First-tier Tribunal (General Regulatory Chamber)

Case Reference: EA-2023-0024-GDPR

Neutral Citation Number: [2023] UKFTT 1068 (GRC)

 

First-tier Tribunal

General Regulatory Chamber

Information Rights

Heard by: CVP

 

Heard on: 15 December 2023

Decision given on: 2 January 2024

 

Before

 

TRIBUNAL JUDGE SOPHIE BUckley

TRIBUNAL MEMBER PAUL TAYLOR

TRIBUNAL member Jo murphy

 

 

Between

 

RASHID MAHMOOD

 

Applicant

and

 

The Information commissioner

 

Respondents

 

 

Representation:

For the Appellant: In person

For the Respondent: Harry Gillow (Counsel)

 

Decision: The application is dismissed.  

 

REASONS

Introduction

 

1.                       This is an application in relation to a complaint made to the Commissioner about the Commissioner's handling of a complaint made by Mr. Mahmood to the Commissioner with case number IC-206527-B3Q7.

 

To which decision does the application relate?

 

2.                       We find that this is an application in relation to the appellant's complaint with case number IC-206527-B3Q7. Mr. Mahmood did not explicitly submit otherwise, but as there are many references by him and the Commissioner to an earlier complaint, we have considered the question of the complaint to which the application relates. We have reached the conclusion that it relates to IC-206527-B3Q7 for the following reasons.

 

3.                       First, it is clear from part 3 of the application notice in which Mr. Mahmood gives the case number of the decision he is appealing against and the date of that decision (14 December 2022).

 

4.                       Second, in part 4 Mr. Mahmood does tick the box to indicate that he would like to tribunal to consider an out of time appeal, but in the reasons box he states:

 

"I am not sure, because this appeal in reference to IC-206527-B3Q7 is not out of time. However, it appears that the ICO may rely on a previous complaint where no outcome was provided and/or transparent to me until April 2022. That case ref is IC-84886-T4Z0.

 

My Solicitors made a new DSAR request to Genting in Feburary 2022 because we were not sure why Genting were saying that the ICO was satisified with their response (after confirming that Genting were breach of GDPR). The ICO on 6 September 2021 gave different decisions at the same time to both parties and this has now caused this confusion.

 

Genting now relying on that my Solictors DSAR request is now "somehow" mainefstly unfounded or excessive because according to them ICO stated that they were satisified with their response on 6 September 2021 and matter concluded. However ICO told me otherwise that matter was not concluded and still under investigation.

 

If the ICO rely that this matter is related to previous request and subsequently submit that this appeal is out of time then I kindly request the Tribunal to consider the reason for this is because ICO gave different decisions to both parties at the same time on 6 September 2021 and this has caused so much confusion and delays."

 

5.                       In those reasons Mr. Mahmood makes clear that he makes the application in relation to IC-206527-B3Q7, albeit he recognises that the Commissioner may wish to rely on a previous complaint and he anticipates that they may therefore submit that the claim is out of time.

 

6.                       It is clear to the tribunal from those sections that the application relates to the decision in IC-206527-B3Q7. This is also clear from paragraph 1 of the grounds of application which states that 'ICO has failed and is refusing to make a decision and is now referring this to the courts without making an assessment or decision'. This paragraph clearly refers to the content of the email from the Commissioner dated 14 December 2022 in IC-206527-B3Q7 in which the Commissioner states that they will be taking no further action and that this is 'now clearly a matter for the courts to decide'.

 

7.                       Although both the Commissioner and Mr. Mahmood refer in the pleadings and in their submissions to the earlier complaint, the application itself relates to IC-206527-B34Q7 and it is in relation to that complaint that the tribunal must consider under section 166 whether to make an order to progress the complaint.

 

Factual background and findings relating to the previous complaint

 

8.                       We were addressed by both parties in detail on the Commissioner's handling of Mr. Mahmood's previous complaint and have made the following findings. The relevance, if any, of these findings to this application is dealt with under 'discussion and conclusions' below.

