Tahirah Pirmohamed v Information Commissioner

The proceedings were held by video hearing on 21 September 2021; the decision was given at that hearing. This is a written version of the decision that was delivered orally at the hearing. The Respondent had indicated that she did not intend to participate in the hearing. The Tribunal was satisfied that it was fair and just to conduct the hearing in this way.

On 3 December 2019 the Applicant complained to the Information Commissioner about an organization that she said held inaccurate personal data about her and had shared that data with a third party. The Applicant’s complaint was allocated case reference RFA0895327.

After corresponding with the applicant and the organisation the respondent wrote to the applicant on 11 September 2020. The case officer stated that she did not consider it appropriate or necessary to pursue further action with Babcock, and confirmed that she had provided Babcock with advice regarding their wider information rights practices, the case officer expressed her conclusion that she was satisfied that Babcock were putting things right.

On 13 November 2020 the Applicant submitted a request for a case review.

On 18 December 2020 the respondent acknowledged receipt of the request for a case review which was allocated case reference IC-71083-G9B0.

On 16 January 2021 and 27 January 2021 the Applicant wrote to the case officer to request a response to her request for a case review.

On 30 April 2021 the applicant sent her notice of application to the tribunal

On 13 May 2021 an ICO reviewing officer wrote to the Applicant with a response to her case review request. The reviewing officer stated that she had reviewed the points raised by the Applicant and had reviewed the relevant information held regarding the concern. The reviewing officer said that she was satisfied that the complaint was handled appropriately and in line with case handling procedures. The reviewing officer said that, having reviewed the matter, she agreed with the case officer’s explanations provided to the applicant and agreed with the steps taken by the case officer.

In the notice of application the Applicant said that they would like the following remedies from the Tribunal

The application was interpreted by the Tribunal as an application under section 166 Data Protection Act 2018 [DPA18].

In the response to the application the Information Commissioner invited the Applicant to withdraw her application because she had received a response to her request for a case review but in the event she did not do so,] the Information Commissioner has applied for this case to be struck out pursuant to rule 8(3)(a) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009. It was argued that as there has been an outcome provided to the Applicant, the Tribunal no longer has any power to make an order under s166 and thus her application has no reasonable prospect of succeeding.

The Applicant not having withdrawn her appeal I considered the application to strike out these proceedings on the basis that they have no reasonable prospects of success.

At the hearing Ms Pirmohamed explained that she felt she had done everything she could as regards the organisation and that she felt the respondent’s approach had been dismissive of her concerns about her personal data. She noted that the respondent had only provided the response to the case review after she had contacted the tribunal. She did not agree with the outcome of the respondent’s investigation or the method with which they reached it.

Since the DPA18 came into force a person can apply to this Tribunal for an “order to progress complaints” under section 166.

Under section 166 DPA18, a data subject has a right to make an application to the Tribunal if they consider that the Commissioner has failed to take certain procedural actions in relation to their complaint.

Section 166 DPA18 as relevant states:

The powers of the Tribunal in considering such applications have been considered by the Upper Tribunal. These cases are binding on the First Tier Tribunal of which the General Regulatory Chamber is a part. (Footnote: ¹)

In Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC) Upper Tribunal Judge Wikeley said at paragraph 31

“Appropriate steps” mean just that, and not an “appropriate outcome”. Likewise, the FTT’s powers include making an order that the Commissioner “take appropriate steps to respond to the complaint”, and not to “take appropriate steps to resolve the complaint”, least of all to resolve the matter to the satisfaction of the complainant.”

Further in the case of Scranage v Information Commissioner [2020] UKUT 196 (AAC) the Upper Tribunal went further in saying :

The Tribunal is limited in its powers to those given by Parliament as interpreted by the Upper Tribunal. The First tier Tribunal does not have power to make a decision on the merits of the complaint, and this Tribunal will not interfere with an exercise of regulatory judgement without good reason.

Furthermore, a person who wants a data controller (or processor) to rectify personal data, compensate them, or otherwise properly comply with the Data Protection Act 2018 or General Data Protection Regulations in relation to personal data must go to the civil courts (Footnote: ²) not a tribunal pursuant to sections 167-169 & 180 of the Data Protection Act 2018. I express no opinion one way or another about whether the Applicant can do so, or whether they should do so; that is a matter for the Applicant, about which this Tribunal cannot give advice.

This Tribunal does not have an oversight function in relation to the Information Commissioner’s Office and does not hold them to account for their internal processes. The Parliamentary and Health Service Ombudsman (Footnote: ³) is the body which has that function. I express no opinion one way or another about whether this applicant can or whether they should raise the issue with the Ombudsmen; again, that is a matter for the applicant, about which this Tribunal cannot advise her.

The Applicant was provided with an outcome to their complaint on 11 September 2020 and this outcome was reviewed and upheld under the Respondent’s case review process on 13 May 2021. The Applicant does not agree with the outcome, but as explained at the hearing, this Tribunal has no power to consider an appeal against the Information Commissioner’s substantive findings.

The Tribunal has no power to do what the Applicant is asking for; by the time of this application Ms Pirmohamed had received all that which this tribunal could order under s166(2) DPA18.

This Tribunal has no power to make a decision about the merits of that outcome, whether it be right or wrong. This is the case regardless of the nature of the complaint made or its evidential basis. The quality, adequacy or merits of the outcome fall outside the scope of s.166 and outside the jurisdiction of this Tribunal. Furthermore, the Tribunal does not have any power to supervise or mandate the performance of the Commissioner’s functions.

There is subsequently no basis for the Tribunal to make an order under section 166(2) DPA18.

Having considered whether this tribunal could provide the Applicant with any other remedy I have concluded that while there may be a remedy available from the courts (about which I make no conclusions or give any indication) there is no other remedy available from this Tribunal in relation to this application.

In order for this application to proceed there must be a realistic prospect of its success. For the reasons set out above, I have concluded that this Tribunal would not be able to provide the outcome(s) sought and that therefore the application is hopeless, or in other words has no reasonable prospect of success.

Having taken account of all relevant considerations, and heard from the applicant orally I decided to strike out this application pursuant to 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 because there was no reasonable prospect of the application succeeding.