Steffi Dias v The Information Commissioner

The application under section 166 of the Data Protection Act 1998 is struck out.

In this decision, ‘the Application’ is a reference to the application made to the tribunal by Ms Steffi Dias under section 166 of the Data Protection Act 1998 (DPA) and ‘the Applicant’ is a reference to Ms Dias.

The Commissioner applies for the Application to be struck out under rule 8(3)(c) (no reasonable prospects of success) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.

The Commissioner submits that the remedies sought by the Applicant are not outcomes that the tribunal can grant in a section 166 application against the Commissioner.

The Commissioner notes in the response that on the 31 October 2023 a case officer in Public Advice Data Protection Complaints Services reviewed the information available and provided the Applicant with an outcome to the Applicant’s concern about a refusal by her GP to share her records directly with her solicitor. The Commissioner acknowledges that the outcome to this element of the Applicant’s complaint was delayed, and apologises to the Applicant for this, however given that the matter was considered and an outcome provided to the Applicant, the Commissioner respectfully submits that there are no further procedural steps which the Tribunal can usefully order.

The Commissioner submits that section 166 does not provide a mechanism by which applicants can challenge the substantive outcome of a complaint.

The Applicant made submissions in response. These submissions are structured around a complaint that the Commissioner has failed to comply with ‘pre-action conduct’. The pre-action conduct set out in those submissions has been taken from the Practice Direction on Pre-action Conduct and Protocols. This Practice Direction applies to civil proceedings in the Courts. It does not apply to proceedings in the First-tier Tribunal.

However, I have taken account of the substantive points made in those submissions which are, in effect, that the Commissioner did not investigate properly and that the Applicant disagrees with the outcome of the complaint.

I have read the grounds of the Application in detail.

The Applicant’s complaint falls into two parts:

The Applicant seeks the following outcomes:

On an application to the tribunal under section 166, the tribunal has no power to deal with the merits of the complaint to the Commissioner or its outcome (confirmed in Killock & Veale & ors v Information Commissioner [2021]UKUT 299 (AAC) and Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC)).

Large parts of the Application consist of a challenge to the substantive outcome of the complaints that the Applicant has made to the Commissioner. Those aspects of the complaint cannot be considered by the tribunal and have no reasonable prospects.

I have considered very carefully those aspects of the complaint which purport to be complaints of a failure to properly investigate. If find that these are in reality complaints about the substantive outcome dressed as complaints of a failure to investigate. For example, the Applicant complains about a failure to investigate in relation to an opt out form that she completed. She states in the grounds of application ‘It is the ICO responsibility to investigate why my & my childs personal data has left the GP when I have emailed them not to’. It is apparent from page 3 of the outcome letter dated 15 May 2023 that this issue was dealt with in investigation and an outcome reached. In reality, the Applicant’s complaint is that she disagrees with this outcome.

Aside from the one matter I deal separately with below, I do not consider that there is any reasonable prospect of the tribunal finding that the Commissioner failed to take appropriate steps to respond to the complaint.

In determining whether a step is appropriate, the Tribunal will decide the question of appropriateness for itself. However, in considering appropriateness, the tribunal is bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. In the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations (see the Upper Tribunal’s decision in Killock & Veale & ors v Information Commissioner [2021]UKUT 299 (AAC) at paragraphs 84 and 85).

Bearing this in mind, and having considered the grounds of Application, the response and the reply, along with the attached documents, it is evident to me that that, save in relation to one matter considered separately below, the Commissioner complied with his statutory duties in this case in that he:

It is not clear to me that the Application includes a complaint about the Commissioner’s failure to investigate the matter raised with the Commissioner by the Applicant by email dated 4 March 2023, i.e. a compliant that the Commissioner failed to investigate the Applicant’s complaint that the GP refused to provide medical records to the Applicant’s solicitor directly following the solicitor’s subject access request to the GP.

To the extent that the Application does include such a complaint, that would be a complaint about failure to take appropriate steps/inform the Applicant of the outcome which would have had some merit at the time the Application was issued.

However, the Commissioner has subsequently investigated that aspect of the Applicant’s complaint and issued an outcome on 31 October 2023.

The only remedies available from the tribunal are that the tribunal makes an order requiring the Commissioner –

It is clear to me from the information and documents provided by the Commissioner that appropriate steps have now been taken to respond to that part of the complaint and that an outcome has been provided. There is therefore no reasonable prospect of the tribunal making any of the available orders in response to any such complaint.

For those reasons, if the Application does include such a complaint about any failure to investigate it also has no reasonable prospect of success.

I have considered whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance), prospect of the Application succeeding at a full hearing. In my view, there are no reasonable prospects of the Application under section 166 succeeding.

I have considered whether I should exercise my discretion to strike the Application out. Taking into account the overriding objective, it is a waste of the time and resources of the Applicant, the tribunal and the Commissioner for this Application to be considered at a final hearing. In my view it is appropriate to strike the Application out.

As the Commissioner correctly states in his response, if the Applicant wishes to seek an order of compliance against the Controller for breach of their data rights, the correct route for them to do so is by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA18.

For the above reasons the Application is struck out under rule 8(3)(c).