First-tier Tribunal (General Regulatory Chamber)

Appeal number:   EA/2021/0117

Neutral Citation Number: [2022] UKFTT 350 (GRC)

 

 

FIRST-TIER TRIBUNAL

GENERAL REGULATORY CHAMBER

Information Rights

 

 

 

	Tahirah Pirmohamed	Applicant
	- and -
	Information Commissioner	Respondent

 

 

Before:

JUDGE LYNN GRIFFIN

 

 

Appearances:

Applicant in person

 

 

 

DECISION

 

Ms Pirmohamed’s application is struck out pursuant to rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009, on the grounds that there is no reasonable prospect of it succeeding.

 

 

REASONS

The Application to the Tribunal

 

1.       The proceedings were held by video hearing on 21 September 2021; the decision was given at that hearing. This is a written version of the decision that was delivered orally at the hearing. The Respondent had indicated that she did not intend to participate in the hearing. The Tribunal was satisfied that it was fair and just to conduct the hearing in this way.

2.       On 3 December 2019 the Applicant complained to the Information Commissioner about an organization that she said held inaccurate personal data about her and had shared that data with a third party. The Applicant’s complaint was allocated case reference RFA0895327.

3.       After corresponding with the applicant and the organisation the respondent wrote to the applicant on 11 September 2020. The case officer stated that she did not consider it appropriate or necessary to pursue further action with Babcock, and confirmed that she had provided Babcock with advice regarding their wider information rights practices, the case officer expressed her conclusion that she was satisfied that Babcock were putting things right.

4.       On 13 November 2020 the Applicant submitted a request for a case review. 

5.       On 18 December 2020 the respondent acknowledged receipt of the request for a case review which was allocated case reference IC-71083-G9B0.

6.       On 16 January 2021 and 27 January 2021 the Applicant wrote to the case officer to request a response to her request for a case review. 

7.       On 30 April 2021 the applicant sent her notice of application to the tribunal

8.        On 13 May 2021 an ICO reviewing officer wrote to the Applicant with a response to her case review request. The reviewing officer stated that she had reviewed the points raised by the Applicant and had reviewed the relevant information held regarding the concern. The reviewing officer said that she was satisfied that the complaint was handled appropriately and in line with case handling procedures. The reviewing officer said that, having reviewed the matter, she agreed with the case officer’s explanations provided to the applicant and agreed with the steps taken by the case officer.

9.       In the notice of application the Applicant said that they would like the following remedies from the Tribunal

a.      Investigation into the GDPR breach

b.      Holding inaccurate personal and medical data without consent

c.       Passing this inaccurate data to a third party without consent

d.     Failure to investigate this matter when raised

e.      Dismissing their obligation to adhere to GDPR

f.        Fine for the organisation

g.      Compensation for the failures and breach

 

10.    The application was interpreted by the Tribunal as an application under section 166 Data Protection Act 2018 [DPA18].

11.    In the response to the application the Information Commissioner invited the Applicant to withdraw her application because she had received a response to her request for a case review but in the event she did not do so,] the Information Commissioner has applied for this case to be struck out pursuant to rule 8(3)(a) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009. It was argued that as there has been an outcome provided to the Applicant, the Tribunal no longer has any power to make an order under s166 and thus her application has no reasonable prospect of succeeding.

12.    The Applicant not having withdrawn her appeal I considered the application to strike out these proceedings on the basis that they have no reasonable prospects of success.

13.    At the hearing Ms Pirmohamed explained that she felt she had done everything she could as regards the organisation and that she felt the respondent’s approach had been dismissive of her concerns about her personal data.  She noted that the respondent had only provided the response to the case review after she had contacted the tribunal. She did not agree with the outcome of the respondent’s investigation or the method with which they reached it.

The powers of the Tribunal in s166 applications

 

14.    Since the DPA18 came into force a person can apply to this Tribunal for an “order to progress complaints” under section 166. 

15.    Under section 166 DPA18, a data subject has a right to make an application to the Tribunal if they consider that the Commissioner has failed to take certain procedural actions in relation to their complaint.  

16.    Section 166 DPA18 as relevant states:

166 (1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner—

(a) fails to take appropriate steps to respond to the complaint,

(b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or

(c) if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.

