Shahina Chowdhury v The Information Commissioner

On 16 April 2021 the applicant made a complaint to the Commissioner that the Secret Intelligence Service (“SIS”) had handled her personal information. On 29 July 2021 the Commissioner provided an outcome to the complaint, confirming that correspondence between SIS and the applicant had been reviewed and that in the in the view of the Commissioner SIS had complied with its data protection obligations. This was confirmed by a case review sent to the applicant on 16 November 2021.

On 30 January 2022 the applicant made an application pursuant to s.166 of the Data Protection Act 2018, requesting the following outcome:

After some preliminary procedural issues, on 30 June 2022 the Commissioner filed a response to the application pursuant to rule 23 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009. It contained an application for the proceedings to be struck out as having no reasonable prospect of success. The Commissioner argued that the application:

It continued by referring to alternative remedies under the 2018 Act, and asking the Tribunal to strike out the proceedings as having no reasonable prospect of success.

The applicant sent an email on 20 June 2022 containing her representations as to why the application should not be struck out. On 4 August 2022 notice was sent to the applicant that the strike out application would be considered at a hearing to take place by video on 24 August 2022.

The Commissioner notified the Tribunal that he would not attend, and is content to rely on his written representations. The applicant made an application for the hearing to instead take place face-to-face at a London location, suggesting Taylor House Hearing Centre. Judge Griffin refused the application on 11 August 2022, suggesting alternative solutions that might be available to the applicant. A renewed application was refused by me on 15 August 2022. Both my decision and that of Judge Griffin were accompanied by written reasons, but I should emphasise that the possibility of renewal or reasonable adjustments was notified to the applicant. The only communication received from the applicant since is a letter to the Chamber President. Its contents do not affect the way in which the Tribunal ought to proceed today.

The applicant did not attend the hearing. Nor did she attend a CVP connection test offered to her earlier in the week. I am satisfied that the applicant has had fair notice of the hearing and voluntarily chose not to attend, and I make my decision based on the parties’ written representations.

The statutory scheme only allows the Tribunal to address procedural failings by the Commissioner, rather than decide on a different substantive outcome to the complaint: Leighton v Information Commissioner (No.2) (Information rights - Data protection) [2020] UKUT 23 (AAC). While the Tribunal does have the final say in considering the appropriateness of investigative steps, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. In the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations he should undertake into any particular issue, and how he should conduct those investigations. This will be informed not only by the nature of the complaint itself but also by a range of other factors such as his own registry priorities, other investigations in the same subject area and his judgement on how to deploy his limited resources most effectively: Killock & Ors v Information Commissioner [2021] UKUT 299.

I have carefully considered everything the applicant has put in writing. The notice of application asks that particular bodies be summoned to an oral hearing. That misunderstands the Tribunal’s powers under s.166 of the Act, which extend only to requiring the Commissioner to take appropriate steps to respond to the complaint. Her written submissions also ask that the Commissioner be ordered to issue an Information Notice pursuant to s.142. Even if the Tribunal’s jurisdiction does extend that far, the appellant has not provided any arguable basis upon which a Tribunal could possibly decide that the investigative steps already taken by the Commissioner are deficient. The Commissioner confirms that the data controller has fully cooperated in the investigation. There is no arguable need for a formal notice.

I am therefore satisfied that no part of the applicant’s case has a reasonable prospect of succeeding. While the Tribunal’s Procedure Rules empower it to summon witnesses, it will never be appropriate to do so if those witnesses cannot give any evidence relevant to the actual issues in the application. Such evidence could not be relevant, because under s.166 the Tribunal can only direct the Commissioner as to his procedural response to the complaint. I do not set out all the applicant’s written arguments, but suffice to say none of them raise any possible prospect of successfully persuading the Tribunal that it should make any order under s.166. On a fair reading, the application really demands a judicial inquiry into whether the security services have misused the applicant’s personal data. The 2018 Act does not afford her that opportunity. I strike out the proceedings as having no reasonable prospect of success.