 

9.                       Mr Mahmood first made a subject access request (SAR) to Genting Casinos Limited ('Genting') on 15 January 2019. Genting responded on 13 February 2019 with partial information. Between 1 and 2 March 2019 Genting disclosed further information and refused to disclose some information. Mr Mahmood made another SAR on 20 September 2020. On 20 October 2020 Genting responded, including information which the application thinks should have been disclosed in 2019. Mr Mahmood asserts that Genting did not provide all the requested data.  

 

10.                   The information requested was all information that Genting held on Mr. Mahmood, including:

10.1.        emails, external and internal, phone calls and further investigations and notes

10.2.        Communications between Genting and Evolution Gaming

10.3.        Communications between Genting and IBAS

10.4.        Live video footage from 8 and 9 January 2021

 

11.                   On 23 January 2021 Mr Mahmood made a complaint to the Commissioner that Genting was in breach of its data protection obligations because:

 

11.1.                 Genting held further data that they had not supplied.

11.2.                 Genting had wrongly refused to supply some video footage.

 

12.                   The Commissioner do not appear to have contacted Genting about the complaint before issuing an outcome.

 

13.                   On 24 June 2021 the Commissioner provided an outcome to Mr Mahmood in which he stated that the Commissioner considered that Genting had not complied with their data protection obligations because Mr Mahmood did not receive an appropriate response to the SAR. The letter stated that the Commissioner had written to Genting and told them to ensure they provide an appropriate response. The letter also informs Mr Mahmood that he has the right to take legal action should Genting not provide the personal data to which he is entitled.

 

14.                   The Commissioner wrote to Genting on 24 June 2021 informing them of the Commissioner's view that there had been an infringement of data protection law because Genting had not properly responded to the SAR. The letter states:

 

"We request that you revisit the way this subject access request has been handled and provide them with all of the information they are entitled to. If your organisation is withholding data please provide the ICO with details of the reasons why and the relevant exemptions that apply under data protection laws."

 

15.                   Broadly speaking, what the Commissioner was saying in both letters was that Mr. Mahmood had not received a proper response to his request. As a result it requested Genting to look again at the request and provide a proper response, including supplying all the information he is entitled to. If Genting wanted to withhold data under any exemptions, then it should provide details to the Commissioner. The Commissioner had not reached any decision on whether or not Mr. Mahmood was entitled to receive any information, nor had it reached a decision on whether Genting was entitled to withhold any information under any specific exemptions.

 

16.                   Mr. Mahmood may have read more into the letter to him of 24 June. He assumed that the Commissioner had concluded that he was entitled to the information requested and that Genting had breached their data protection obligations by withholding it from him. In support of this, Mr. Mahmood states that he called the case officer after receiving the letter and says that he was told:

 

16.1.        that Genting should send me all the data requested,

16.2.        that the main reason why the Commissioner decided that Genting had infringed the DPA was because Mr. Mahmood had provided clear evidence that they had the video footage of 8 Jan 2019 but were saying that they did not, and because of the IBAS information they did not disclose.

 

17.                   There is no contemporaneous record of this phone call, which took place approximately 2.5 years ago. Further, the letter of 24 June 2021 clearly sets out the conclusions of the Commissioner. It is very clear from that letter that the Commissioner had not concluded that Mr. Mahmood was entitled to receive the requested information, and that they had not yet considered any exemptions. For those reasons, either Mr. Mahmood has misunderstood or misremembered what was being said on the telephone, or what was said on the telephone did not accurately represent what the Commissioner had decided and communicated in its letter.

