First-tier Tribunal (General Regulatory Chamber)

First-tier Tribunal

General Regulatory Tribunal

Information Rights

 

IN THE MATTER OF AN APPLICATION TO THE FIRST-TIER TRIBUNAL

(INFORMATION RIGHTS) UNDER SECTION 166 OF THE DATA PROTECTION

ACT 2018

 

Case No. EA/2022/0255/GDPR

NCN: [2023] UKFTT 606 (GRC)

 

BETWEEN:

 

LYNSEY HUMPHRIES

Applicant

-and-

 

THE INFORMATION COMMISSIONER

Respondent

 

 

APPLICATION ON BEHALF OF THE RESPONDENT TO STRIKE OUT THE APPLICATION

______________________

 

Heard by: Determination on the papers.

Heard on: 10 July 2023.

Heard by: Judge Brian Kennedy KC.

Decision given on: 10 July 2023.

 

Result: These proceedings are struck out pursuant to rule 8(3)(c) of the Tribunal Procedure (First- tier Tribunal) (General Regulatory Chamber) Rules 2009 on the grounds that there is no reasonable prospect of it succeeding.

 

 

REASONS

Introduction:

1.    The Tribunal has considered this matter on the papers and is satisfied that it does not defeat the interests of justice to do so pursuant to rule 32(3) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (“the 2009 Rules”).

Factual Background:

2.    By way of a Notice of Application received by the Tribunal on 27 December 2022, the Applicant brought this appeal based on an assertion that that the Respondent has failed to properly deal with the complaint. On 11 October 2021, the Applicant submitted an online Complaint Form together with attachments about Stockport Metropolitan Borough Council (“SMBC”) (the “Complaint”). The Applicant made multiple allegations about SMBC in the Complaint, including that SMBC held inaccurate information relating to the Applicant. The Complaint was allocated case reference IC-134358-J3P7. The detailed History and Chronology are set out in Paragraphs 15 to 34 of the formal Response dated 10 February 2023 wherein the Respondent has set out the relevant factual matrix and exchanges between the parties from 11 October 2021 to 8 February 2023 which it is not necessary to repeat here save that on 12 January 2023, the Commissioner received an email from the Tribunal attaching a Notice of Appeal from the Applicant. Upon receipt of this, the Commissioner proactively sought to conduct a case review of the handling of the Complaint. On 8 February 2023, the Commissioner wrote to the Applicant with the results of the case review of the Complaint. The Commissioner held that the case handler who dealt with the Complaint has appropriately explained the Commissioner’s position on complaints about accuracy. However, the service the Applicant received from the Commissioner relating to phone call response times fell below what the Commissioner expects. For this reason, the Commissioner apologised and ensured that it would not happen again in the future.

 

3.    In effect the appellant seeks these issues to be considered by the Tribunal pursuant to section 166 of the Data Protection Act 2018 (“2018 Act”).

Legal Background

4.    Article 77(1) of the GDPR gives every data subject the right to complain to a supervisory authority (in the domestic context, the Information Commissioner) if they consider that the processing of their personal data infringes their GDPR rights. The relevant provisions of section 165 of the 2018 Act accordingly provide as follows: - “165  Complaints by data subjects: -

 

(1)   Articles 57(1)(f) and (2) and 77 of the GDPR (data subject's right to lodge a complaint) confer rights on data subjects to complain to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the GDPR.

(2)   A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act.

(3) The Commissioner must facilitate the making of complaints under subsection (2) by taking steps such as providing a complaint form which can be completed electronically and by other means.

(4) If the Commissioner receives a complaint under subsection (2), the Commissioner must—

(a) take appropriate steps to respond to the complaint,

(b) inform the complainant of the outcome of the complaint,

(c) inform the complainant of the rights under section 166, and

(d) if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.

(5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—

(a) investigating the subject matter of the complaint, to the extent appropriate, and

(b) informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with another supervisory authority or foreign designated authority is necessary.”

