Saim Köksal v Information Commissioner

On 25 June 2022 Dr Köksal made an application under s.166 of the Data Protection Act 2018 (“the Application”). The Commissioner’s rule 23 Response was due within 28 days of the Application being sent to him, but the Response was not received until 30 August 2022. Within the Response the Commissioner requested that the Application be struck out as having no reasonable prospect of success. Dr Köksal provided his representations against the application in a letter emailed to the Tribunal on 5 September 2022, together with further evidence sent on 26 September 2022.

In a decision dated 29 September 2022, a Registrar extended time for the Response and struck out the Application as having no reasonable prospect of success. The applicant has exercised his right under rule 4(3) to have the matter considered afresh by a Judge. It is not clear whether Dr Köksal’s email of 26 September 2022 was before the Registrar, but in any event, I reach this fresh decision having considered all the material provided by the parties.

This decision should be read with the chronology contained within the Response at paragraphs 15 to 42, which I need not repeat in full. Dr Köksal submitted his complaint to the Commissioner on 26 May 2021, concerning the way in which his Subject Access Request (“SAR”) had been handled by the Financial Conduct Authority (“FCA”). On 28 September 2021 the Commissioner’s case officer wrote to Dr Köksal to say that his complaint had already been considered under a previous reference, and its outcome communicated on 14 January 2021. This was maintained in subsequent correspondence until 25 October 2021, when further evidence was sent to the Commissioner. This was accepted as giving rise to a new complaint. The FCA’s response to the complaint was that Dr Köksal’s SAR was for 50,000 emails and personal information dating back to 2011. The FCA argued that this was manifestly excessive. On 24 May 2022 the Commissioner issued an outcome agreeing with the FCA’s position and rejecting the complaint. This position was further clarified on 9 June 2022 and maintained in the outcome of a formal review sent on 16 June 2022.

The Notice of Application requests the following relief:

When deciding whether to extend time, the Tribunal will apply the overriding objective to the rules according to the following structure. First, was the delay serious or significant? Second, was there a good reason? Third, regard to the all circumstances would it be right to extend time?

The statutory scheme only allows the Tribunal to address procedural failings by the Commissioner, rather than decide on a different substantive outcome to the complaint: Leighton v Information Commissioner (No.2) (Information rights - Data protection) [2020] UKUT 23 (AAC). Contrary to many data subjects’ expectations, s.166 does not provide a right of appeal against the substantive outcome of the Commissioner’s investigation on its merits: Scranage v Information Commissioner [2020] UKUT 196 (AAC). While the Tribunal does have the final say in considering the appropriateness of investigative steps, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. In the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations he should undertake into any particular issue, and how he should conduct those investigations. This will be informed not only by the nature of the complaint itself but also by a range of other factors such as his own registry priorities, other investigations in the same subject area and his judgement on how to deploy his limited resources most effectively: Killock & Ors v Information Commissioner [2021] UKUT 299.

Dr Köksal disagrees with the way in which the above principles are described by the commissioner, arguing that they are “wrongly established”. Insofar as this asserts that the relevant authorities were wrongly decided, then this does not matter. The authorities are binding on the First-tier Tribunal.

The proceedings may only be struck out under r.8(3)(c) where the Tribunal considers there is no reasonable prospect of the appellant’s case, or part of it, succeeding. In HMRC v Fairford Group (in liquidation) and Fairford Partnership Limited (in liquidation) [2014] UKUT 329 it was held that the approach should be similar to that taken in the civil courts pursuant to r.3.4 of the Civil Procedure Rules. The Tribunal must consider whether there is a realistic, as opposed to a fanciful (in the sense of being entirely without substance) prospect of succeeding on the issue on full consideration. A ‘realistic’ prospect of success is one that carries some degree of conviction and not one that is merely arguable. The Tribunal must avoid conducting a ‘mini-trial’. The power to strike out must be exercised in accordance with all aspects of the overriding objective (at r.2 of the Procedure Rules) to deal with cases fairly and justly, its effect being to debar a litigant from a full hearing of his claim. Yet striking out will be the correct course of action, and support the overriding objective, where an appeal or application raises an unwinnable case and continuance of the proceedings would be without any possible benefit to the parties and a waste of resources.

On the late Response and extension of time, the Commissioner refers to an “unprecedented” level of work and resourcing problems.