 

18.                   Genting wrote to Mr Mahmood on 20 August 2021, copied to the Commissioner, setting out why it considered that it had complied with its data protection obligations and setting out the exemptions upon which it relied. Mr. Mahmood submits that the letter relates primarily to separate civil proceedings between him and Genting. Having read the letter the tribunal disagrees. The letter largely concerns the subject access request and the related complaint made to the Commissioner. For example, the tribunal notes that in the letter Genting:

18.1.        Asserts that Genting has complied with its data protection obligations.

18.2.        Sets out the exemptions under the Data Protection Act 2018 that Genting relies on.

18.3.        Comments on the areas of contention that Mr. Mahmood has raised in his ICO complaint and follow up email.

 

19.                   Mr. Mahmood is suspicious of the fact that this email was apparently sent by 'a third party' and suggests that as a result it is not 'legal'. In the tribunal's view there is nothing suspect about the email having been sent to the Commissioner by a third party (who could be one of a variety of legitimate agents or representatives) and the letter is simply a letter setting out the position of Genting.

 

20.                   Having received this letter, the Commissioner wrote to Mr Mahmood on 6 September 2021 as follows:

 

"I am writing to you regarding the data protection concern you raised with us relating to Genting Casinos.

 

We have seen a copy of the response sent to you, dated 20 August, and pending any further developments in this matter we do not intend to take any further action.

 

Though we do not intend to take action at this time, we will keep a record of this and should we take action in the future this may form part of the intelligence we use to do so. Thank you for bringing this matter to our attention."

 

21.                   We accept that this letter is ambiguous. It does not state that the Commissioner was satisfied with Genting's response. It does not state that the Commissioner has now concluded that Genting have complied with their data protection obligations. It does not state that the complaint is closed, subject to new evidence being provided.

 

22.                   Mr. Mahmood interpreted the letter as meaning that the Commissioner remained unsatisfied with Genting's response, and that they continued to believe Genting was in breach of its data protection obligations. We do not accept that that is the natural meaning of the letter, but we accept, as stated above, that it is ambiguous.

 

23.                   The Commissioner also wrote to Genting on 6 September 2021, in slightly clearer terms, stating:

 

"Thank you for your email of 20 August 2021.

 

We are satisfied with the provided response and pending any further developments consider the matter concluded."

 

24.                   Although we have found that the letter to Mr. Mahmood was ambiguous, the position has since been clarified by the Commissioner. The first occasion was by letter dated 14 January 2022 in which the Commissioner stated:

 

 

"I apologise that you are unclear on the current status of this complaint.

 

Status of your complaint

 

At this time your complaint is closed as we are satisfied with the response provided to us by Genting Casino. As expressed to you in our email of 18 October 2021 this case is being kept in our records, in line with our retention policy. You mentioned that you had further evidence to provide following legal advice and we advised that if you provided this we would be able to take any appropriate action.

 

We would like to apologise that this has caused confusion regarding the status of your case. As we are taking no further action at this time, it is considered closed, pending any new information provided to us."

 

25.                   Thus if Mr. Mahmood had been under any misunderstanding as a result of the ambiguous letter of September 2021, by January 2022 the outcome of his complaint had been made very clear to him. The Commissioner was satisfied by the response of Genting and the case was closed, pending any new information being provided.

 

26.                   Via his solicitors Mr Mahmood submitted a further SAR to Genting on 18 February 2022. The information requested was all information that Genting held on Mr. Mahmood, including:

 

26.1.                      Video footage of 8 and 9 January 2021

26.2.                      Copies of all internal correspondence including notes relating to meetings held or conversations undertaken relating Mr. Mahmood and

26.3.                      Confirmation of third parties that Genting have provided our Mr. Mahmood's personal information and data to

 

27.                   As can be seen from our description of the information requested in 2020 above, there is a substantial overlap between the two sets of information.

 

28.                   On 22 April 2022 Genting refused to reply on the basis that the request was manifestly unfounded and excessive, relying on the letter from the Commissioner in September 2021.

 

29.                   Mr. Mahmood asked the Commissioner on a number of occasions to reopen the case, on the basis that he had provided new information. On 16 May 2022 the Commissioner wrote to Mr Mahmood as follows:

 

At this time we will not be reopening this complaint.

 

You were advised on 6 September 2021 stating that we were taking no further action having seen the response sent to you on 20 August 2021. You were further advised that this meant the case was closed pending further development on 18 October 2021 as we were satisfied with the response from Genting Casino.

