Matthew Cox v Information Commissioner

On 27 February 2021 Mr Cox made a complaint to the Commissioner concerning the handling of his personal data by Bangor University. The Commissioner responded by requiring Bangor University to undertake further specified steps to respond. After further correspondence between the three parties, on 15 October 2021 the Commissioner confirmed to Mr Cox that he was now of the view that Bangor University had complied with their data protection obligations.

The present application to the Tribunal was made on 11 November 2021. It contained an application for an extension of time, but the application was made within the relevant 28 day time limit. I treat it as an application for additional time to provide further grounds in support, and further representations have accordingly been made. The substantive outcome sought by Mr Cox is as follows:

The Commissioner has responded by applying for the proceedings to be struck out as having no reasonable prospects of success. The Commissioner argues that Mr Cox has already received an outcome to his complaint, and that there is nothing further that the Tribunal could order the Commissioner to do. As to (2) and (3) above, neither the Commissioner upon receiving a complaint nor the Tribunal on the making of this application have any jurisdiction to award compensation. The Tribunal does have a jurisdiction to order costs in the limited circumstances set out in r.10 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 but this does not extend to the type of remedy sought by Mr Cox.

The application was previously withdrawn by Mr Cox following what appears to have been constructive dialogue at resolving his issues with Bangor University. After that dialogue broke down he applied for the application to be reinstated, which was approved by a Registrar on 26 May 2022. Mr Cox was sent a copy of the Commissioner’s strike-out application and directed to provide representations in response. He did so on 13 June 2022, as follows:

The Commissioner’s strike-out application has been listed for oral hearing. The Commissioner has confirmed that he is content to rely on the written submissions he has already made. I heard oral submissions from Mr Cox, and considered all the documents provided to the Tribunal.

The complaint to the Commissioner engages ss.165 and 166 of the Data Protection Act 2018, which set out how the Commissioner must respond to complaints and the Tribunal’s jurisdiction to make orders to progress them. The Commissioner’s statutory duty upon receiving a complaint is contained within s.165:

At s.166, the 2018 Act provides the following redress for a failure to meet that statutory duty:

It can be seen from the plain language of the statute that the section will only apply at all if one of the conditions at s.166(1)(a), (b) or (c) is met. There are further rights of action against the data controller or data processor contained at ss.167-169. These may only be pursued in the High Court or the county court, not in this Tribunal.

The scope of s.166 was considered by the Upper Tribunal in Leighton v The Information Commissioner (No.2) (Information rights - Data protection) [2020] UKUT 23 (AAC). The Upper Tribunal’s analysis, which is binding upon me, was as follows:

The Upper Tribunal reached the same conclusion in Scranage v Information Commissioner [2020] UKUT 196 (AAC), holding that – contrary to many data subjects’ expectations – s.166 does not provide a right of appeal against the substantive outcome of the Commissioner’s investigation on its merits. The provision is procedural rather than substantive in its focus.

In Killock & Ors v Information Commissioner [2021] UKUT 299 the Upper Tribunal held that s.166 is ‘forward-looking’. The Tribunal is concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint, specifying appropriate “steps to respond” rather than assessing the appropriateness of a response that has already been given. The same applies to orders under s.166(2)(b) requiring the Commissioner to inform the complainant of progress on the complaint or of the outcome of the complaint within a specified period. These are procedural matters (giving information) and should not be used to achieve a substantive regulatory outcome. A dissatisfied complainant must instead have recourse to the legal remedies at ss.167-169, or bring judicial review proceedings against the Commissioner in the Administrative Court.

Killock does contain an important caveat to the above, expressed by the Upper Tribunal as follows:

The Upper Tribunal held that it is the Tribunal rather than the Commissioner which decides whether a particular investigative step is reasonable, the Commissioner’s view is not decisive. But in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. In the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations he should undertake into any particular issue, and how he should conduct those investigations. This will be informed not only by the nature of the complaint itself but also by a range of other factors such as his own registry priorities, other investigations in the same subject area and his judgement on how to deploy his limited resources most effectively.

As to when it is appropriate to strike out proceedings due to a lack of reasonable prospects of success, in HMRC v Fairford Group (in liquidation) and Fairford Partnership Limited (in liquidation) [2014] UKUT 329 it was held that the approach should be similar to that taken in the civil courts pursuant to r.3.4 of the Civil Procedure Rules. The Tribunal must consider whether there is a realistic, as opposed to a fanciful (in the sense of being entirely without substance) prospect of succeeding on the issue on full consideration. A ‘realistic’ prospect of success is one that carries some degree of conviction and not one that is merely arguable. The Tribunal must avoid conducting a ‘mini-trial’. The power to strike out must be exercised in accordance with all aspects of the overriding objective (at r.2 of the Procedure Rules) to deal with cases fairly and justly, its effect being to debar a litigant from a full hearing of his claim. Yet striking out will be the correct course of action, and support the overriding objective, where an appeal or application raises an unwinnable case and continuance of the proceedings would be without any possible benefit to the parties and a waste of resources.

