Case Reference: EA/2022/0065/GDPR
Information Rights
Decision given on: 16 January 2023
Before
TRIBUNAL JUDGE Stephen Cragg KC
TRIBUNAL MEMBER Jo Murphy
TRIBUNAL MEMBER Naomi Matthews
Between
ROBERT BARTOSIK
Applicant
and
(1) THE INFORMATION COMMISSIONER
Respondents
Decision: Application allowed
The Tribunal’s orders are set out at paragraph 35.
REASONS
MODE OF HEARING
The parties and the Tribunal agreed that these matters were suitable for determination on the papers in accordance with rule 32 Chamber’s Procedure Rules.
The Tribunal considered an agreed open bundle of evidence consisting of 79 pages.
BACKGROUND
On 24 March 2021 the Applicant wrote to Police Scotland (PS) asking for erasure of his personal data. He was especially concerned about information held about him concerning his presence at Gorbals police station, as he claimed never to have been in that police station. On 9 May 2021, the Commissioner received an online Complaint Form together with additional documentation from the Applicant to support his complaint about the way PS had handled a request for erasure.
On 17 August 2021, the Applicant’s complaint was allocated to an ICO case officer and a reference number IC-105484-R5W0 was assigned. The case officer sent an email on the same day to the Applicant asking if he had now received a response to his request for erasure from PS. Also on 17 August 2021, the Applicant replied confirming he had not received a response.
On the 18 August 2021, the case officer advised PS that it was the Commissioner’s view, having considered the information available to the case officer in relation to this complaint at the time, that PS has not complied with its obligations under data protection law. The reasons for this finding were explained, and the Commissioner requested that PS ensure that the Applicant should receive a response to his request as soon as possible. However, on the same day PS responded to the case officer advising they had responded to the Applicant on 1 and 26 April 2021.
The copy of the letter from PS to the Applicant dated 1 April 2021. Essentially, the letter said that the request for erasure had been denied on the basis that the information ‘is being processed for the purpose of law enforcement’. The letter goes on:-
Your request references a letter from Police Scotland dated 06/01/2021 Ref: MI/01270/20. In this letter Chief Inspector MacIntyre discusses statements made by a Public Enquiry and Support Assistant (PESA) in support of a Complaint about the Police (CAP) made by yourself.
This CAP (reference: CO/01933/20) was investigated by Police Sergeant James
McFarlane, who provided a formal response to you on 16th December 2020.
Accordingly, the CAP is now resolved and the records of the investigation have been archived by Professional Standards Department (West).
We do not need to go further into the details of the case or the police complaint. PS told the Applicant that the PS record retention operating procedure had been applied, and this provided for review periods on retention which would be applied. The Applicant was provided with links to the relevant procedures.
Thus, having reviewed the correspondence received from PS and the Applicant the case officer responded to the Applicant on 18 August 2021 advising that in her view PS had complied with its obligations under data protection law in this instance, by responding to the request. Therefore formal regulatory action would not be taken.
On 18 August 2021, the Applicant responded to the case officer’s outcome letter advising he wished to appeal the decision “as the Police keep fake data about my person in their computer system, fabricated by their PESA” and they had not delivered their decision to the Applicant earlier than they had to the case officer.
On 19 August 2021, the case officer responded to the Applicant providing further detail as to the Commissioner’s findings and advised that if the Applicant remained unhappy with the outcome of his complaint, then his case could be reviewed. The case officer also said:-
… looking at the response provided by PS on 1 April 2021, we are satisfied with the explanations provided by PS and are of the view that PS is able to legitimately retain the information held until January 2026.
On 2 September 2021, the Applicant responded to the case officer to request a case review. On 7 September 2021, a reviewing case officer conducted a review of the Applicant’s case and advised that he was satisfied that the case officer had dealt with the Applicant’s complaint appropriately and in line with casework processes. It was explained that although this case review was the final stage of the ICO’s case handling process, the Applicant was entitled to take his own case to Court under data protection legislation, irrespective of the ICO’s decision. The Applicant was also advised of his right to complain about the handling of his complaint to the Parliamentary and Health Service Ombudsman if he believed that the Commissioner had provided a poor service.
