDGE STEPHEN ROPER
MEMBER DAVID COOK
MEMBER KATE GRIMLEY-EVANS
Between
TARA OFATHAIGH
Appellant
and
THE INFORMATION COMMISSIONER
Respondent
Decision: The appeal is Dismissed
REASONS
Preliminary matters
1.
In this decision, we use the following terms to denote the meanings shown:
Appellant:
Tara OFathaigh.
Case Management Directions:
The Tribunal’s Case Management Directions dated 8 August 2024.
Commissioner:
The Information Commissioner (the Respondent).
Complaint:
The Appellant’s complaint to the Commissioner, submitted on 27 November 2023, concerning Arriva plc’s handling of the Request.
DPA:
The Data Protection Act 2018.
Request:
The subject access request made to Arriva plc by the Appellant, dated 16 November 2023, as referred to in paragraph 8.
Tribunal Rules:
The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.
UK GDPR:
The General Data Protection Regulation (EU) 2016/679, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 .
2.
Unless the context otherwise requires (or as otherwise expressly stated), references in this decision :
a.
to numbered paragraphs are references to paragraphs of this decision so numbered;
b.
to any section are references to the applicable section of the DPA; and
c.
to a Rule are references to the applicable rule of the Tribunal Rules.
3.
The surname provided by the Appellant in her notice of appeal was ‘OFathaigh’ but we note that the surname provided in the Request and the subsequent correspondence with the Commissioner (including by the Appellant’s father when corresponding on her behalf) was ‘Fahy’. We have used the surname ‘OFathaigh’ in this decision, given that it was the surname provided by the Appellant in connection with the appeal, but no disrespect is intended to the Appellant in not using the other given surname in this decision.
Background to the appeal
4.
The background to the appeal is as follows, although we should first note three preliminary points.
5.
The Appellant’s appeal, which was submitted by way of a notice of appeal received by the Tribunal on 5 March 2024, did not specify the statutory basis on which the appeal was being brought. The Appellant was not legally represented in respect of the appeal. The Commissioner considered that the appeal was made pursuant to section 166(2), which is set out in paragraph 33. We agree with that assessment, based on the documentation before us and the nature of the issues involved. We should perhaps also note, for the Appellant’s understanding, that if we concluded otherwise then the Tribunal would have no power at all to consider the Appellant’s application. We accordingly find that the application was an appeal made pursuant to section 166, seeking an order to be made by the Tribunal pursuant to section 166(2).
6.
We refer in this decision to the ‘appeal’, partly because (as noted) the Appellant submitted a notice of appeal and partly for ease of reference, although technically speaking it is an ‘application’ (pursuant to section 166(2)).
7.
The Commissioner made an application to strike out the appeal. Pursuant to the Case Management Directions, that application was to be dealt with by the Tribunal Panel when we convened to consider the appeal. We therefore address that application later below.
The Request
8.
On 16 November 2023, the Appellant sent an email to Arriva plc making a request (often known as a ‘subject access request’ or ‘data subject access request’) for a copy of her personal data.
9.
Arriva plc responded on 24 November 2023 stating that it did not “have access to the systems required” to comply with the Request. The response also stated that the Arriva Bus division had been contacted and that it would be in touch with the Appellant in order to facilitate the Request.
10.
The Appellant replied to Arriva plc on the same day, essentially to the effect that its response was inadequate as Arriva plc was the data controller. The Appellant explained that she would make a complaint to the Commissioner and seek compensation if her personal data was not received within the relevant statutory period.
11.
On 27 November 2023, Arriva plc sent a further response stating as follows:
“ Arriva Plc are not the data controllers for your data, this is our UK bus division who manage the application, they are also the entity that have access and capability to undertake your request – they are the appropriate legal entity. Arriva Plc does not directly collect nor, have access to the data. ”.
12.
Arriva plc also stated in that response that if the Appellant could provide further information as to why she felt that Arriva plc was the data controller, then it would be “ happy to investigate”.
13.
The Appellant replied to Arriva plc (on the same date, 27 November 2023), stating; “ I'm not sure why you are asking me these questions because you should know these things. If you are unsure, we can let the ICO make the decision… ”.
The Complaint
14.
Shortly after sending that reply to Arriva plc (approximately 30 minutes later), the Appellant also submitted a complaint to the Commissioner concerning Arriva plc’s handling of the Request.
