Mike Davies v Information Commissioner

On 10 January 2022 the applicant made a complaint to the Commissioner that the Labour Party had not provided a response to his Subject Access Request made on 24 September 2021 within the one month time limit provided by Article 12(3) of UK GDPR. On 26 April 2022 the present application was made to the Tribunal by the applicant pursuant to s.166 of the Data Protection Act 2018:

The application was manifestly well-founded when it was made as there had been no response to the initial complaint within an initial period of 3 months. On 4 May 2022 the Commissioner provided an outcome to the complaint, as follows:

The Commissioner subsequently provided a response to the present application pursuant to rule 23 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009, an extension of time having been sought for that purpose. Within the response the Commissioner requests that the application be struck out as having no reasonable prospects of success, the applicant having now had an outcome to this complaint and there being nothing left for the Tribunal to do.

The Tribunal listed a remote hearing on 24 August 2022. The applicant attended. The Commissioner had confirmed that he would not be represented and would rely on his written submissions.

I directed the applicant to the relevant legal principles. The statutory scheme only allows the Tribunal to address procedural failings by the Commissioner, rather than decide on a different substantive outcome to the complaint: Leighton v Information Commissioner (No.2) (Information rights - Data protection) [2020] UKUT 23 (AAC). Contrary to many data subjects’ expectations, s.166 does not provide a right of appeal against the substantive outcome of the Commissioner’s investigation on its merits: Scranage v Information Commissioner [2020] UKUT 196 (AAC). While the Tribunal does have the final say in considering the appropriateness of investigative steps, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. In the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations he should undertake into any particular issue, and how he should conduct those investigations. This will be informed not only by the nature of the complaint itself but also by a range of other factors such as his own registry priorities, other investigations in the same subject area and his judgement on how to deploy his limited resources most effectively: Killock & Ors v Information Commissioner [2021] UKUT 299.

As to when it is appropriate to strike out proceedings due to a lack of reasonable prospects of success, in HMRC v Fairford Group (in liquidation) and Fairford Partnership Limited (in liquidation) [2014] UKUT 329 it was held that the approach should be similar to that taken in the civil courts pursuant to r.3.4 of the Civil Procedure Rules. The Tribunal must consider whether there is a realistic, as opposed to a fanciful (in the sense of being entirely without substance) prospect of succeeding on the issue on full consideration. A ‘realistic’ prospect of success is one that carries some degree of conviction and not one that is merely arguable. The Tribunal must avoid conducting a ‘mini-trial’. The power to strike out must be exercised in accordance with all aspects of the overriding objective (at r.2 of the Procedure Rules) to deal with cases fairly and justly, its effect being to debar a litigant from a full hearing of his claim. Yet striking out will be the correct course of action, and support the overriding objective, where an appeal or application raises an unwinnable case and continuance of the proceedings would be without any possible benefit to the parties and a waste of resources.

Mr Davies told me that he had still not had a response to his SAR despite it having been nearly a year since it was made. This was, he said, part of a wider failure by the Labour Party to respond to SARs in accordance with the law. The Commissioner was aware of the problem but appeared to be doing nothing about it. Responding to the complaint by simply informing the Labour Party that it had been upheld served no purpose. The result is that the Labour Party is routinely in breach of the law and faces no consequences from the regulator.

Carefully considering Mr Davies’ submissions, I consider that the proceedings ought to be struck out as having no reasonable prospects of success. The obligation of the Commissioner is to take appropriate steps to respond to the complaint. Informing a data controller that it is in breach of the law and that it should now comply does provide the response to a complaint provided by the 2018 Act. I would observe that such a finding is often the final outcome in a wide range of regulatory complaints. Whether the circumstances are such that the Commissioner ought to be taking further action in relation to the Labour Party in particular, in general or in response to this complaint in particular, is a paradigm example of a matter falling within the Commissioner’s regulatory competence. There is no basis in the present case for the Tribunal to interfere that can withstand the principles set out in Killock. The Commissioner is therefore right that there is nothing left for the Tribunal to do.

None of the above should be taken as any criticism of Mr Davies. He simply wants the Labour Party to comply with the law and respond to his Subject Access Request. They should have done so within 1 month (3 months in certain circumstances) but did not. Mr Davies was then entitled to complain to the Commissioner, and to have a response within 3 months. The Commissioner only provided an outcome after the present application to the Tribunal was made, likely causing greater resources to be expended by all concerned than if he had responded within the proper timescale. On one view, that outcome simply told Mr Davies and the Labour what they already knew. So Mr Davies’ frustration, with no response to his SAR nearly a year after it was made, is understandable. But this Tribunal cannot provide a remedy.