 

You were advised that if you had further evidence pending your legal advice then we may be able to take further action, but this evidence was never provided to us. As it has been 7 months since the last email we sent you advising you of the status of this case it would be inappropriate to reopen this case for review.

 

30.                   On 16 May 2021 Mr. Mahmood again requested that the case be re-opened, stating that he had provided new information in July 2021. He sent another email of the same date stating 'Please let me know when you reopen this case (or in the alternative) open a new one..."

 

31.                    The Commissioner treated this as an application for a review.

 

32.                   A review was undertaken in June 2022 and the review decision again makes the outcome clear:

 

"It is my understanding that you are unhappy with our decision as you believe that Genting have failed to provide you with all of the personal data you are entitled to in response to your SAR.

 

I have reviewed the actions taken by Corey Davies and I agree with the decision reached in that Genting Casinos have complied with their data protection obligations in respect of your SAR.

 

This is because they have provided you with a response that explains what information you have been provided, what has been withheld and why this information has been withheld, including appropriate explanations of the exemptions they have applied in this instance.

 

We informed you of our decision in September 2021 and stated that we would review this decision if further evidence could be provided."

 

33.                   Thus if Mr. Mahmood had still been under any misunderstanding as a result of the ambiguous letter of September 2021, by June 2022 the outcome of his complaint had been made abundantly clear to him. The Commissioner was satisfied with the response of Genting and had concluded that Genting had complied with their data protection obligations in respect of his SAR. Further the Commissioner had explained that they had reached this conclusion because they had provided Mr. Mahmood with a response that explained what information he had been provided, what had been withheld and why that information had been withheld, including appropriate explanations of the exemptions they had applied.

 

34.                   For those reasons we conclude that by, at the very latest June 2022, Mr. Mahmood had been provided with an outcome to complaint is IC-84886-T4Z0.

 

35.                   Mr Mahmood was not satisfied with this response. In particular in an email dated 7 June 2022 he complained that he supplied new evidence without undue delay in October 2021, that he had not been told that the Commissioner was satisfied with Genting's response and that the Commissioner had sent different decisions to him and to Genting in September 2021.

 

36.                   The Commissioner replied on 7 June 2022 referring Mr. Mahmood to its letter of January 2022, noting that no new evidence had been supplied in October 2021 and stating that it was too late to re-open the complaint.

 

37.                   There was further correspondence from Mr. Mahmood which culminated in him submitting a new complaint to the Commissioner about Genting on 9 December 2022. That complaint was about Genting's refusal to reply to the new SAR made on 18 February 2022 on the grounds that it was manifestly unfounded and excessive. That is the complaint which is the subject of this application to the tribunal and was given the case number IC-206527-B3Q7

 

38.                   The Commissioner wrote to Mr. Mahmood on 14 December 2022:

 

"Thank you for registering a second personal data concern with the Information Commissioner's Office ('ICO') about Genting Casinos UK Limited ('Genting'), part of the Genting Group of companies, and their refusal to respond to your subject access request ('SAR'). We understand this is substantially the same as, and linked to, your previous concern - our case reference: IC84886-T4Z0.

 

We note that you were disappointed with the outcome in that case and, following a review, were subsequently referred to The Parliamentary and Health Service Ombudsman (PHSO).

 

The ICO also notes from Genting's letter of 22 April 2022 to your solicitors that they consider your request(s) to be "manifestly unfounded and / or excessive" and that they refuse to respond further.

 

Genting have stated the legal basis on which they are relying in refusing your SAR. It is our opinion that this is now clearly a matter for the courts to decide. As such we will be taking no further action in this matter and refer you back to your legal advisors. This Case will now close.

 

However, your complaint has been noted and will serve as intelligence towards any future regulatory action the ICO considers necessary. Thank you for bringing this matter to our attention."