 

5.    Section 166 of the 2018 Act reads:

“The powers of the Tribunal in considering such applications have been considered by the Upper Tribunal. These cases are binding on the First Tier Tribunal of which the General Regulatory Chamber is a part.”

 

6.    In Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC) Upper Tribunal Judge Wikeley said at paragraph 31-“Appropriate steps” mean just that, and not an “appropriate outcome”. Likewise, the FTT’s powers include making an order that the Commissioner “take appropriate steps to respond to the complaint”, and not to “take appropriate steps to resolve the complaint”, least of all to resolve the matter to the satisfaction of the complainant.”

 

7.    Further in the case of : Scranage v Information Commissioner [2020] UKUT 196 (AAC) the Upper Tribunal went further saying :

“... there is a widespread misunderstanding about the reach of section 166. Contrary to many data subjects’ expectations, it does not provide a right of appeal against the substantive outcome of the Information Commissioner’s investigation on its merits. Thus, section 166(1), which sets out the circumstances in which an application can be made to the Tribunal, is procedural rather than substantive in its focus. This is consistent with the terms of Article 78(2) of the GDPR (see above). The prescribed circumstances are where the Commissioner fails to take appropriate steps to respond to a complaint, or fails to update the data subject on progress with the complaint or the outcome of the complaint within three months after the submission of the complaint, or any subsequent three month period in which the Commissioner is still considering the complaint.”

Conclusion:

 

8.    The Tribunal is limited in its powers to those given by Parliament as interpreted by the Upper Tribunal. The First tier Tribunal does not have power to make a decision on the merits of the complaint, and this Tribunal will not interfere with an exercise of regulatory judgement without good reason.

 

9.    Furthermore, a person who wants a data controller (or processor) to rectify personal data, compensate them, or otherwise properly comply with the Data Protection Act 2018 or General Data Protection Regulations in relation to personal data must go to the civil courts not a tribunal pursuant to sections 167-169 & 180 of the Data Protection Act 2018. This Tribunal express no opinion one way or another about whether the Applicant can do so, or whether they should do so; that is a matter for the Applicant, about which this Tribunal cannot give advice.

 

10. This Tribunal does not have an oversight function in relation to the Information Commissioner’s Office and does not hold them to account for their internal processes. The Parliamentary and Health Service Ombudsman³ is the body which has that function. I express no opinion one way or another about whether this applicant can or whether they should raise the issue with the Ombudsmen; again, that is a matter for the applicant, about which this Tribunal cannot advise her.

 

11. The outcome to the complaint was reviewed and upheld under the Respondent’s case review process. The Applicant does not agree with the outcome, but this Tribunal has no power to consider an appeal against the Information Commissioner’s substantive findings.

 

12. This Tribunal has no power to make a decision about the merits of that outcome, whether it be right or wrong. This is the case regardless of the nature of the complaint made or its evidential basis. The quality, adequacy or merits of the outcome fall outside the scope of s.166 and outside the jurisdiction of this Tribunal. Furthermore, the Tribunal does not have any power to supervise or mandate the performance of the Commissioner’s functions.

 

13. There is accordingly no basis for the Tribunal to make an order under section 166(2) DPA18.

 

14. Having considered whether this Tribunal could provide the Applicant with any other remedy it is clear that while there may be a remedy available from other courts (about which no conclusions can be given herein) there is no other remedy available from this Tribunal in relation to this application.

 

15. In order for this application to proceed there must be a realistic prospect of its success. For the reasons set out above, this Tribunal would not be able to provide the outcome(s) sought and that therefore the application is hopeless, or in other words has no reasonable prospect of success.

 

16. Having considered all the above the Tribunal has therefore decided to strike out this application pursuant to 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 because there was no reasonable prospect of the application succeeding.

 

Brian Kennedy KC                                                                    10 July 2023.