Appeal Reference: EA.2022.0342.GDPR
Information Rights
Before
DISTRICT JUDGE REBECCA WORTH
Between
KUSHARA NAVARATNE
Appellant
and
INFORMATION COMMISSIONER
Respondent
Decision and Reasons
Background
By Notice of Appeal which appears to be undated and received on 28 October 2022, Mr Navaratne lodged proceedings with this Tribunal about the Information Commissioner’s Office (“ICO”) reference IC-188245-C7B6. When required to state what outcome he sought, Mr Navaratne stated:
The appellant is seeking a compliance order under Section 167 (2a) for the purposes of securing compliance with the data protection legislation which requires the ICO to:
…
The appellant is also seeking under Section 167 (3) for the Tribunal ……
Mr Navaratne attached to the Notice of Appeal various documents, including emails to and from the ICO.
In a response dated 13 January 2023 the ICO invited Mr Navaratne to withdraw his application with an alternative application to strike out the application under rule 8(3)(c) of the GRC Rules (Footnote: 1). The basis of the application to strike out was because no complaint had been made to the ICO but a complaint has been opened in response to the Notice of Appeal (ICO reference IC-207290-K0N3).
Mr Navaratne was invited to make submissions about the application to strike out and stated that “The appellant had complained to the Information Commissioner’s Office (ICO) on 24 September 2022.”.
The law
Section 166 of the Data Protection Act 2018 provides (as relevant):
This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR the Commissioner—
fails to take appropriate steps to respond to the complaint,
fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or
if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
The Tribunal may, on an application by the data subject, make and order requiring the Commissioner—
…..
Rule 8 of the GRC Rules provides (as relevant):
Striking out a party’s case
(1) …
The Tribunal must strike out the whole or part of the proceedings if the Tribunal—
does not have jurisdiction in relation to the proceedings of that part of them; and
does not exercise its power under rule 5(3)(k)(i) (transfer to another court or tribunal) in relation to the proceedings or that part of them.
The Tribunal may strike out the whole or part of the proceedings if—
…
…
the Tribunal considers there is no reasonable prospect of the appellant’s case, or part of it, succeeding.
Consideration
Approaching this from the position which the ICO takes, the following can be stated:
They do not consider that any complaint was made prior to the proceedings being lodged.
The ICO has now set up a complaint case, reference IC-207290-K0N3.
The above would lead to the conclusion that, as this Tribunal only has jurisdiction if there has been a complaint under Section 165; the Tribunal does not have jurisdiction and is obliged (rule 8(2)(a)) to strike out the appeal.
However, I will approach this from the position which Mr Navaratne asserts. The following can be stated:
A complaint was lodged on 24 September 2022.
The ICO responded to that complaint on 30 September 2022.
Mr Navaratne lodged proceedings at the end of October.
Mr Navaratne lodged proceedings about a month after he had received a response from the ICO and only 2 months after he had lodged his complaint. There is no reasonable prospect of the Tribunal making an Order for complaint when Mr Navaratne has not even waited for the period that Parliament allowed the ICO to consider a complaint (3 months and then another 3 months).
Decision
I strike out the proceedings, pursuant to rule 8(3)(c) of the GRC Rules, as there is no reasonable prospect of them succeeding.
Mr Navaratne’s attention is drawn to Section 180 of the Data Protection Act 2018, if he seeks an outcome which is provided under Section 167 of the Data Protection 2018, he will need to pursue that in the High Court or a County Court, this Tribunal only has power to make orders under section 166.
Signed District Judge Worth
District Judge Worth, authorised to sit as a Tribunal Judge in the GRC, dated 06 March 2023