 

Legal framework

 

39.                   Section 165 of the Data Protection Act 2018 provides as follows:

 

(1)  Articles 57(1)(f) and (2) and 77 of the UK GDPR (data subject's right to lodge a complaint) confer rights on data subjects to complain to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the UK GDPR.

(2)  A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act.

(3)  The Commissioner must facilitate the making of complaints under subsection (2) by taking steps such as providing a complaint form which can be completed electronically and by other means.

(4)  If the Commissioner receives a complaint under subsection (2), the Commissioner must—

take appropriate steps to respond to the complaint,

inform the complainant of the outcome of the complaint,

inform the complainant of the rights under section 166, and

if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.

(5)  The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—

(a) investigating the subject matter of the complaint, to the extent appropriate, and

(b) informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with a foreign designated authority is necessary.

 

 

40.                   At section 166, the 2018 Act provides the following redress for a failure to meet that statutory duty:

 

166 Orders to progress complaints

 

(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner—

(a) fails to take appropriate steps to respond to the complaint,

(b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or

(c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.

(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—

(a) to take appropriate steps to respond to the complaint, or

(b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

(3) An order under subsection (2)(a) may require the Commissioner— (a) to take steps specified in the order;

(b) to conclude an investigation, or take a specified step, within a period specified in the order.

(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).

 

41.                   The tribunal is extremely grateful to Mr. Gillow for his clear submissions on the effect of the case law on section 166 which were of great assistance to the tribunal when setting out the legal framework below. The tribunal was also assisted by the analysis of the case law by Upper Tribunal Judge Wikely in his determination of the permission to appeal application in Cortes v Information Commissioner UA-2023-001298-GDPA (unreported) to which Mr. Gillow referred.

 

42.                   Section 166 only applies at all if one of the conditions at section 166(1)(a), (b) or (c) is met. It is only then that the Tribunal may make one of the orders set out at section 166(2) and (3). There are further rights of action against the data controller or data processor contained at sections 167 to 169. These may only be pursued in the High Court or the county court.

 

43.                   In Killock and Veale v Information Commissioner; EW v IC and Coghlan (on behalf of C) v IC ("Killock and Veale") [2021] UKUT 299 the Upper Tribunal stated:

 

"Analysis and discussion

 

74. The remedy in s.166 is limited to the mischiefs identified in s.166(1). We agree with Judge Wikeley's conclusion in Leighton (No 2) that those are all procedural failings. They are (in broad summary) the failure to respond appropriately to a complaint, the failure to provide timely information in relation to a complaint and the failure to provide a timely complaint outcome. We do not need to go further by characterising s.166 as a "remedy for inaction" which we regard as an unnecessary gloss on the statutory provision. It is plain from the statutory words that, on an application under s.166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the s.166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a Tribunal from the procedural failings listed in s.166 towards a decision on the merits of the complaint must be firmly resisted by Tribunals.

 

75. We do not accept that the limits of s.166 mean that the rights of data subjects are not protected to the extent required by the GDPR or by the CFR. Infringement of rights under data protection legislation is remediable in the courts (ss.167-169 DPA). In addition, if a data subject decides to complain to the Commissioner, s.166 provides procedural protections in order to ensure that the complaint receives appropriate, timely and transparent consideration. The Tribunal as a judicial body has expertise in procedural matters. It is therefore apt for a Tribunal to provide a remedy against procedural failings in complaints handling.

 

76. The Tribunal does not have the same expertise in determining the appropriate outcome of complaints. The Commissioner is the expert regulator. She is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome. In so far as the Commissioner's regulatory judgments would not and cannot be matched by expertise in the Tribunal, it is readily comprehensible that Parliament has not provided a remedy in the Tribunal in relation to the merits of complaints.

 

77. This does not leave data subjects unprotected. If the Commissioner goes outside her statutory powers or makes any other error of law, the High Court will correct her on ordinary public law principles in judicial review proceedings. The combination of a statutory remedy in the Tribunal in relation to procedures and to the supervision of the High Court in relation to substance provides appropriate and effective protection to individuals. It does not require us to strain the language of s.166 to rectify any lack of protection or to correct any defect in Parliament's enactment of the UK's obligations to protect an individual's data."

