Declan Hoyland v The Information Commissioner

Having considered the matter afresh pursuant to rule 4(3) of the Tribunal Procedure (First-Tier Tribunal) (General Regulatory Chamber) Rules 2009 (the GRC Procedure Rules), I agree with the Registrar’s decision not to extend the time limit for the application under section 166 of the Data Protection Act 2018 (‘DPA’).

The Application is not admitted by the tribunal.

In this decision ‘the Applicant’ is a reference to Mr. Hoyland. ‘The Application’ is a reference to Mr. Hoyland’s application to the tribunal under section 166 DPA. The Commissioner received the complaint from the Applicant on 8 August 2022. The Application was received by the tribunal on 9 October 2023.

Under rule 22(6)(f) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (‘the Rules’), an application under section 166 must be made to the tribunal within 28 days of the expiry of six months from the date on which the Commissioner received the complaint.

Mr. Hoyland raised the following points in his email of 10 November 2023 requesting that the decision of the Registrar be considered afresh by a Judge:

“1)

In my grounds of appeal, among other points, I noted that I wished my appeal to be considered on two articles of human rights. The Tribunal Registrar did not consider human rights in the given decision more broadly or the two articles identified in their reasons to not grant extension. Only the DPA was considered as a legal basis for denying extension. I would like the tribunal to consider my human rights.

2)

The UN technically does have an office in the UK, and given it's not known where exactly my data is as noted in my appeal grounds, I think the tribunal and ICO has not fully considered the bigger picture in relation to what can be enforced. The International Maritime Organization (IMO) is based at 4 Albert Embankment, London SE1 7SR, United Kingdom. This is part of the United Nations.

3)

I would like the tribunal to be aware that I have made a submission of Information to Special Procedures through the United Nations Human Rights Office of the High Commissioner. However, this process will take arguably longer than everything so far given they appear to be receiving high volume submissions in relation to the Middle East and Eastern Europe. It also does not appear to be a legal mechanism and I'm unsure if the United Nations will consider my submission, because it does create a crisis of identity for the UN to examine itself. Therefore at present, the General Regulatory Chamber feels like my only recourse. I have considered the UN HQ in New York but New York does not have specific data privacy law or a mechanism I can use to enforce my rights. I wish the tribunal to understand that even in countries where the UN 'has an office' (noting the point above that there is one in the UK anyway...) it is difficult to just start, let alone bring, any regulatory action.

4)

Given there is new evidence from the United Nations as fresh as 09/10/23 included in the appeal bundle, it does feel at odds with natural justice for the tribunal to not consider my appeal on the basis of time. Especially given my reasons given surrounding my family member. I could not reasonably and efficiently pursue all of their welfare and health rights at the same time as trying to pursue enforcement of my own information rights. There is also the issue which I noted in my grounds of appeal, the ICO could have got in touch with the UN, but they didn't, instead they give me options to pursue myself. This led to what they commonly call a 'wild goose chase' which ultimately has extended the time waiting for these advised upon entities to reply. Which, they didn't.

5)

Although admittedly this is very very cheeky, there were some administrative errors within this given appeal process where I was not notified of what was going on and an apology was offered by the GRC via email. This apology emerged after I sent the GRC an email to ask what was happening because I had not been contacted by the GRC at all since I made my appeal submission. The GRC is also not perfect in delivering upon its duties and it does echo oddly that I am flogged while this occurs at the same time.”

I have taken account of this email and the grounds of application and attached documents when reaching this decision.

The Application is therefore approximately 7 months out of time. That is the equivalent of the entire original time limit. That is a serious and significant delay.

In terms of the reason for the delay, I note that the Applicant received an outcome from the Commissioner in November 2022, which was confirmed under review in December 2022. Since then the Applicant has been attempting to follow up the matter with the organisations to which the Commissioner referred him. I also note that his mother was diagnosed with brain cancer earlier in 2023 and had a deterioration in her health in 2022. The Applicant is her carer.

Although none of this would have prevented the Applicant from submitting an application to the tribunal, I accept that all this goes at least some way to explaining the delay.

The substantive grounds for an appeal or application are relevant only if they are very strong or very weak. In my view in this case the grounds of application are very weak to the extent that the Application cannot succeed for the following reasons.

The Commissioner communicated the outcome of that complaint to the Applicant on 22 November 2022 as follows:

“We have been unable to find an office for the United Nations in the United Kingdom. As the United Nations are based in New York they do not fall within the scope of the UK GDPR.

You may wish to raise your concerns with the relevant data protection authority in the United States.

I am sorry that we are unable to consider your concerns further, however I hope you find the above information helpful”.

