Paul John Calvert v Information Commissioner

On 27 July 2021 Mr Calvert made a request to his employer, the North East Ambulance Service NHS Foundation Trust. The request can be briefly summarised as requesting rectification of data held by the Trust that Mr Calvert asserted was inaccurate, pursuant to Article 16 of UK GDPR. Dissatisfied with its response, on 27 August 2021 Mr Calvert complained to the Commissioner.

An outcome to the complaint was issued by the Commissioner on 21 December 2021, rejecting Mr Calvert’s complaint. He sought a review, and on 20 January 2022 the Commissioner’s decision was maintained. On 15 February 2022 Mr Calvert made the present application to the Tribunal under s.166 of the Data Protection Act 2018. The relief sought in the notice of application was as follows:

The Commissioner provided his rule 23 response on 24 June 2022. It contained an application for an order striking out the proceedings under rule 8(3)(c) as having no reasonable prospect of succeeding. Mr Calvert responded with his own written representations against the strike-out application, and the matter was listed for hearing. Neither party attended, each confirming that they were content to rely on their written submissions. I have carefully taken everything said into account. This decision has been delayed for reasons unrelated to this particular appeal, for which I apologise.

The complaint to the Commissioner engages ss.165 and 166 of the Data Protection Act 2018, which set out how the Commissioner must respond to complaints and the Tribunal’s jurisdiction to make orders to progress them. The Commissioner’s statutory duty upon receiving a complaint is contained within s.165:

At s.166, the 2018 Act provides the following redress for a failure to meet that statutory duty:

It can be seen from the plain language of the statute that the section will only apply at all if one of the conditions at s.166(1)(a), (b) or (c) is met. There are further rights of action against the data controller or data processor contained at ss.167-169. These may only be pursued in the High Court or the county court, not in this Tribunal.

The scope of s.166 was considered by the Upper Tribunal in Leighton v The Information Commissioner (No.2) (Information rights - Data protection) [2020] UKUT 23 (AAC). The Upper Tribunal’s analysis, which is binding upon me, was as follows:

The Upper Tribunal reached the same conclusion in Scranage v Information Commissioner [2020] UKUT 196 (AAC), holding that – contrary to many data subjects’ expectations – s.166 does not provide a right of appeal against the substantive outcome of the Commissioner’s investigation on its merits. The provision is procedural rather than substantive in its focus.

In Killock & Ors v Information Commissioner [2021] UKUT 299 the Upper Tribunal held that s.166 is ‘forward-looking’. The Tribunal is concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint, specifying appropriate “steps to respond” rather than assessing the appropriateness of a response that has already been given. The same applies to orders under s.166(2)(b) requiring the Commissioner to inform the complainant of progress on the complaint or of the outcome of the complaint within a specified period. These are procedural matters (giving information) and should not be used to achieve a substantive regulatory outcome. A dissatisfied complainant must instead have recourse to the legal remedies at ss.167-169, or bring judicial review proceedings against the Commissioner in the Administrative Court.

Killock does contain an important caveat to the above, expressed by the Upper Tribunal as follows:

The Upper Tribunal held that it is the Tribunal rather than the Commissioner which decides whether a particular investigative step is reasonable, the Commissioner’s view is not decisive. But in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. In the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations he should undertake into any particular issue, and how he should conduct those investigations. This will be informed not only by the nature of the complaint itself but also by a range of other factors such as his own registry priorities, other investigations in the same subject area and his judgement on how to deploy his limited resources most effectively. It should be noted that one of the parties in Killock, EW, was successful. The Commissioner had misconstrued and misapplied her own Service Standards, so in simply declining to investigate the complaint at all had not taken such steps as were appropriate to respond to the complaints.

As to when it is appropriate to strike out proceedings due to a lack of reasonable prospects of success, in HMRC v Fairford Group (in liquidation) and Fairford Partnership Limited (in liquidation) [2014] UKUT 329 it was held that the approach should be similar to that taken in the civil courts pursuant to r.3.4 of the Civil Procedure Rules. The Tribunal must consider whether there is a realistic, as opposed to a fanciful (in the sense of being entirely without substance) prospect of succeeding on the issue on full consideration. A ‘realistic’ prospect of success is one that carries some degree of conviction and not one that is merely arguable. The Tribunal must avoid conducting a ‘mini-trial’. The power to strike out must be exercised in accordance with all aspects of the overriding objective (at r.2 of the Procedure Rules) to deal with cases fairly and justly, its effect being to debar a litigant from a full hearing of his claim. Yet striking out will be the correct course of action, and support the overriding objective, where an appeal or application raises an unwinnable case and continuance of the proceedings would be without any possible benefit to the parties and a waste of resources.