That might have been the end of the matter but things took a further turn when the Applicant received another letter from PS dated 15 February 2022. It stated that there was ‘new information’ as follows:-
Police Scotland Information Assurance are now in possession of a new, ratified, statement from the Public Enquiry and Support Assistant (PESA) at Gorbals Police Station, dated 8th February 2022, where the PESA acknowledges that they had never seen you, either within or without the station, and explains how this mis-identification has occurred.
This statement corroborates your assertions, made above.
PS still relied on processing of the information for the purposes of law enforcement, but additional explanation was also supplied as follows, to the effect that additional restrictions would now be placed on the processing of the information:-
The new PESA statement provides information which may affect the outcome of the CAP resolution and, accordingly, this has been presented to Professional Standards Department (West) for them to determine whether or not the CAP should be subject to re-investigation.
The statement you requested be deleted forms part of the official record of CAP CO/01933/20, as will the new statement received from the PESA.
However, the original (incorrect statement) is now of only very specific worth (should the CAP be re-investigated, for example) and meets the criteria for personal information which should be subject to restrictions in processing detailed in DPA 2018 s47 (2). Accordingly, the original PESA statement, dated 14th December 2020, will be subject to restrictions in processing, meaning that it can only be used as evidence in the re-investigation of CAP/01933/20 (should that be implemented).
On 15 March 2022, the Commissioner received further correspondence from the Applicant, addressing this change in position by PS:-
The Information Assurance in their decision dated 15/02/2022 Ref: DPR21034 informed me that instead of data erasure they restrict processing my personal data under Section 47 (2) of DPA 2018 (att. 4). I believe, that Information Assurance breached:
1) Section 41 (2) Safeguards: archiving of DPA 2018 , because processing my personal data in this case is not allowed, because it is likely to cause substantial damage or substantial distress to me;
2) Section 48 (2) Rights under section 46 or 47: supplementary of DPA 2018, because they issued their decision dated 15/02/2022 outside "applicable time period", which is 1 month as defined in Section 54 (2) of DPA 2018. Therefore I ask you to investigate these breaches of DPA 2018 and issued directions to Information Assurance.
On 16 March 2022, the case officer advised the Applicant that he had reviewed this latest correspondence and considered that its content duplicated that of his complaint of 9 May 2021, as an outcome and case review had already been provided, the case officer did not intend to reopen the case, as follows:-
I have considered your complaint of 15 March 2022 and consider that its content duplicates that of your complaint of 09 May 2021.
An outcome has been provided to your initial complaint and this outcome has also been reviewed following your request for a Case Review.
I do not intend in covering old ground, your case is closed and it is not intended that it will be re-opened.
THE APPLICATION AND RESPONSE
By way of a Notice of Application dated 16 March 2022 (the same day as the Commissioner’s correspondence), the Applicant made an application to the Tribunal under s166(2) Data Protection Act 2018 (DPA). The grounds of appeal read:-
The ICO refused my new complaint submitted yesterday and based on new circumstances as Information Assurance (a body about which I've complained to ICO) have challenged (sic) (Footnote: 1 ) totally their primary decision after their wider investigation in the matter and confirmed that fake data was used against me by Police Scotland. They decided to restrict process that data under Section 47 (2) of DPA 2018. Therefore, the ICO's decision is unfair and unjust. They just show total ignorance of law.
With reference to previous ICO's decision after my review request dated 02/09/2021 I believe that ICO's decision dated 07/09/2021 is void because there is no right to review under UK's law (as far as I know).
In response, the Commissioner argued that as any appeal in relation to the first complaint should have been filed by 7 November 2021, and it was not filed until 16 March 2022, then the appeal should not be allowed to proceed. In any event there was no realistic prospect of success.
The Commissioner’s response to the substantive appeal was as follows:-
It is clear from the chronology of this investigation that there has been no such failing. By considering the Applicant’s complaint, liaising with the controller, and providing the Applicant with an outcome and a case review of that outcome, the Commissioner has clearly taken appropriate steps to respond to the Applicant’s complaint within the requirements of the legislation. As the Commissioner has taken steps to comply with the procedural requirements set out in section 166(1) of the DPA18, there is subsequently no basis for the Tribunal to make an order under section 166(2) DPA18.