In a letter dated 25 November 2022 to the Applicant the Commissioner stated as follows:

“the United Nations do not appear to have a UK office address. The location of their headquarters can be found in New York. The UK and Ireland Desk is based in Belgium you can raise your concerns directly with them here:

UNRIC 
155 Rue de la Loi / Wetstraat 
1040, Brussels 
Belgium

As explained previously, when an organisation has its main headquarters outside the UK we cannot enforce our powers as they do fall within the scope of DPA 2018. For these reasons, we will not be taking further action in this case”.

The Applicant requested a case review on 25 November 2022. In a letter dated 14 December 2022 the Commissioner gave the Applicant the following view:

“It is my view that Ms Holland’s decision not to consider your complaint further, on the basis the organisation was outside of the ICO’s jurisdiction, was reasonable and appropriate.   

It was also in line with the ICO’s general approach to data controllers based outside of the UK. 

Consequently I do not uphold your complaint in this matter.”

To reach ‘a decision’, the Commissioner does not have to reach a decision on the substantive merits of a complaint. This is clear from the wording of the statutory framework, as the Court of Appeal noted in Delo. Warby LJ gave the leading judgment and made the following observations about 57.1(f) GDPR:

“60.

For present purposes the most striking point about the language of that provision is that it does not contain any words that are redolent of decisions on the merits of a complaint. Article 57 does not adopt any of the familiar ways of designating a decision-making function. We are not told that the Commissioner must (for instance) adjudicate, decide, determine, rule upon, or resolve a complaint, or that complaints must be "upheld" or not upheld by the Commissioner. Rather, we are told that the Commissioner must "handle" a complaint. He must "investigate the subject-matter of the complaint" but even then only "to the extent appropriate". He must "inform" the complainant of the "progress" of the complaint and its investigation and its "outcome".

61.

The same points can be made about Articles 77 and 78. Article 77(2) does not state that the data subject who exercises the Article 77(1) right to lodge a complaint is entitled to have the Commissioner adjudicate, or decide, or determine or resolve that complaint. It states that the Commissioner "shall inform" the complainant "on the progress and the outcome" of the complaint. No remedy is identified other than an "outcome". Article 78 does confer a right to an "effective judicial remedy" but it does not say there must be such a remedy where the Commissioner fails to determine the merits of a complaint. The conduct for which Article 78 requires an effective judicial remedy is failure to "handle" the complaint or to "inform" the data subject of its "progress" or "outcome".

62.

These are all distinctive and unusual words to use in a context of this kind. As Mr Delo submits, a regulatory scheme usually provides for decisions to be made by the regulator. A dispute resolution mechanism calls for a definitive conclusion of the dispute. But in my view these are points against the interpretation advocated by Mr Delo rather than in favour of it. If this were domestic UK legislation intended to impose on the Commissioner a duty to reach and pronounce a decision on the merits of all complaints lodged by data subjects, in the same way that a court or tribunal would be bound to do if seised of a disputed allegation of infringement, then one would expect to see language of the kind I have mentioned at [60] above. From the perspective of an English lawyer, the absence of any such language and the use of the quite different terminology which I have highlighted are both remarkable features of Articles 57, 77 and 78. Making all due allowance for differences between the legislative methods of the UK and the EU, these are indications – and in my opinion strong ones – that the legislative intent was not to require the Commissioner to determine every complaint on its merits.

63.

In my view, contrary to Mr Delo's submissions, the ordinary and natural interpretation of the language used in these provisions is that the Commissioner's principal obligations are to address and deal with every complaint by arriving at and informing the complainant of some form of "outcome", having first investigated the subject matter "to the extent appropriate" in the circumstances of the case. There are also second tier obligations, to inform the complainant of the progress of the investigation and of the complaint.

64.

An "outcome" must be the end point of the Commissioner's "handling" of a complaint. A conclusive determination or ruling on the merits that brings an end to the complaint is certainly an "outcome" but that word is intended to have broader connotations. In Killock, the Upper Tribunal decided, in my view correctly, that it embraced a decision to cease handling a specific complaint whilst using it to inform and assist a wider industry investigation. In the present case, Mostyn J held that the word "outcome" is an apt description of the Commissioner's decision to conclude his consideration of Mr Delo's complaint by informing him of the Commissioner's view that the conduct complained of was "likely" to be compliant with the UK GDPR (or, put another way, that the complaint of infringement was "likely" to be ill-founded). Again, I would agree with that.”

Thus the Commissioner's principal obligations are to address and deal with every complaint by arriving at and informing the complainant of some form of "outcome", having first investigated the subject matter "to the extent appropriate" in the circumstances of the case. There are also second tier obligations, to inform the complainant of the progress of the investigation and of the complaint.