(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—

(a) to take appropriate steps to respond to the complaint, or

(b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

(3) An order under subsection (2)(a) may require the Commissioner—

(a) to take steps specified in the order;

(b) to conclude an investigation, or take a specified step, within a period specified in the order.

 

17.    The powers of the Tribunal in considering such applications have been considered by the Upper Tribunal. These cases are binding on the First Tier Tribunal of which the General Regulatory Chamber is a part. [1]

18.    In Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC) Upper Tribunal Judge Wikeley said at paragraph 31

“Appropriate steps” mean just that, and not an “appropriate outcome”. Likewise, the FTT’s powers include making an order that the Commissioner “take appropriate steps to respond to the complaint”, and not to “take appropriate steps to resolve the complaint”, least of all to resolve the matter to the satisfaction of the complainant.”

 

19.    Further in the case of Scranage v Information Commissioner [2020] UKUT 196 (AAC) the Upper Tribunal went further in saying :

“... there is a widespread misunderstanding about the reach of section 166. Contrary to many data subjects’ expectations, it does not provide a right of appeal against the substantive outcome of the Information Commissioner’s investigation on its merits. Thus, section 166(1), which sets out the circumstances in which an application can be made to the Tribunal, is procedural rather than substantive in its focus. This is consistent with the terms of Article 78(2) of the GDPR (see above). The prescribed circumstances are where the Commissioner fails to take appropriate steps to respond to a complaint, or fails to update the data subject on progress with the complaint or the outcome of the complaint within three months after the submission of the complaint, or any subsequent three month period in which the Commissioner is still considering the complaint.”

 

20.    The Tribunal is limited in its powers to those given by Parliament as interpreted by the Upper Tribunal. The First tier Tribunal  does not have power to make a decision on the merits of the complaint, and this Tribunal will not interfere with an exercise of regulatory judgement without good reason.

21.    Furthermore, a person who wants a data controller (or processor) to rectify personal data, compensate them, or otherwise properly comply with the Data Protection Act 2018 or General Data Protection Regulations in relation to personal data must go to the civil courts [2] not a tribunal pursuant to sections 167-169 & 180 of the Data Protection Act 2018. I express no opinion one way or another about whether the Applicant can do so, or whether they should do so; that is a matter for the Applicant, about which this Tribunal cannot give advice.

22.    This Tribunal does not have an oversight function in relation to the Information Commissioner’s Office and does not hold them to account for their internal processes. The Parliamentary and Health Service Ombudsman [3] is the body which has that function. I express no opinion one way or another about whether this applicant can or whether they should raise the issue with the Ombudsmen; again, that is a matter for the applicant, about which this Tribunal cannot advise her.

 

Analysis and conclusions

23.    The Applicant was provided with an outcome to their complaint on 11 September 2020 and this outcome was reviewed and upheld under the Respondent’s case review process on 13 May 2021. The Applicant does not agree with the outcome, but as explained at the hearing, this Tribunal has no power to consider an appeal against the Information Commissioner’s substantive findings.

24.    The Tribunal has no power to do what the Applicant is asking for; by the time of this application Ms Pirmohamed had received all that which this tribunal could order under s166(2) DPA18.

25.    This Tribunal has no power to make a decision about the merits of that outcome, whether it be right or wrong. This is the case regardless of the nature of the complaint made or its evidential basis. The quality, adequacy or merits of the outcome fall outside the scope of s.166 and outside the jurisdiction of this Tribunal. Furthermore, the Tribunal does not have any power to supervise or mandate the performance of the Commissioner’s functions.

26.    There is subsequently no basis for the Tribunal to make an order under section 166(2) DPA18.

27.    Having considered whether this tribunal could provide the Applicant with any other remedy I have concluded that while there may be a remedy available from the courts (about which I make no conclusions or give any indication) there is no other remedy available from this Tribunal in relation to this application.

28.    In order for this application to proceed there must be a realistic prospect of its success. For the reasons set out above, I have concluded that this Tribunal would not be able to provide the outcome(s) sought and that therefore the application is hopeless, or in other words has no reasonable prospect of success.

29.    Having taken account of all relevant considerations, and heard from the applicant orally I decided to strike out this application pursuant to 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 because there was no reasonable prospect of the application succeeding.

 

Tribunal Judge Lynn Griffin

28 September 2022

 

Promulgation Date - 30 September 2022