15.
The Complaint was assigned to a case officer within the Information Commissioner’s Office. The case officer wrote to the Appellant on 8 February 2024 with an outcome to the Complaint, which explained that Arriva plc had acted correctly in stating that the Arriva Bus division was the correct data controller rather than Arriva plc and which directed the Appellant to the privacy policy of Arriva UK Bus Limited. The case officer advised the Appellant to raise a complaint with Arriva UK Bus Limited or Arriva plc if Arriva UK Bus Limited did not provide a response to the Request.
16.
There was then some further correspondence between the Appellant and the case officer regarding the role of data controllers and group companies. During that correspondence, the case officer also informed the Appellant that the Commissioner remained satisfied with Arriva plc’s handling of the Request. Following that correspondence, the Appellant contacted the case officer again on 13 February 2024 stating that neither of the Arriva entities had provided the personal data pursuant to the Request. The Appellant also asked whether the case officer’s decision could be appealed.
17.
On the same date (13 February 2024), the case officer responded stating that the Appellant would have to raise her concerns with Arriva UK Bus Limited before the Commissioner could consider the Complaint further.
18.
On 14 February 2024, the Appellant’s father contacted the case officer, stating that he was acting on the Appellant’s behalf, explaining that he did not believe she was being treated fairly by either Arriva or the Commissioner. He also expressed the view that the Appellant was not required to raise the Request directly with Arriva UK Bus Limited, due to it being simply an affiliate of Arriva plc. He requested that the original decision regarding the Complaint be reconsidered.
19.
The case officer contacted the Appellant by email dated 5 March 2024, stating that a letter of authority would be required, to be signed by the Appellant, authorising her father to act on her behalf. The case officer also informed the Appellant that until such letter of authority was received, they would be unable to correspond further with the Appellant’s father.
The appeal
The grounds of appeal
20.
The Appellant’s grounds of appeal referred to some research which the Appellant had undertaken, which had stated that parent companies were likely to be either a ‘Controller in Common’ or a ‘Joint Controller’ in respect of personal data held by the parent’s subsidiary companies. The Appellant quoted the research as stating that “ this is especially true if the parent company holds 100% of the shares of the subsidiary ”.
21.
The Appellant’s grounds of appeal then stated “ I think it should be enough to apply to the head office of a company and ask them for a copy of my personal data. ”.
22.
The Appellant stated in her notice of appeal that the outcomes she sought from the appeal were for the Tribunal to:
a.
“ … tell the IC that they were wrong and that it should be enough to ask the head office of a company for a copy of all of the personal data it holds. ”; and
b.
“ …tell Arriva Limited [sic] to provide me with a copy of my personal data… ”.
The Tribunal’s powers and role
23.
The powers of the Tribunal in respect of the appeal are set out in section 166(2) (as supplemented by section 166(3)) . In summary, the Tribunal is empowered to make an order requiring the Commissioner either:
a.
to take appropriate steps to respond to the complaint in question; or
b.
to inform the Appellant of the progress on the complaint, or of the outcome of the complaint, within a period which the Tribunal may specify.
24.
However, an application under section 166 permits a Tribunal to make any such order only if the Commissioner has failed in some procedural respect, as specified in section 166(1).
Mode of hearing
25.
The parties consented to the appeal being determined by the Tribunal without an oral hearing .
26.
The Tribunal considered that the appeal was suitable for determination on the papers in accordance with Rule 32 and was satisfied that it was fair and just to conduct the appeal in this way.
The evidence and submissions
27.
No bundle was provided to the Tribunal ahead of the determination of the appeal (through no fault of either party). Pursuant to the Case Management Directions, the Tribunal was satisfied that it had the necessary evidential documents and pleadings in order properly to determine the appeal. Accordingly, the appeal was determined based on the pleadings and evidence which were provided to the Tribunal by the parties in connection with the appeal, albeit without the Tribunal having a formal bundle.
28.
All of the contents of the documents and the arguments from both parties were read and considered, even if not directly referred to in this decision.
The relevant statutory framework We acknowledge the Practice Direction dated 4 June 2024 ( https://www.judiciary.uk/guidance-and-resources/practice-direction-from-the-senior-president-of-tribunals-reasons-for-decisions/ ) and particularly paragraph 9, which refers to the First-tier Tribunal not needing to specifically refer to relevant authorities. We include references to the applicable legislative framework , to provide relevant context, but have accordingly not set out details of the applicable case law (albeit referring to some cases where appropriate) .