The Commissioner’s strike-out application principally argues that Mr Calvert’s quarrel is with the outcome of the complaints rather than its progression, in contravention of the legal principles set out above. The Commissioner accepts that it delayed in providing a timely outcome, but further complaint about the service provided is a matter for the Parliamentary and Health Service Ombudsman rather than the Tribunal. If Mr Calvert disagrees with the outcome, the Commissioner argues, he retains a private cause of action under the Act that can be pursued in the courts.

Mr Calvert’s response correctly sets out some of the governing legal principles. his first argument concerns the delay and providing him with an outcome. Upon receiving the outcome letter on 21 December 2021, Mr Calvert had contacted the Commissioner’s case officer to advise that further evidence relevant to the case had emerged during the delay. The Trust had conducted a second investigation, the findings of which had contradicted the original investigation that had been submitted with the complaint. As the outcome had been reached following consideration of solely the original investigation, the situation had changed. Mr Calvert was advised to conduct a case review. When the case review outcome had been received, it appeared to Mr Calvert that the Commissioner had failed to consider all the available and pertinent documentary evidence. He had brought this to the attention of the reviewing officer, who had declined to take further action.

Mr Calvert argues that his case does not simply seek to disagree with the outcome, but rather asks the Tribunal to direct the Commissioner to take proper steps to respond – in this by properly considering the documents he has put forward. The failure to have done this is put forward as a breach of the Commissioner’s case review and complaints policy, which states:

It is clear that the original complaint solely concerned a request for rectification of inaccurate data. Article 16 of UK GDPR provides as follows:

The outcome letter set out the Trust’s response to the complaint. The Trust had declined to alter occupational health information provided by Mr Calvert’s line manager as it was a subjective opinion, and it was not possible for the Trust to confirm that it was inaccurate. The Trust had nonetheless placed the request for rectification on the file so that it would be apparent that Mr Calvert did not agree. Within the outcome letter, the Commissioner concluded that the Trust had complied with Article 16 and the relevant ICO guidance:

Mr Calvert’s request for a review is clear and detailed. It can be summarised as arguing that the impugned data concerned facts rather than opinion: first, a referral form contained text at the top stating that it must be discussed with the employee, and it had not; second, it set out the wrong number of absences from work; third, the manager had signed a statement on the form confirming that it had been discussed with Mr Calvert and was accurate, when it was plainly not. Mr Calvert provided documentary evidence to support his assertions that these matters were, objectively, inaccurate.

The review of 21 December 2021 can be summarised as reaching two conclusions. First, the legal duty of rectification extends only to taking appropriate steps to investigate, then contacting the data subject with an outcome and, if refusing to correct the data, explaining why and (if appropriate) recording that the data’s accuracy had been challenged. The Commissioner’s view was confirmed that the Trust had complied with that duty. It should be noted that the Commissioner was not made aware prior to the review outcome that the Trust had changed its position and upheld the complaint.

I consider that there is no reasonable prospect of Mr Calvert persuading a fully constituted Tribunal to make a s.166 direction. While in its letter of 30 December 2021 the Trust agreed to rectify some of the data, the Commissioner was not in possession of the Trust’s change of position when issuing the outcome and review. His investigation cannot be criticised for failing to take into account facts that were never put before him, and which post-dated the outcome. It might be open to Mr Calvert to make a fresh complaint based on what might be described as an acknowledged failure to correctly complete the rectification process within the one month period required by law. Whether or not that is the case, the situation having now been resolved through the Trust’s internal grievance procedure it is impossible to see that any action would follow that complaint. As correctly observed by the Commissioner, the duty to address the complaint has, beyond argument, been discharged.

Ultimately the issue is best seen through the lens of what s.166 direction could ever be made. That put forward in the notice of application explicitly asks that the Tribunal consider the correctness of the outcome, which falls outside the jurisdiction conferred by the statute. Nor, I consider, can a realistic direction be formulated on Mr Calvert’s behalf. Re-considering the complaint by reference to the Trust’s investigation would illegitimately require the Commissioner to consider post-decision evidence with no identifiable benefit. Requiring the Commissioner to reconsider the complaint on the basis that the data was not subjective opinion would be illegitimately telling the Commissioner what to make of the substantive complaint, and he has plainly assessed that issue already. There is nothing left for the Commissioner to do, and Mr Calvert simply disagrees with the outcome. The Act gives a cause of action for breach of UK GDPR in the civil courts should Mr Calvert wish to pursue it. There is no realistic prospect of a s.166 direction being made by the Tribunal, and it would be wrong to let the case proceed further.