Colin Orford v The Information Commissioner

The Applicant has by Notice of Appeal dated 26 June 2023 applied for an order under s. 166 of the Data Protection Act 2018.

On 16 October 2032, the Information Commissioner responded to the Notice of Appeal and proposed a strike out for no prospects of success. The Information Commissioner states that it had issued an outcome letter to the Applicant on 26 June 2023 and submits that there is no order that the Tribunal can make under s. 166 DPA 2018 because, as a matter of law, this remedy is purely procedural and cannot be used to change the substantive outcome of a complaint or direct the Applicant’s requested outcome of a ‘proper investigation’.

Under rule 8 (4), the Applicant was given an opportunity to make representations in respect of the proposed strike out. The Applicant made representations dated 30 October 2023 which I have considered carefully.

The powers of this Tribunal in determining a s. 166 application are limited to those set out in s. 166 (2). In order to exercise them, the Tribunal must be satisfied that the Commissioner has failed to progress a complaint made to the ICO under s. 165 DPA 2018. The jurisdiction to make an Order is limited to circumstances in which there has been a failure of the type set out in s. 166 (1) (a), (b) and (c). This Tribunal has no supervisory jurisdiction in relation to the handling of a complaint to the Information Commissioner’s Office and the Tribunal may not review the Information Commissioner’s decision to take no further action in relation to a complaint. That view has been frequently expressed by the Upper Tribunal and was also taken in the High Court by Mostyn J. in R (Delo) v ICO [2022] EWHC 3046 (Admin) (Footnote: ²) at [128] as follows:

“….Sections 166(2) and (3) allow the Tribunal to order the Commissioner to take steps specified in the order to respond to the complaint. In my judgment, this would not extend to telling the Commissioner that he had to reach a conclusive determination on a complaint where the Commissioner had rendered an outcome of no further action without reaching a conclusive determination. This is because s. 166 by its terms applies only where the claim is pending and has not reached the outcome stage. It applies only to alleged deficiencies in procedural steps along the way and clearly does not apply to a merits-based outcome decision.”

In this case, it is clear that the ICO progressed the complaint and informed the Applicant of its outcome decision. In the light of Mostyn J.’s judgment, which I am bound to follow, it seems to me that this letter may in fact have deprived the Tribunal of jurisdiction under s. 166 DPA, as the complaint could no longer be said to be ‘pending’ when the Notice of Appeal was lodged. This would mean that a mandatory strike out under rule 8 (2) (a) of the Tribunal’s rules would have been appropriate.

However, as requested, I have considered whether a strike out under rule 8 (3)(c) for no prospects of success should be directed. I sympathise with the Applicant’s concerns, but it is not disputed that an outcome letter has been provided by the Information Commissioner’s Office and this means that there is no longer any remedy which this Tribunal can provide under s. 166 DPA 2018. This also, inevitably, means that the Notice of Appeal has no reasonable prospects of success. Nevertheless, the Applicant should consider whether the order he seeks is obtainable through the courts as their Data Protection Act jurisdiction is different from that of this Tribunal.

I conclude that this Notice of Appeal has no reasonable prospects of success as the ICO has responded to the complaint and the law does not allow me to take the action which the Applicant requests. I direct that this application to the Tribunal be struck out under rule 8 (3) (c) of the Tribunal’s Rules and it will accordingly proceed no further.