The right of access for data subjects
29.
Article 15 of the UK GDPR provides individuals with a general right of access to their personal data held by a data controller, including the right to be provided with a copy of their personal data which is being processed by the data controller.
The right to complain to the Commissioner
30.
An individual (a ‘data subject’) has a right to make a complaint to the Commissioner if that individual considers that the processing of their personal data infringes the UK GDPR and/or Parts 3 or 4 of the DPA. Section 165 sets out the position as follows:
“(1)
Articles 57(1)(f) and (2) and 77 of the UK GDPR (data subject's right to lodge a complaint) confer rights on data subjects to complain to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the UK GDPR.
(2)
A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act . ”.
31.
So far as is relevant, section 165 then goes on to provide:
“(4)
If the Commissioner receives a complaint under subsection (2), the Commissioner must—
(a)
take appropriate steps to respond to the complaint,
(b)
inform the complainant of the outcome of the complaint,
(c)
inform the complainant of the rights under section 166, and
(d)
if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.
(5)
The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—
(a)
investigating the subject matter of the complaint, to the extent appropriate, and
(b)
informing the complainant about progress on the complaint... ”.
32.
In essence, therefore, section 165(4) requires the Commissioner to take appropriate steps, as well as the specified other actions, when he receives a relevant complaint from an individual. The appropriate steps which the Commissioner must take include (in summary) investigating the complaint and informing the individual about its progress.
The right to apply to the Tribunal
33.
Section 166 provides individuals with a right to make an application to the Tribunal for an order requiring the Commissioner to take appropriate steps to respond to a relevant complaint, or to inform the individual of the progress on (or outcome of) the complaint, if the Commissioner has failed to take certain procedural actions in relation to it. So far as is relevant, that section provides:
“(1)
This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner—
(a)
fails to take appropriate steps to respond to the complaint,
(b)
fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or
(c)
if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
(2)
The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—
(a)
to take appropriate steps to respond to the complaint, or
(b)
to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.
(3)
An order under subsection (2)(a) may require the Commissioner—
(a)
to take steps specified in the order;
(b)
to conclude an investigation, or take a specified step, within a period specified in the order. ”.
34.
We comment later below on the nature and meaning of section 166 and its practical effect.
Discussion and findings
35.
We first address the Commissioner’s strike-out application. For the reasons we have given below, we dismissed that application. We therefore went on to consider and determine the appeal itself. Accordingly, we set out below our material considerations and findings in respect of the appeal itself, following our reasons for dismissing the Commissioner’s strike-out application.
The Commissioner’s strike-out application
36.
The Commissioner applied for the appeal to be struck out pursuant to Rule 8(2)(a) and/or Rule 8(3)(c) on the grounds that either the Tribunal had no jurisdiction to consider the appeal or that the appeal had no reasonable prospect of success. The grounds given in support of this application were essentially based on the same reasons given by the Commissioner in resisting the appeal.
37.
Given our finding in paragraph 5 that the appeal was made pursuant to section 166, seeking an order from the Tribunal pursuant to section 166(2), it follows that we must reject the Commissioner’s argument (in respect of the first ground) that the Tribunal had no jurisdiction to determine the matters before it.
38.
In respect of the second ground, the Commissioner argued that the Appellant’s grounds of appeal go to the merits of the Commissioner’s decision and that this was an issue which was therefore beyond the scope of the Tribunal’s powers. We deal with the nature and scope of section 166 and the Tribunal’s powers below. However, in our view, at face value the Appellant had an arguable case, in respect of a potential order that the Tribunal does have jurisdiction to make (namely, an order under section 166(2)), and the merits of the appeal would largely depend on an analysis of the legal position and the applicable facts of the case. Accordingly we also reject the Commissioner’s argument that there was no reasonable prospect of the appeal succeeding, such that it should be struck out.
39.
We therefore turn now to address the appeal itself.
The nature and meaning of section 166
40.
We start by addressing the nature of section 166. The Commissioner, in his response to the appeal (and associated strike-out application), referred to various authorities from case law as to the function and purpose of that section (in various Upper Tribunal decisions, as well as decisions in the High Court and the Court of Appeal). It is not necessary for us to refer to that case law again in this decision, but we accept the relevance and application to the appeal of the various authorities which the Commissioner referred to.
