Skip to Main Content
Alpha

Help us to improve this service by completing our feedback survey (opens in new tab).

Matthew Cox v Information Commissioner

[2022] UKFTT 297 (GRC)

NCN:[2022] UKFTT 00297 (GRC)

Case Reference: EA/2021/0340/GDPR;

First-tier Tribunal
General Regulatory Chamber

Information Rights

Heard by: CVP

Heard on: 22 August 2022

Decision given on: 25 August 2022

Before

TRIBUNAL JUDGE NEVILLE

Between

MR MATTHEW COX

Applicant

and

INFORMATION COMMISSIONER

Respondent

Representation:

For the Applicant: The applicant in person

For the Respondent: No attendance

DECISION

The proceedings are struck out pursuant to r.8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.

REASONS

1.

On 27 February 2021 Mr Cox made a complaint to the Commissioner concerning the handling of his personal data by Bangor University. The Commissioner responded by requiring Bangor University to undertake further specified steps to respond. After further correspondence between the three parties, on 15 October 2021 the Commissioner confirmed to Mr Cox that he was now of the view that Bangor University had complied with their data protection obligations.

2.

The present application to the Tribunal was made on 11 November 2021. It contained an application for an extension of time, but the application was made within the relevant 28 day time limit. I treat it as an application for additional time to provide further grounds in support, and further representations have accordingly been made. The substantive outcome sought by Mr Cox is as follows:

The ICO has been unable to fully consider context, fiscal proportionality or the University’s conduct. The SAR(2) is a proportionate way to resolve the dispute and is not excessive.

(1)

Compel Bangor University to provide a full and appropriate response to SAR2.

(2)

Compensation by way of legal costs incurred as a result of the University’s misconduct.

(3)

Compensation to remedy GDPR breach, distress, worry and frustration.

3.

The Commissioner has responded by applying for the proceedings to be struck out as having no reasonable prospects of success. The Commissioner argues that Mr Cox has already received an outcome to his complaint, and that there is nothing further that the Tribunal could order the Commissioner to do. As to (2) and (3) above, neither the Commissioner upon receiving a complaint nor the Tribunal on the making of this application have any jurisdiction to award compensation. The Tribunal does have a jurisdiction to order costs in the limited circumstances set out in r.10 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 but this does not extend to the type of remedy sought by Mr Cox.

4.

The application was previously withdrawn by Mr Cox following what appears to have been constructive dialogue at resolving his issues with Bangor University. After that dialogue broke down he applied for the application to be reinstated, which was approved by a Registrar on 26 May 2022. Mr Cox was sent a copy of the Commissioner’s strike-out application and directed to provide representations in response. He did so on 13 June 2022, as follows:

The ICO's judgment was based on incomplete and misleading evidence. The formal complaints process was not appropriate given the delayed response by the ICO - the complaints timeline and ICO's delayed response would have exceeded the time in which an appeal could have been made to the GRC.

All evidence was offered to the ICO but no response was received.

This evidence was provided to the ICO and GRC 22 November 2021.

On 22 November an error was identified and clarification was sought.

A formal request that all available evidence be considered by the ICO was made 23 November.

Finally, on 24 November, a copy of a report published by Bangor University (Prof Rogers; who is the member of staff shared the data - now head of research and governance) was forwarded to the ICO and GRC.

This concordat falsely reports to the University's ethics and governance regulators that no complaints had been received. All evidence is now in the possession of the ICO and identifies that Bangor University broke their own policies governing Data usage and subject access requests - which they have yet to comply with. The ICO have not responded to the evidence made available to them and I would ask that all evidence be reviewed by the register or judge before a decision is made.

5.

The Commissioner’s strike-out application has been listed for oral hearing. The Commissioner has confirmed that he is content to rely on the written submissions he has already made. I heard oral submissions from Mr Cox, and considered all the documents provided to the Tribunal.

Legal principles

6.

The complaint to the Commissioner engages ss.165 and 166 of the Data Protection Act 2018, which set out how the Commissioner must respond to complaints and the Tribunal’s jurisdiction to make orders to progress them. The Commissioner’s statutory duty upon receiving a complaint is contained within s.165:

(4) If the Commissioner receives a complaint under subsection (2), the Commissioner must—

(a) take appropriate steps to respond to the complaint,

(b) inform the complainant of the outcome of the complaint,

(c) inform the complainant of the rights under section 166, and

(d) if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.

(5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—

(a) investigating the subject matter of the complaint, to the extent appropriate, and

(b) informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with [a]2 foreign designated authority is necessary.

7.

At s.166, the 2018 Act provides the following redress for a failure to meet that statutory duty:

166

Orders to progress complaints

(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the [UK GDPR] , the Commissioner—

(a) fails to take appropriate steps to respond to the complaint,

(b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or

(c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.