 

44.                   We agree with Mr. Gillow that there is a 'slight nuance' missing from the analysis in paragraph 77 that is brought out in R (on the application of Delo) v Information Commissioner and Wise Payments Limited [2022] EWHC 3046 (Admin), a judgment recently upheld by the Court of Appeal at [2023] EWCA Civ 1141 ("Delo").

 

45.                   That 'nuance' is that the distinction between a remedy in relation to procedures in the Tribunal and the supervision of the High Court in relation to substance does not fit perfectly with the nature of judicial review. Classically, it is said that judicial review is concerned with procedure not substance. Arguably even a challenge based on irrationality is concerned first and foremost with procedure. This nuance matters, because it is important to recognise that not all procedural flaws will be for the Tribunal under section 166. Many will fall properly within the jurisdiction of the High Court.

 

46.                   The Upper Tribunal in Killock and Veale and the High Court in Delo have gone on to look at what procedural elements section 166 is concerned with, and have concluded that those are very narrow indeed and only related to the points identified in section 166 itself.

 

47.                   The Upper Tribunal held that it is the Tribunal rather than the Commissioner which decides whether a particular investigative step is reasonable, and the Commissioner's view is not decisive. But in considering appropriateness the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. In the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations he should undertake into any particular issue, and how he should conduct those investigations. This will be informed not only by the nature of the complaint itself but also by a range of other factors such as his own registry priorities, other investigations in the same subject area and his judgement on how to deploy his limited resources most effectively.

 

48.                   In paragraph 87 the Upper Tribunal states (our emphasis):

 

"87. Moreover, s.166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate "steps to respond" and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question. We do not rule out circumstances in which a complainant, having received an outcome to his or her complaint under s.165(b), may ask the Tribunal to wind back the clock and to make an order for an appropriate step to be taken in response to the complaint under s.166(2)(a). However, should that happen, the Tribunal will cast a critical eye to assure itself that the complainant is not using the s.166 process to achieve a different complaint outcome."

 

49.                   There is potentially a tension between the wording in italics and the decision of the High Court in Delo. At paragraph 131 Mostyn J states:

 

"131. For my part, if an outcome has been pronounced, I would rule out any attempt by the data subject to wind back the clock and to try by sleight of hand to achieve a different outcome by asking for an order specifying an appropriate responsive step which in fact has that effect. The Upper Tribunal rightly identified in [77] that if an outcome was pronounced which the complainant considered was unlawful or irrational then they can seek judicial review in the High Court. "

 

50.                   In our view, paragraph 131 is obiter and, in so far as there is any tension between Delo and Killock and Veale on this point, we would follow the decision of the Upper Tribunal, as the specialist body in this area of law. Therefore in our view, 'winding back the clock' is not ruled out.

 

51.                   However, it is clear from the authorities that the circumstances in which the tribunal might be able to 'wind back the clock' after an outcome has been issued without crossing the jurisdictional demarcation line are extremely limited. A good example is that given in paragraph 86 of Killock v Veale of a situation where an outcome has been issued but the tribunal finds that it would have been an appropriate step to issue it in braille.

 

52.                   That sort of 'winding back the clock' does not involve the tribunal unpicking the substantive decisions, or considering whether the decision was irrational or any other matter which is properly a question for the High Court on a judicial review.

 

53.                   However, any consideration by the tribunal, after an outcome has been issued, of whether particular steps taken to investigate the complaint were appropriate or whether relevant evidence was considered or taken into account is likely to step on the toes of the High Court. If the tribunal were to order the Commissioner to take those steps after an outcome has been issued, this would be likely to unpick or unwind that outcome. The tribunal has no power to order the Commissioner to retrospectively take a step that it deems appropriate, where taking such a step might lead to a different substantive outcome to the complaint.