41.
We consider that it suffices for us to briefly summarise the legal position based on those authorities. In essence (and so far as is relevant for current purposes) the following are the relevant legal principles.
42.
An application under section 166:
a.
is not concerned with the merits of the relevant complaint; and
b.
does not provide a right of challenge to the substantive outcome of the Commissioner’s investigation into that complaint.
43.
In other words, an application under section 166 does not address the merits or substance of a complaint but rather is merely procedural in nature: it is concerned only with procedural actions which the Commissioner is required to take in respect of the complaint.
44.
We consider that it is instructive to quote the comments of the Upper Tribunal Judge Wikeley in the case of Scranage v Information Commissioner [2020] UKUT 196 (AAC), at paragraph 6 (original emphasis).
:
“ ...there is a widespread misunderstanding about the reach of section 166. Contrary to many data subjects’ expectations, it does not provide a right of appeal against the substantive outcome of the Information Commissioner’s investigation on its merits. Thus, section 166(1), which sets out the circumstances in which an application can be made to the Tribunal, is procedural rather than substantive in its focus. This is consistent with the terms of Article 78(2) of the GDPR (see above). The prescribed circumstances are where the Commissioner fails to take appropriate steps to respond to a complaint, or fails to update the data subject on progress with the complaint or the outcome of the complaint within three months after the submission of the complaint, or any subsequent three-month period in which the Commissioner is still considering the complaint. ”.
45.
The test (in section 166(1)(a)) as to whether the Commissioner has failed “to take appropriate steps to respond to the complaint” is exactly as it says – namely “appropriate steps” and not an ‘appropriate outcome’ (or similar). Likewise, the Tribunal’s powers where the Commissioner has failed to take appropriate steps include making an order that the Commissioner must “take appropriate steps to respond to the complaint” (and not to ‘take appropriate steps to resolve the complaint’). Pursuant to section 166(4), an order to take appropriate steps in response to a complaint includes (as set out in section 165(5)(a)) “investigating the subject matter of the complaint, to the extent appropriate”.
46.
In considering an application under section 166, the Tribunal must bear in mind that the Commissioner is the expert regulator and so is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome. However (using the words of Upper Tribunal Judge Wikeley in Osifeso v Information Commissioner ), [2022] UKUT 146 (ACC), at paragraph 22.
“ this does not mean that the Tribunal surrenders its judicial task to the Commissioner – thus, the Commissioner’s view carries weight but is not decisive ”.
Was there a procedural failing by the Commissioner?
47.
As we have noted, section 166 is concerned with providing a remedy for any procedural failings on the part of the Commissioner after a complaint is made to him (not the merits of the complaint or its outcome). The Tribunal may only make an order under section 166(2) only if the Commissioner has failed in some procedural respect. The procedural failings in question are those set out in section 166(1), which (in summary and paraphrasing) are as follows:
a.
not taking appropriate steps to respond to the complaint;
b.
not updating the complainant about progress on, or of the outcome of, the complaint within three months of the Commissioner receiving the complaint;
c.
not updating the complainant during a subsequent period of three months if the Commissioner has not concluded matters within the first three months.
48.
For convenience, we refer below to each of those failings, respectively, as a ‘taking steps failure’, an ‘update failure’ and a ‘subsequent update failure’.
49.
The background to the appeal which we noted above was not in dispute – and, indeed, was self-evident from the documents before us. For completeness, we should note that we make findings of fact regarding the relevant background we have outlined. As we noted in paragraphs 15 and 17, the Commissioner provided the Appellant with an outcome to the Complaint on 8 February 2024 and a further clarification on 13 February 2024 .
50.
Given that the Commissioner considered the Complaint and responded to it (providing an outcome to it), we find that there was no ‘taking steps failure’ by the Commissioner in respect of the Complaint. Further, as those responses from the Commissioner (both the response with the outcome on 8 February 2024 and the subsequent clarification on 13 February 2024) occurred within three months of the date of the Complaint, we find that there was no ‘update failure’. Also, as the Commissioner’s response to the Complaint was concluded (an outcome provided) within three months from its date, it follows that we must also find that there was no ‘subsequent update failure’ (on the basis that no subsequent three month period was applicable).