(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—

(a) to take appropriate steps to respond to the complaint, or

(b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

(3) An order under subsection (2)(a) may require the Commissioner—

(a) to take steps specified in the order;

(b) to conclude an investigation, or take a specified step, within a period specified in the order.

(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).

8.

It can be seen from the plain language of the statute that the section will only apply at all if one of the conditions at s.166(1)(a), (b) or (c) is met. There are further rights of action against the data controller or data processor contained at ss.167-169. These may only be pursued in the High Court or the county court, not in this Tribunal.

9.

The scope of s.166 was considered by the Upper Tribunal in Leighton v The Information Commissioner (No.2) (Information rights - Data protection) [2020] UKUT 23 (AAC). The Upper Tribunal’s analysis, which is binding upon me, was as follows:

31.

I note that in Platts v Information Commissioner (EA/2018/0211/GDPR) the FTT accepted a submission made on behalf of the Commissioner that “s.166 DPA 2018 does not provide a right of appeal against the substantive outcome of an investigation into a complaint under s.165DPA 2018” (at paragraph [13]). Whilst that is a not a precedent setting decision, I consider that it is right as a matter of legal analysis. Section 166 is directed towards providing a tribunal based remedy where the Commissioner fails to address a section 165 complaint in a procedurally proper fashion. Thus, the mischiefs identified by section 166(1) are all procedural failings. “Appropriate steps” mean just that, and not an “appropriate outcome”. Likewise, the FTT’s powers include making an order that the Commissioner “take appropriate steps to respond to the complaint”, and not to “take appropriate steps to resolve the complaint”, least of all to resolve the matter to the satisfaction of the complainant. Furthermore, if the FTT had the jurisdiction to determine the substantive merits of the outcome of the Commissioner’s investigation, the consequence would be jurisdictional confusion, given the data subject’s rights to bring a civil claim in the courts under sections 167-169 (see further DPA 2018 s.180).

10.

The Upper Tribunal reached the same conclusion in Scranage v Information Commissioner [2020] UKUT 196 (AAC), holding that – contrary to many data subjects’ expectations – s.166 does not provide a right of appeal against the substantive outcome of the Commissioner’s investigation on its merits. The provision is procedural rather than substantive in its focus.

11.

In Killock & Ors v Information Commissioner [2021] UKUT 299 the Upper Tribunal held that s.166 is ‘forward-looking’. The Tribunal is concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint, specifying appropriate “steps to respond” rather than assessing the appropriateness of a response that has already been given. The same applies to orders under s.166(2)(b) requiring the Commissioner to inform the complainant of progress on the complaint or of the outcome of the complaint within a specified period. These are procedural matters (giving information) and should not be used to achieve a substantive regulatory outcome. A dissatisfied complainant must instead have recourse to the legal remedies at ss.167-169, or bring judicial review proceedings against the Commissioner in the Administrative Court.

12.

Killock does contain an important caveat to the above, expressed by the Upper Tribunal as follows:

87.

… We do not rule out circumstances in which a complainant, having received an outcome to his or her complaint under s.165(b), may ask the Tribunal to wind back the clock and to make an order for an appropriate step to be taken in response to the complaint under s.166(2)(a). However, should that happen, the Tribunal will cast a critical eye to assure itself that the complainant is not using the s.166 process to achieve a different complaint outcome.

13.

The Upper Tribunal held that it is the Tribunal rather than the Commissioner which decides whether a particular investigative step is reasonable, the Commissioner’s view is not decisive. But in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. In the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations he should undertake into any particular issue, and how he should conduct those investigations. This will be informed not only by the nature of the complaint itself but also by a range of other factors such as his own registry priorities, other investigations in the same subject area and his judgement on how to deploy his limited resources most effectively.

14.

As to when it is appropriate to strike out proceedings due to a lack of reasonable prospects of success, in HMRC v Fairford Group (in liquidation) and Fairford Partnership Limited (in liquidation) [2014] UKUT 329 it was held that the approach should be similar to that taken in the civil courts pursuant to r.3.4 of the Civil Procedure Rules. The Tribunal must consider whether there is a realistic, as opposed to a fanciful (in the sense of being entirely without substance) prospect of succeeding on the issue on full consideration. A ‘realistic’ prospect of success is one that carries some degree of conviction and not one that is merely arguable. The Tribunal must avoid conducting a ‘mini-trial’. The power to strike out must be exercised in accordance with all aspects of the overriding objective (at r.2 of the Procedure Rules) to deal with cases fairly and justly, its effect being to debar a litigant from a full hearing of his claim. Yet striking out will be the correct course of action, and support the overriding objective, where an appeal or application raises an unwinnable case and continuance of the proceedings would be without any possible benefit to the parties and a waste of resources.

