Ashu Mathia Ashu v The Information Commissioner

The Applicant has by Notice of Appeal dated 31 October 2022 applied for an order under s. 166 of the Data Protection Act 2018.

On 3 January 2023, the Information Commissioner responded to the Notice of Appeal and proposed a strike out for no prospects of success. The Information Commissioner states that it issued an outcome letter to the Applicant on 26 September 2022 and a case review letter on 28 October 2022. It submits that there is no order that the Tribunal can make under s. 166 DPA 2018 because, as a matter of law, this remedy is procedural and cannot be used to change the substantive outcome of a complaint.

Under rule 8 (4), the Applicant was given an opportunity to make representations in respect of the proposed strike out. The Applicant submitted on 4 January 2023 that the Information Commissioner had wrongly refused to process his complaint because further information was required; however, he disputes that the information requested was relevant to his case in its entirety.

The powers of this Tribunal in determining a s. 166 application are limited to those set out in s. 166 (2) DPA. In order to exercise them, the Tribunal must be satisfied that the Commissioner has failed to progress a complaint made to the ICO under s. 165 DPA 2018. The jurisdiction to make an Order is limited to circumstances in which there has been a failure of the type set out in s. 166 (1) (a), (b) and (c). This Tribunal has no supervisory jurisdiction in relation to the handling of a complaint to the Information Commissioner’s Office and the Tribunal may not review the Information Commissioner’s decision to take no further action in relation to a complaint. That view has been frequently expressed by the Upper Tribunal and was also recently taken in the High Court by Mostyn J. in R (Delo) v ICO [2022] EWHC 3046 (Admin) (Footnote: ¹) at [128] as follows:

“….Sections 166(2) and (3) allow the Tribunal to order the Commissioner to take steps specified in the order to respond to the complaint. In my judgment, this would not extend to telling the Commissioner that he had to reach a conclusive determination on a complaint where the Commissioner had rendered an outcome of no further action without reaching a conclusive determination. This is because s. 166 by its terms applies only where the claim is pending and has not reached the outcome stage. It applies only to alleged deficiencies in procedural steps along the way and clearly does not apply to a merits-based outcome decision.”

In this case, it is clear that the ICO asked the Applicant for more information on several occasions. As this was not forthcoming, the ICO informed the Applicant of its outcome decision, which was not to progress the matter. This decision was upheld on review. In the light of Mostyn J.’s judgment, it seems to me that this outcome letter (and case review letter) serves to deprive the Tribunal of jurisdiction under s. 166 DPA, as the complaint could no longer be said to be ‘pending’ when the Notice of Appeal was lodged. This would mean that a mandatory strike out under rule 8 (2) (a) of the Tribunal’s rules would have been appropriate.

Nevertheless, I have considered whether a strike out under rule 8 (3)(c) for no prospects of success should be directed. I note that an outcome letter has been provided and this means that there is no longer any remedy which this Tribunal can provide under s. 166 DPA 2018. This also, inevitably, means that the Notice of Appeal has no reasonable prospects of success.

I conclude that this Notice of Appeal has no reasonable prospects of success as the ICO responded to the complaint by asking for more information then decided to issue an outcome letter when the further requested information was not supplied. This Tribunal has no power to interfere with that decision. I therefore direct that this application to the Tribunal be struck out and it will accordingly proceed no further.