It is clear from the above that there is no obligation under GDPR for that “outcome” to be a settled conclusion on whether something is or is not in breach of data protection legislation. There is no requirement for a conclusive determination on the merits of a complaint. The Commissioner’s principal obligations are set out in paragraph 63 of the Court of Appeal’s decision above. An “outcome” might be a conclusive determination or ruling on the merits but it also encompasses, for example, a decision to cease handling a specific complaint whilst using it to inform and assist a wider industry investigation or a decision to conclude the Commissioner’s consideration of the complaint by informing the complainant of the Commissioner’s view that the complaint was likely to be ill-founded.

In this case the investigation that the Commissioner deemed appropriate was to attempt to find an office for the United Nations in the United Kingdom. The ‘outcome’ was the Commissioner reaching the view that, as the United Nations are based in New York, they do not fall within the scope of the UK GDPR and that it was not appropriate to take any action. This outcome was clearly communicated to the Applicant on 22 November 2022 and confirmed on 25 November and 14 December 2022.

On an application to the tribunal under section 166, the tribunal has no power to deal with the merits of the complaint to the Commissioner or its outcome (confirmed in Killock & Veale & ors v Information Commissioner[2021]UKUT 299 (AAC) (Killock v Veale).

This means that ground 1 of the Application cannot succeed. The tribunal has no power to consider whether the Commissioner was right to conclude that he would take no action because the United Nations was outside the jurisdiction. That ground is a challenge to the outcome of the complaint.

The Applicant asserts in his email of 10 November 2023 that the UN technically does have an office in the UK, and that it is not known where exactly his data is. This is also a challenge to the outcome of the complaint, in relation to which the tribunal does not have jurisdiction.

This also means that grounds 2, 3 and 5 of the Application cannot succeed. The tribunal has no power to consider whether the United Nations have complied with their data protection obligations. Those grounds concern the merits of the complaint.

Ground 4 is made up of:

Ground 4(c) is a challenge to the merits of the complaint. Ground 4(d) is a challenge to the outcome of the complaint. Neither of those grounds can succeed in a section 166 Application.

Grounds 4(a) and (b) are essentially complaints that there is no adequate remedy for failures by the UN to handle personal data appropriately because it is, or claims to be, or is considered by the Commissioner to be, outside the scope of the GDPR. This is said to result in a breach of the Applicant’s human rights.

If there is a lack of an effective remedy to challenge the actions of the UN in relation to personal data, it is not possible for the tribunal to remedy this on a section 166 application. A section 166 application would not allow the tribunal to consider the issue of whether or not the UN had complied with its data protection obligations even if the UN were covered by the GDPR. It is not the fact that the UN is not covered by the GDPR which means that the tribunal has no jurisdiction to consider if the UN has properly handled the Applicant’s data.

Once an outcome to a complaint has been provided, the tribunal has no power retrospectively to order the Commissioner to take appropriate steps to respond to the complaint, where that might lead to a different outcome. That is because once a decision has been reached, challenges to the lawfulness of the process by which it can be reached or to its rationality are a matter for judicial review by the High Court, and not a matter for the tribunal. (Killock v Veale and R (on the application of Delo) v Information Commissioner and Wise Payments Limited [2022] EWHC 3046 (Admin), upheld by the Court of Appeal at [2023] EWCA Civ 1141 (“Delo”)).

To the extent that the Applicant asserts that the Commissioner has not taken appropriate steps to respond to his complaint, these are, in reality, challenges to the process by which the decision (which the Applicant disagrees with) was reached or to the outcome itself. They are not within the remit of section 166.

In deciding whether or not to extent time, I have taken account of all the matters set out above, including the lack of any substantive merit to the Application. I have taken account of all the circumstances of the case, including the need to conduct litigation efficiently and at a proportionate cost and the need to enforce compliance with procedural rules. For all the reasons set out above I am not persuaded that it is in the interests of justice to grant an extension of time and I do not admit the Application.

The Applicant has requested ‘some sort of advice or decisive route be notified to me so I can further avoid wasting UK tribunal/court time’. I have not in this decision had to consider whether or not the Commissioner or the UN are right to assert that it is outside the remit of the GDPR. Nor have I had to consider whether there is any effective remedy for inappropriate handling of personal data by the UN. Nor have I had to consider whether there is any breach of the Applicant’s human rights as a result. I am therefore unable to give any ruling on those matters.

In terms of advice or a decisive route, the tribunal is neutral and cannot provide legal advice to either party. There are however many sources of legal advice available, both paid and unpaid, which might assist the Applicant.