51.
For the above reasons, we find that the Commissioner took appropriate steps to respond to the Complaint . It is important to reiterate that, for the purposes of section 166, it is not the merits or substance of the Complaint which is relevant but rather only the procedural actions which the Commissioner is required to take in respect of it.
Other points raised by the Appellant
52.
For completeness, we address some other specific points raised by the Appellant in her reply to the Commissioner’s response to the appeal.
53.
The Appellant took issue with the request for a signed letter of authority – in particular, considering that this was a ‘device’ used by organisations when challenges were made. The Appellant also queried the veracity of any letter of authority which might be provided, asserting that it would not confirm the Appellant’s identity. The Appellant also questioned the manner in which the letter of authority was requested, considering that the correct approach would have been for the Commissioner to write by letter to the Appellant at her home address “ and inform them that an individual was corresponding on their behalf and inviting a response if they objected to this situation ”.
54.
As we have noted, section 166 is procedural, rather than substantive, in its focus and we are required to be mindful of the role of the Commissioner as the expert regulator. Accordingly, it is not for the Tribunal to consider or address the merits of the steps which the Commissioner took in respect of the Complaint. We would separately just observe, though, that requesting a letter of authority appears to us to be an appropriate thing to do (and it would be for the Commissioner to satisfy itself of the authenticity of any such letter of authority, if provided) and there are obvious risks with the Appellant’s view that the Commissioner could correspond with a third party on behalf of a complainant in the absence of receiving an objection from the complainant.
55.
We also note, incidentally, that evidently no such letter of authority was ever provided. Indeed, rather than simply provide a letter of authority to the Commissioner, as requested, the Appellant took the steps of issuing the appeal before us.
56.
The Appellant also stated that it was difficult to understand exactly the Commissioner’s position regarding the appeal. The Appellant considered that the Commissioner appeared to believe that the Appellant sought to challenge the Commissioner’s jurisdiction or procedure, but stated that this was misconceived because “the challenge is far more fundamental”. The Appellant went on to state that the Commissioner had misunderstood the law on the basis that he believes that a commercial entity may direct an individual making a subject access request to apply to its affiliates without requiring the parent organisation to “gather in” the individual’s personal data. The Appellant’s position in this regard was, instead, that an individual should be able to make a subject access request to one entity (a head office) in a group of companies and that entity should then be required to ‘gather’ the personal data requested, to save the individual having to make several requests to different entities.
57.
We make three observations in respect of the points in the preceding paragraph (which also address the first outcome which the Appellant sought in the appeal, as we noted in paragraph 22). First, the appeal is indeed (to an extent) about the Commissioner’s procedures, insofar as an application under section 166 requires there to have been some procedural failing on the part of the Commissioner. Secondly (and for the other reasons we have given), there is no jurisdiction in the current appeal for the Tribunal to address the rights of data subjects and/or the obligations of organisations which respond to them. Thirdly (and we reiterate that this is an observation only for current purposes), we consider that the Appellant is mistaken in her view of how subject access requests should be made and responded to in respect of group companies (and, likewise, we consider that the research findings which the Appellant referred to in her grounds of appeal, as noted in paragraph 20, are erroneous) – but this is not for us to address in this appeal.
58.
Finally, we briefly address the remaining outcome which the Appellant sought in the appeal, as noted in paragraph 22 – namely, a direction to Arriva for the provision of a copy of her personal data. As we have outlined, the Tribunal’s powers (had the appeal been successful) would only extend to making an order for the Commissioner to either take appropriate steps to respond to the Complaint, or to inform the Appellant of progress on (or the outcome of) the Complaint. Consequently, the relief which was sought by the Appellant would not have been an available remedy even if the appeal had succeeded. We note that the Commissioner has indicated to the Appellant (in his response to the appeal) an alternative means by which this outcome might be pursued by the Appellant, by reference to section 167. We make no comment on this point, save that the Appellant should note that the remedy in that section applies to an application to the relevant court (not the Tribunal).
Final conclusions
59.
For all of the reasons we have given, we find that the Commissioner has complied with the procedural requirements set out in section 166(1), and that there is accordingly no basis for the Tribunal to make an order under section 166(2).
60.
We therefore dismiss the appeal .
Signed: Stephen Roper Date: 13 December 2024
Judge of the First-tier Tribunal