 

54.                   If a complainant considers that a decision reached by the Commissioner was irrational or that the process by which it was reached is unlawful, that can be challenged by judicial review. Once a decision has been reached, the question of whether the process followed and any procedural defects might have led to a different outcome is matter for judicial review, not an application under section 166.

 

55.                   Importantly, to reach 'a decision', the Commissioner does not have to reach a decision on the substantive merits of a complaint. This is clear from the wording of the statutory framework, as the Court of Appeal noted in Delo. Warby LJ gave the leading judgment and made the following observations about 57.1(f) GDPR:

 

"60. For present purposes the most striking point about the language of that provision is that it does not contain any words that are redolent of decisions on the merits of a complaint. Article 57 does not adopt any of the familiar ways of designating a decision-making function. We are not told that the Commissioner must (for instance) adjudicate, decide, determine, rule upon, or resolve a complaint, or that complaints must be "upheld" or not upheld by the Commissioner. Rather, we are told that the Commissioner must "handle" a complaint. He must "investigate the subject-matter of the complaint" but even then only "to the extent appropriate". He must "inform" the complainant of the "progress" of the complaint and its investigation and its "outcome".

 

61. The same points can be made about Articles 77 and 78. Article 77(2) does not state that the data subject who exercises the Article 77(1) right to lodge a complaint is entitled to have the Commissioner adjudicate, or decide, or determine or resolve that complaint. It states that the Commissioner "shall inform" the complainant "on the progress and the outcome" of the complaint. No remedy is identified other than an "outcome". Article 78 does confer a right to an "effective judicial remedy" but it does not say there must be such a remedy where the Commissioner fails to determine the merits of a complaint. The conduct for which Article 78 requires an effective judicial remedy is failure to "handle" the complaint or to "inform" the data subject of its "progress" or "outcome".

 

62. These are all distinctive and unusual words to use in a context of this kind. As Mr Delo submits, a regulatory scheme usually provides for decisions to be made by the regulator. A dispute resolution mechanism calls for a definitive conclusion of the dispute. But in my view these are points against the interpretation advocated by Mr Delo rather than in favour of it. If this were domestic UK legislation intended to impose on the Commissioner a duty to reach and pronounce a decision on the merits of all complaints lodged by data subjects, in the same way that a court or tribunal would be bound to do if seised of a disputed allegation of infringement, then one would expect to see language of the kind I have mentioned at [60] above. From the perspective of an English lawyer, the absence of any such language and the use of the quite different terminology which I have highlighted are both remarkable features of Articles 57, 77 and 78. Making all due allowance for differences between the legislative methods of the UK and the EU, these are indications - and in my opinion strong ones - that the legislative intent was not to require the Commissioner to determine every complaint on its merits.

 

63. In my view, contrary to Mr Delo's submissions, the ordinary and natural interpretation of the language used in these provisions is that the Commissioner's principal obligations are to address and deal with every complaint by arriving at and informing the complainant of some form of "outcome", having first investigated the subject matter "to the extent appropriate" in the circumstances of the case. There are also second tier obligations, to inform the complainant of the progress of the investigation and of the complaint.

 

64. An "outcome" must be the end point of the Commissioner's "handling" of a complaint. A conclusive determination or ruling on the merits that brings an end to the complaint is certainly an "outcome" but that word is intended to have broader connotations. In Killock, the Upper Tribunal decided, in my view correctly, that it embraced a decision to cease handling a specific complaint whilst using it to inform and assist a wider industry investigation. In the present case, Mostyn J held that the word "outcome" is an apt description of the Commissioner's decision to conclude his consideration of Mr Delo's complaint by informing him of the Commissioner's view that the conduct complained of was "likely" to be compliant with the UK GDPR (or, put another way, that the complaint of infringement was "likely" to be ill-founded). Again, I would agree with that."

 

56.                   Thus the Commissioner's principal obligations are to address and deal with every complaint by arriving at and informing the complainant of some form of "outcome", having first investigated the subject matter "to the extent appropriate" in the circumstances of the case. There are also second tier obligations, to inform the complainant of the progress of the investigation and of the complaint.