Consideration

15.

I have no hesitation in striking out the proceedings insofar as Mr Cox seeks compensation and costs against either the Commissioner or Bangor University. The Data Protection Act 2018 provides a number of remedies for breach of its provisions. Compensation is available under ss.168-169 of the Act but may only be awarded by a court, not by this Tribunal. There is no prospect at all of Mr Cox’s application succeeding in that respect. Mr Cox accepted this at the hearing.

16.

The remaining issue is the remedy sought at (1) of the Notice of Application, as set out at paragraph 3 above. I am grateful to Mr Cox for his measured and thoughtful submissions. He acknowledged the procedural nature of the Tribunal’s jurisdiction, according to the legal principles set out in the Commissioner’s strike out application, and argued that his application fell within the category of cases where it was appropriate to ‘wind back the clock’ in order that appropriate steps were taken to respond to his complaint. Bangor University had claimed that it would take 100 hours to undertake the search Mr Cox requested. Mr Cox does not dispute that figure, but argues that in finding it disproportionate the Commissioner had omitted to consider that it is not only Mr Cox’s own interests at stake. On his case, he says, sensitive medical details of 1,700 respondents to a survey were wrongly shared. That merited greater investigation by Bangor University and, in turn, the Commissioner.

17.

I can see that where the Commissioner responds to a complaint by upholding a data controller’s proportionality argument, but fails to engage at all with the actual scale of the problem asserted by the complainant, an order under s.166(2)(a) might in principle be appropriate. But notwithstanding Mr Cox’s submissions that the Commissioner has always been aware of that background, having gone through the evidence provided by Mr Cox there is nothing which might possibly lead to a Tribunal concluding (1) that Mr Cox ever had any basis for thinking that such sensitive medical details were dealt with in breach of data protection principles or (2) that this ever formed any part of his complaint until after it had been rejected.

18.

The only pre-complaint mention of the interests of other survey respondents is in an email where Mr Cox warns that he will be contacting them. As part of the disclosure made to Mr Cox, on 13 April 2021 the “extent” of the information disclosed to other universities was set out. Assuming that this even relates to the same data, which is unclear, it only contains the mean scores of their responses and not any data that might arguably identify any individuals. I cannot see that its disclosure to academics could lead any Tribunal to conclude that the Commissioner ought to have addressed the survey respondents’ interests when determining the scope of his investigation. Nor has Mr Cox actually asserted that information was disclosed that might identify individual respondents. Instead the correspondence with Bangor University has concerned Mr Cox’s intellectual property claim concerning the use of his ‘works’ and wishing to know to whom it has been disclosed and any commercial use to which it has been put. While a letter from Womble Bond Dickinson written on Mr Cox’s behalf states that the claim and SARs are separate, it is beyond doubt that the present data protection dispute is in pursuit of the former: the grounds in support of Mr Cox’s application freely admit that the requests are made as a more cost-effective alternative to pre-action disclosure. An email sent by Mr Cox after proceedings were already underway does raise that the complaint involved “the misuse and misappropriate of research data … of more than 1700 respondents”, but it is clear from the surrounding context that the misuse and misappropriation cited is the claimed breach of Mr Cox’s intellectual property rights.

19.

There is therefore no arguable case to be made by Mr Cox that he raised unlawful handling of 1,700 survey respondents’ sensitive data in his complaint, only to be ignored. It formed no part of his complaint at all. Even if it was mentioned by telephone, or in correspondence that has not been provided, there is no arguable case to be made that the Commissioner had such grounds to include this factor in assessing proportionality that the Tribunal could possibly disagree with his approach.

20.

Having disposed of that asserted flaw in the Commissioner’s response, I turn to what remains. The extent of the search required is well stated in the documents and there is no reasonable prospect of establishing any defect in the procedure whereby the Commissioner concluded that there had been no breach of data protection principles. Mr Cox has failed to identify any other defect that carries a realistic prospect of success. Of course I am not deciding Mr Cox’s application, I must instead determine whether it has a real prospect of success if it does come to be decided. For the reasons I have given, and applying the legal principles identified above, it does not. No useful purpose would be served by the proceedings continuing and I exercise the discretion to strike out the proceedings pursuant to rule 8(3)(c).

Signed Date:

Judge Neville 25 August 2022

Matthew Cox v Information Commissioner

[2022] UKFTT 297 (GRC)

Download options

Download this judgment as a PDF (139.4 KB)

The original format of the judgment as handed down by the court, for printing and downloading.

Download this judgment as XML

The judgment in machine-readable LegalDocML format for developers, data scientists and researchers.