On 22 July 2022 the Registrar considered the Commissioner’s application to strike out the appeal on the basis that it was out of time and there was no reasonable prospect of success in any event. The Registrar’s ruling includes the following in relation to the complaint of 9 May 2021:-
The Applicant suggests that the Commissioner did not show any evidence that Information Assurance sent a first reply on 01 April 2021. There is evidence of this document presented in these proceedings.
The Applicant suggests that the Commissioner did not investigate any issue in his review request dated 02 September 2021. I note the Information Commissioner’s Lead Case Officer reviewed this matter and provided a response on 07 September 2021.
I am satisfied that the Commissioner has taken all appropriate steps in this to comply with his statutory obligation as evidenced in letters dated 18 August
and 19 August 2021. However, for the reasons stated below I am not of the view that this forms the substance of the Applicant’s application before this
Tribunal.
The Registrar went on to consider the events of March 2022 as follows:-
The Applicant suggests that the Commissioner did not investigate the new complaint of 15 March 2022 in relation to Information Assurance issued a new second decision dated 15 February 2022.
…
With regard to what is said in the Commissioner’s response and the Lead Case Officer’s letter dated 16 March 2022 it appears that this complaint was conflated with the complaint on 09 May 2021. It seems to me that one approach would have been treat it as a separate complaint, assign it a separate case reference identifier and proceed to consider it on that basis. I repeat that I have not seen the actual complaint and so make this observation in absence of such.
It seems to me from the information before me that this Tribunal is able to
consider whether the Commissioner has taken appropriate steps to respond,
inform of the progress, or provide an outcome to the complaint of 15 March
2022.
I find that in the circumstances the Tribunal has the power to consider an order under section 166(2) of the DPA 2018 directing the Commissioner to progress the complaint.
On that basis the Registrar did not strike out the appeal. However, somewhat surprisingly in the context of these comments, the Commissioner filed further submissions on 22 August 2022 which simply stated:-
The Commissioner advises that the Applicant’s second complaint is a duplicate of his original complaint of 9 May 2021 [copy complaint together with attachments attached]. It was handled by Police Scotland under the same reference and relates to the same erasure request.
The Commissioner will not therefore be assigning a new case reference. The Commissioner’s Response dated 4 May 2022 outlines everything in detail.
Finally, the Applicant responded to this on 23 August 2022:-
My second complaint dated 15/03/2022 is not a duplicate of complaint dated 09/05/2021, what is clearly stated in the details of that complaint (a copy sent to the Tribunal on 27/07/2022). Because the Information Assurance issued a new decision in my case dated 15/02/2022 I've made a new complaint to ICO in that matter. That complaint shall be investigated by ICO.
Therefore, I apply under Section 166 of DPA 2018 to the Tribunal for the orders to investigate that complaint by ICO in a proper manner and a proper time.
LEGAL BACKGROUND
A data subject has a right to make a complaint to the Commissioner if they consider that the processing of personal data relating to them infringes the General Data Protection Regulation (“GDPR”), and/or Parts 3 or 4 of the Data Protection Act 2018 (DPA) see section 165(2) DPA
Under section 166 DPA, a data subject has a right to make an application to the Tribunal if the Commissioner has failed to take certain procedural actions in relation to their complaint. Section 166 DPA states as follows:-
This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or
(c) if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
The Tribunal may, on an application by the data subject, make an order
requiring the Commissioner—
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.
An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order.
(b) to conclude an investigation, or take a specified step, within a period specified in the order.
…
Case law establishes that an application under s166 DPA is not concerned with the merits of the underlying complaint or intended to provide a right of challenge to the substantive outcome of the Commissioner’s investigation into that complaint. This was most recently confirmed in the case of R (Delo) v Information Commissioner [2022] EWHC 3046 (Admin), decided two weeks before we considered this application. In that case Mostyn J said:-
In Killock and Veale v ICO (Information rights - Freedom of Information - exceptions: practice and procedure) [2021] UKUT 299 (AAC) Farbey J and UTJ De Waal held at [74]:
“The remedy in s.166 is limited to the mischiefs identified in s.166(1). We agree with Judge Wikeley’s conclusion in Leighton (No 2) that those are all procedural failings. They are (in broad summary) the failure to respond appropriately to a complaint, the failure to provide timely information in relation to a complaint and the failure to provide a timely complaint outcome. We do not need to go further by characterising s.166 as a “remedy for inaction” which we regard as an unnecessary gloss on the statutory provision. It is plain from the statutory words that, on an application under s.166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the s.166 remedy as reflecting the provisions of Article 78(2) which are procedural. Any attempt by a party to divert a Tribunal from the procedural failings listed in s.166 towards a decision on the merits of the
complaint must be firmly resisted by Tribunals”
I fully agree with this…
131…..if an outcome has been pronounced, I would rule out any attempt by the data subject to wind back the clock and to try by sleight of hand to achieve a different outcome by asking for an order specifying an appropriate responsive step which in fact has that effect.