I have no hesitation in striking out the proceedings insofar as Mr Cox seeks compensation and costs against either the Commissioner or Bangor University. The Data Protection Act 2018 provides a number of remedies for breach of its provisions. Compensation is available under ss.168-169 of the Act but may only be awarded by a court, not by this Tribunal. There is no prospect at all of Mr Cox’s application succeeding in that respect. Mr Cox accepted this at the hearing.

The remaining issue is the remedy sought at (1) of the Notice of Application, as set out at paragraph 3 above. I am grateful to Mr Cox for his measured and thoughtful submissions. He acknowledged the procedural nature of the Tribunal’s jurisdiction, according to the legal principles set out in the Commissioner’s strike out application, and argued that his application fell within the category of cases where it was appropriate to ‘wind back the clock’ in order that appropriate steps were taken to respond to his complaint. Bangor University had claimed that it would take 100 hours to undertake the search Mr Cox requested. Mr Cox does not dispute that figure, but argues that in finding it disproportionate the Commissioner had omitted to consider that it is not only Mr Cox’s own interests at stake. On his case, he says, sensitive medical details of 1,700 respondents to a survey were wrongly shared. That merited greater investigation by Bangor University and, in turn, the Commissioner.

I can see that where the Commissioner responds to a complaint by upholding a data controller’s proportionality argument, but fails to engage at all with the actual scale of the problem asserted by the complainant, an order under s.166(2)(a) might in principle be appropriate. But notwithstanding Mr Cox’s submissions that the Commissioner has always been aware of that background, having gone through the evidence provided by Mr Cox there is nothing which might possibly lead to a Tribunal concluding (1) that Mr Cox ever had any basis for thinking that such sensitive medical details were dealt with in breach of data protection principles or (2) that this ever formed any part of his complaint until after it had been rejected.

The only pre-complaint mention of the interests of other survey respondents is in an email where Mr Cox warns that he will be contacting them. As part of the disclosure made to Mr Cox, on 13 April 2021 the “extent” of the information disclosed to other universities was set out. Assuming that this even relates to the same data, which is unclear, it only contains the mean scores of their responses and not any data that might arguably identify any individuals. I cannot see that its disclosure to academics could lead any Tribunal to conclude that the Commissioner ought to have addressed the survey respondents’ interests when determining the scope of his investigation. Nor has Mr Cox actually asserted that information was disclosed that might identify individual respondents. Instead the correspondence with Bangor University has concerned Mr Cox’s intellectual property claim concerning the use of his ‘works’ and wishing to know to whom it has been disclosed and any commercial use to which it has been put. While a letter from Womble Bond Dickinson written on Mr Cox’s behalf states that the claim and SARs are separate, it is beyond doubt that the present data protection dispute is in pursuit of the former: the grounds in support of Mr Cox’s application freely admit that the requests are made as a more cost-effective alternative to pre-action disclosure. An email sent by Mr Cox after proceedings were already underway does raise that the complaint involved “the misuse and misappropriate of research data … of more than 1700 respondents”, but it is clear from the surrounding context that the misuse and misappropriation cited is the claimed breach of Mr Cox’s intellectual property rights.

There is therefore no arguable case to be made by Mr Cox that he raised unlawful handling of 1,700 survey respondents’ sensitive data in his complaint, only to be ignored. It formed no part of his complaint at all. Even if it was mentioned by telephone, or in correspondence that has not been provided, there is no arguable case to be made that the Commissioner had such grounds to include this factor in assessing proportionality that the Tribunal could possibly disagree with his approach.

Having disposed of that asserted flaw in the Commissioner’s response, I turn to what remains. The extent of the search required is well stated in the documents and there is no reasonable prospect of establishing any defect in the procedure whereby the Commissioner concluded that there had been no breach of data protection principles. Mr Cox has failed to identify any other defect that carries a realistic prospect of success. Of course I am not deciding Mr Cox’s application, I must instead determine whether it has a real prospect of success if it does come to be decided. For the reasons I have given, and applying the legal principles identified above, it does not. No useful purpose would be served by the proceedings continuing and I exercise the discretion to strike out the proceedings pursuant to rule 8(3)(c).