On strike out, the Commissioner argues that the outcome sought by the Application is country to the legal principles set out above. The role of the tribunal is to progress complaints, not alter the substantive outcome. The commissioner has complied with his obligation under section 165, and there is subsequently no basis for the tribunal to make an order under section 166.

I have considered everything submitted by Dr Köksal, and the following summary should not be taken as an exhaustive list of the issues he has raised. Dr Köksal resists extending time for the Response. He cites “systematic misconduct” by the Commissioner, and further asserts that the Commissioner has mismanaged his work-load. The Commissioner has sought to reduce the backlog of complaints by denying them proper attention, causing yet more work by reason of the resulting “confrontations and challenges”.

As to his substantive Application, Dr Köksal sets out complaints he has made to the Commissioner concerning other organisations. He gives the reasons why he considers each was mishandled. As to the present complaint, I have taken account of the underlying allegations made by Dr Köksal. He argues that their misconduct is much more serious than the Commissioner considers, and that as statutory regulator the Commissioner must grapple with issues of compliance even though they might be complicated. Dr Köksal also argues that the Commissioner has “big companies do not make mistakes syndrome”, leading to evidence being ignored that is capable of demonstrating a breach of data protection legislation.

Dr Köksal denies seeking to alter the substantive outcome by way of the present Application, instead asking the Tribunal to require the Commissioner to take the ‘appropriate’ steps required by the Act. He says that he fully appreciates that an outcome to a particular complaint might not be in his favour, but he is still entitled to have it appropriately investigated.

Dr Köksal also raises what he refers to as ‘discrimination’ by the Commissioner. This is not by reference to a protected characteristic, but rather asserts bias in favour of public bodies and large organisations. It is consistent with the authorities, he argues, to require the Commissioner to use his statutory enforcement powers where appropriate. This is especially so where where the Commissioner appears unwilling to use his statutory powers as a matter of systemic inability rather than by reference to the individual complaints before him.

I do extend time. The delay is serious. The reason put forward relates to resourcing and “unprecedented” work volumes. The Tribunal notes that a party’s resources will not excuse procedural failings: R. (Hysaj) v Secretary of State for the Home Department [2014] EWCA Civ 1633 at [42]. Furthermore, the word “unprecedented” has now been deployed by the Commissioner in numerous cases for a significant period of time. The time will come when this bare assertion is no longer accepted. All that said, and as unattractive as the conclusion may be, the overriding objective still supports permitting a late response in this case. The Response has now been received and it contains information that is useful to the Tribunal in addressing its function under s.166. The alternative would be to debar the Commissioner from further participation, and this might lead to the Tribunal directing him to take steps that are manifestly inappropriate. This would only waste further time and resources.

The Commissioner’s resources are relevant to the substantive s.166 Application. The Commissioner has the institutional expertise and competence to decide how best to deploy his limited resources between the complaints he receives. As recognised in Killock, this necessarily involves making a decision on what level of investigation and attention is merited by a particular complaint. In that sense the ‘discrimination’ argued by Dr Köksal may, even if established, be unobjectionable. The Commissioner is entitled to take a risk-based approach that includes the size of an organisation.

The Commissioner describes the outcome as:

“… essentially our view or opinion, based on the information provided to us, as to whether an organisation is likely or unlikely to have complied with the provisions of the UK GDPR and/or Data Protection Act 2018.”

Here, the view was that the SAR was manifestly excessive and that the FCA had complied with its obligations. The Commissioner declined to undertake the scale of investigation required by Dr Köksal. That view was reached following consideration of his arguments and evidence, and the correspondence to Dr Köksal shows that the broad nature of his allegations was taken into account:

The Commissioner is entitled to decline a complainant’s request for particular regulatory action. The evidence he has submitted consists of complaints to the FCA and Commissioner, the detail of which is said to remain unaddressed. I am not deciding the substantive application, but whether it has a real prospect of success. Nothing said by Dr Köksal creates any prospect at all that the Tribunal would find it appropriate to “wind back the clock” in this case such as to make a direction under s.166. Indeed, it is impossible to see what form such a direction might even take. Whatever delays and mistakes may have happened over the progress of the complaint to the Commissioner, once remedied there is nothing left for the Tribunal to do about them. Furthermore, the sanctions, financial remedies and broader oversight of the Commissioner sought in the Notice of Application are plainly beyond the jurisdiction conferred by s.166. The Application has no reasonable prospect of success, and I exercise my discretion under rule 8(3)(c) to strike it out.