Lynsey Humphries v The Information Commissioner

The Tribunal has considered this matter on the papers and is satisfied that it does not defeat the interests of justice to do so pursuant to rule 32(3) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (“the 2009 Rules”).

By way of a Notice of Application received by the Tribunal on 27 December 2022, the Applicant brought this appeal based on an assertion that that the Respondent has failed to properly deal with the complaint. On 11 October 2021, the Applicant submitted an online Complaint Form together with attachments about Stockport Metropolitan Borough Council (“SMBC”) (the “Complaint”). The Applicant made multiple allegations about SMBC in the Complaint, including that SMBC held inaccurate information relating to the Applicant. The Complaint was allocated case reference IC-134358-J3P7. The detailed History and Chronology are set out in Paragraphs 15 to 34 of the formal Response dated 10 February 2023 wherein the Respondent has set out the relevant factual matrix and exchanges between the parties from 11 October 2021 to 8 February 2023 which it is not necessary to repeat here save that on 12 January 2023, the Commissioner received an email from the Tribunal attaching a Notice of Appeal from the Applicant. Upon receipt of this, the Commissioner proactively sought to conduct a case review of the handling of the Complaint. On 8 February 2023, the Commissioner wrote to the Applicant with the results of the case review of the Complaint. The Commissioner held that the case handler who dealt with the Complaint has appropriately explained the Commissioner’s position on complaints about accuracy. However, the service the Applicant received from the Commissioner relating to phone call response times fell below what the Commissioner expects. For this reason, the Commissioner apologised and ensured that it would not happen again in the future.

In effect the appellant seeks these issues to be considered by the Tribunal pursuant to section 166 of the Data Protection Act 2018 (“2018 Act”).

Article 77(1) of the GDPR gives every data subject the right to complain to a supervisory authority (in the domestic context, the Information Commissioner) if they consider that the processing of their personal data infringes their GDPR rights. The relevant provisions of section 165 of the 2018 Act accordingly provide as follows: - “165 Complaints by data subjects: -

Section 166 of the 2018 Act reads:

“The powers of the Tribunal in considering such applications have been considered by the Upper Tribunal. These cases are binding on the First Tier Tribunal of which the General Regulatory Chamber is a part.”

In Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC) Upper Tribunal Judge Wikeley said at paragraph 31-“Appropriate steps” mean just that, and not an “appropriate outcome”. Likewise, the FTT’s powers include making an order that the Commissioner “take appropriate steps to respond to the complaint”, and not to “take appropriate steps to resolve the complaint”, least of all to resolve the matter to the satisfaction of the complainant.”

Further in the case of : Scranage v Information Commissioner [2020] UKUT 196 (AAC) the Upper Tribunal went further saying :

“... there is a widespread misunderstanding about the reach of section 166. Contrary to many data subjects’ expectations, it does not provide a right of appeal against the substantive outcome of the Information Commissioner’s investigation on its merits. Thus, section 166(1), which sets out the circumstances in which an application can be made to the Tribunal, is procedural rather than substantive in its focus. This is consistent with the terms of Article 78(2) of the GDPR (see above). The prescribed circumstances are where the Commissioner fails to take appropriate steps to respond to a complaint, or fails to update the data subject on progress with the complaint or the outcome of the complaint within three months after the submission of the complaint, or any subsequent three month period in which the Commissioner is still considering the complaint.”

The Tribunal is limited in its powers to those given by Parliament as interpreted by the Upper Tribunal. The First tier Tribunal does not have power to make a decision on the merits of the complaint, and this Tribunal will not interfere with an exercise of regulatory judgement without good reason.

Furthermore, a person who wants a data controller (or processor) to rectify personal data, compensate them, or otherwise properly comply with the Data Protection Act 2018 or General Data Protection Regulations in relation to personal data must go to the civil courts not a tribunal pursuant to sections 167-169 & 180 of the Data Protection Act 2018. This Tribunal express no opinion one way or another about whether the Applicant can do so, or whether they should do so; that is a matter for the Applicant, about which this Tribunal cannot give advice.

This Tribunal does not have an oversight function in relation to the Information Commissioner’s Office and does not hold them to account for their internal processes. The Parliamentary and Health Service Ombudsman³ is the body which has that function. I express no opinion one way or another about whether this applicant can or whether they should raise the issue with the Ombudsmen; again, that is a matter for the applicant, about which this Tribunal cannot advise her.

The outcome to the complaint was reviewed and upheld under the Respondent’s case review process. The Applicant does not agree with the outcome, but this Tribunal has no power to consider an appeal against the Information Commissioner’s substantive findings.

This Tribunal has no power to make a decision about the merits of that outcome, whether it be right or wrong. This is the case regardless of the nature of the complaint made or its evidential basis. The quality, adequacy or merits of the outcome fall outside the scope of s.166 and outside the jurisdiction of this Tribunal. Furthermore, the Tribunal does not have any power to supervise or mandate the performance of the Commissioner’s functions.

There is accordingly no basis for the Tribunal to make an order under section 166(2) DPA18.

Having considered whether this Tribunal could provide the Applicant with any other remedy it is clear that while there may be a remedy available from other courts (about which no conclusions can be given herein) there is no other remedy available from this Tribunal in relation to this application.

In order for this application to proceed there must be a realistic prospect of its success. For the reasons set out above, this Tribunal would not be able to provide the outcome(s) sought and that therefore the application is hopeless, or in other words has no reasonable prospect of success.

Having considered all the above the Tribunal has therefore decided to strike out this application pursuant to 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 because there was no reasonable prospect of the application succeeding.