Ivor Adams v The Information Commissioner

The Applicant has by Notice of Appeal dated 29 September 2022 applied for an order under s. 166 of the Data Protection Act 2018.

On 4 November 2022, the Information Commissioner responded to the Notice of Appeal and proposed a strike out for no prospects of success. The Information Commissioner states that it issued an outcome letter to the Applicant on 22 September 2022 and a case review letter on 26 October 2022. It submits that there is no order that the Tribunal can make under s. 166 DPA 2018 because, as a matter of law, this remedy is procedural and cannot be used to change the substantive outcome of a complaint.

Under rule 8 (4), the Applicant was given an opportunity to make representations in respect of the proposed strike out. The Applicant submitted on 13 November 2022 that the Information Commissioner’s response was insufficient to hold the data controller to account for its failure to comply with GDPR.

The powers of this Tribunal in determining a s. 166 application are limited to those set out in s. 166 (2). In order to exercise them, the Tribunal must be satisfied that the Commissioner has failed to progress a complaint made to the ICO under s. 165 DPA 2018. The jurisdiction to make an Order is limited to circumstances in which there has been a failure of the type set out in s. 166 (1) (a), (b) and (c). This Tribunal has no supervisory jurisdiction in relation to the handling of a complaint to the Information Commissioner’s Office and the Tribunal may not review the Information Commissioner’s decision to take no further action in relation to a complaint. That view has been frequently expressed by the Upper Tribunal and was also recently taken in the High Court by Mostyn J. in R (Delo) v ICO [2022] EWHC 3046 (Admin) (Footnote: ¹) at [128] as follows:

“….Sections 166(2) and (3) allow the Tribunal to order the Commissioner to take steps specified in the order to respond to the complaint. In my judgment, this would not extend to telling the Commissioner that he had to reach a conclusive determination on a complaint where the Commissioner had rendered an outcome of no further action without reaching a conclusive determination. This is because s. 166 by its terms applies only where the claim is pending and has not reached the outcome stage. It applies only to alleged deficiencies in procedural steps along the way and clearly does not apply to a merits-based outcome decision.”

In this case, it is clear that the ICO progressed the complaint and informed the Applicant of its outcome decision. In the light of Mostyn J.’s judgment, it seems to me that this outcome letter (and case review letter) serves to deprive the Tribunal of jurisdiction under s. 166 DPA, as the complaint could no longer be said to be ‘pending’ when the Notice of Appeal was lodged. This would mean that a mandatory strike out under rule 8 (2) (a) of the Tribunal’s rules would have been appropriate.

Nevertheless, I have considered whether a strike out under rule 8 (3)(c) for no prospects of success should be directed. I note that an outcome letter has been provided and this means that there is no longer any remedy which this Tribunal can provide under s. 166 DPA 2018. This also, inevitably, means that the Notice of Appeal has no reasonable prospects of success. The Applicant should consider whether the order they seek is obtainable through the courts as it is not obtainable in this Tribunal.

I conclude that this Notice of Appeal has no reasonable prospects of success as the ICO has responded to the complaint and the law does not allow me to take the action which the Applicant requests. I direct that this application to the Tribunal be struck out and will accordingly proceed no further.