 

57.                   It is clear from the above that there is no obligation under GDPR for that "outcome" to be a settled conclusion on whether something is or is not in breach of data protection legislation. There is no requirement for a conclusive determination on the merits of a complaint. The Commissioner's principal obligations are set out in paragraph 63 of the Court of Appeal's decision above. An "outcome" might be a conclusive determination or ruling on the merits but it also encompasses, for example, a decision to cease handling a specific complaint whilst using it to inform and assist a wider industry investigation or a decision to conclude the Commissioner's consideration of the complaint by informing the complainant of the Commissioner's view that the complaint was likely to be ill-founded.

 

Evidence

 

58.                   We read and took account of a bundle of documents.

 

Discussion and conclusions

 

59.                       The letter of 14 December 2022 provides an outcome to the complaint under consideration. It is apparent from that letter what steps the Commissioner has taken. The Commissioner has compared the complaint to the earlier complaint and concluded that it is 'substantially the same'. The Commissioner has noted Genting's letter of 22 April 2022 to Mr. Mahmood's solicitors that they consider your request(s) to be "manifestly unfounded and / or excessive" and conclude that Genting have stated the legal basis on which they are relying in refusing Mr. Mahmood's SAR. The Commissioner has then formed the opinion that this was now clearly a matter for the courts to decide. As a result the Commissioner decided that they would take no further action.

 

60.                       Mr. Mahmood argues in the grounds of appeal that the Commissioner is 'refusing to make any decision or outcome' and is not complying with section 165 DPA. As the authorities above make clear, there is no statutory requirement for the Commissioner to determine the substantive merits of the complaint.

 

61.                       The decision that the Commissioner reached is that it would take no further action having considered the similarities to the previous complaint. That is clearly capable of constituting an "outcome", as required under GDPR. That outcome was provided to Mr. Mahmood. We find that the Commissioner has not refused to provide a decision or outcome. It has reached a decision and the outcome has been communicated to the complainant.

 

62.                       For the reasons set out above under 'Factual background and findings relating to the previous complaint' we have concluded that the Commissioner also reached a decision and communicated an outcome to the complainant in relation to his previous complaint.

 

63.                       To the extent that Mr. Mahmood asks us to consider whether the Commissioner was right to decide to take no further action in the light of the previous complaint, that is not within our remit under section 166. That is a challenge to the substantive decision made by the Commissioner.

 

64.                       To the extent that Mr. Mahmood argues that, in reaching that decision, the Commissioner relied on what he says was a flawed investigation or outcome in his previous complaint, or a flawed investigation of the current complaint, we accept Mr. Gillow's submission that that is exactly the type of argument that can only properly be made in a judicial review, where the court can consider whether, on the basis of any defects in the decision making process, the decision was procedurally flawed, or irrational or that no reasonable decision maker could have reached that decision. That is not our role. We cannot unpick or unravel a decision of the Commissioner once an outcome has been communicated.

 

65.                       We have, in any case, been taken through the Commissioner's handling of the previous complaint and although we say this is not necessary to determine this application, we have given our view above on whether or not an outcome had been given in the section entitled Factual background and findings relating to the previous complaint above.

 

66.                       To the extent that Mr. Mahmood argues that Genting were in breach of their data protection obligations, that is also outside our remit. That is a matter for the courts to consider under section 167.

 

67.                       We note Mr. Mahmood's practical concerns about bringing an action for judicial review or under section 167. It may well be the case that any action for judicial review is now out of time. It may well be the case that solicitors are more willing to 'take on' a complaint under section 167, presumably on a conditional fee basis rather than at all, if there exists a favourable outcome by the Commissioner. These points do not assist him in this application. The tribunal's jurisdiction is limited by statute. We have no power to consider matters outside our jurisdiction even if we were persuaded that it was in the interests of justice to do so.

 

68.                       For those reasons, the application under section 166 is dismissed.

 

Signed Sophie Buckley

Judge of the First-tier Tribunal

Date: 20 December 2023