We note that the passages cited from the Killock case (and now approved by the High Court) have been cited by the Commissioner in the present case, and the law is now clear as to the scope of an appeal under s166 DPA.
DISCUSSION AND DECISION
It seems to us that the key to this case is deciding whether the second complaint (as the Applicant calls it) to the Commissioner was a new complaint or, as the Commissioner would have it, simply a repeat of the first complaint. In essence, the Commissioner has declined to deal with this complaint at all. The Commissioner says in terms that the Commissioner will ‘not…be assigning a new case reference’. In legal terms, the Applicant’s complaint is that for the purposes of s166(1)(a) DPA the Commissioner has failed ‘to take appropriate steps to respond to the complaint’.
It seems to us that the correspondence from the Applicant on 15 March 2022 was indeed raising a new complaint and not simply a repeat of the May 2021 complaint. In May 2021 the Applicant was raising the issue that PS had not responded within the statutory time limit to his request for erasure, and also complaining about the decision of PS to retain the information about the Applicant’s presence in a particular police station (taken on the basis that he had, in fact, been in the police station). The Commissioner dealt with this complaint properly by establishing that PS had responded to the request. The Commissioner also reached a conclusion on the complaint (we say nothing about whether it was right or wrong) that ‘we are satisfied with the explanations provided by PS and are of the view that PS is able to legitimately retain the information held until January 2026’.
However, with the PS letter of 15 February 2022 the factual position changed quite dramatically. The position of PS was that the information held, in the form of a statement stating that the Applicant had been in the police station, was simply incorrect but, nevertheless, PS had further decided not to erase the information but to process it for limited purposes.
It seems to us that the Applicant was perfectly entitled to make a new complaint to the Commissioner about that changed set of circumstances, and the new decision not to erase. It cannot be said that it was simply a repeat of the first complaint: now PS were seeking to retain personal information about the Applicant that they had accepted to be incorrect.
We say absolutely nothing about whether PS are entitled to take this stance, and that is not our role in an appeal brought under s166 DPA. As the UT said in Killock (now endorsed in Delo),
‘It is plain from the statutory words that, on an application under s.166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome’.
However, in our view, deciding erroneously not to consider a complaint at all has got nothing to do with the ‘merits of the complaint or its outcome’. As the Commissioner says, the complaint was not even given a new case reference. As the case officer said on 16 March 2022, ‘your case is closed and it is not intended that it will be re-opened’.
Thus, we make findings of fact that the letter of 15 March 2022 was a new complaint by the Applicant in the circumstances outlined above, and that the Commissioner failed to consider the complaint at all.
On that basis it seems to us clear that this is a case which comes within s166(1)(a) DPA and the Commissioner has failed ‘to take appropriate steps to respond to the complaint’.
In conclusion:-
To the extent that the application raises issues about the way in which the Commissioner dealt with the complaint of 9 May 2021, the application is dismissed as the Commissioner took appropriate steps to respond to the complaint.
In relation to the complaint (as we have found it to be) of 15 March 2022, the application is granted, as the Commissioner has failed to take appropriate to respond to the complainant.
The Tribunal makes an order that:-
The Commissioner takes appropriate steps to respond to the Applicant’s complaint, by registering and considering the complaint, in line with the Commissioner’s functions.
The Commissioner informs the Applicant within 28 days of the date of this decision of the progress of the complaint, and of the date an outcome will be provided (if not already done).
The Tribunal notes that it has no other powers to order an investigation, or to award the Applicant compensation (as requested in the appeal notice).
Signed: Recorder Stephen Cragg KC
Sitting as a judge of the First-tier Tribunal
Date: 16 January 2023.
Promulgated: 16 January 2023.