Eduardo Cortes v The Information Commissioner

The Tribunal has considered this matter on the papers and is satisfied that it does not defeat the interests of justice to do so pursuant to rule 32(3) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (“the 2009 Rules”).

By way of a Notice of Application received by the Tribunal on 18 November 2022, the Applicant brought this appeal under section 166(2) of the Data Protection Act 2018 (“DPA18”). On 17 August 2022 the Applicant submitted a Complaint Form to the Commissioner, together with some supporting evidence, about the way in which Kingston Hospital Foundation Trust (“the Trust”) had handled personal information. This was acknowledged by the Commissioner on 17 August 2022, when the Applicant was advised of the right to apply to the Tribunal in the event that the Commissioner failed to take appropriate steps to respond to his complaint or did not provide information about the progress or outcome his complaint within three months.

The Complaint had been allocated case reference IC-187387-S4L2. On 4 November 2022 an ICO case officer wrote to the Applicant with an outcome, noting that the concerns raised did not relate to the handling of the Applicant’s own personal information. The case officer explained that he would review the complaint but as the concerns related to the handling of third-party personal information, he would not be providing the Applicant with any further response or further information relating to the complaint. Upon receiving the outcome, the Applicant expressed concern that there had been a misunderstanding and it was his documentation that was erased by the Trust. Later that same day the case officer responded to the Applicant providing clarity and explained that personal data was information that related to an identified or identifiable individual and that on this occasion it was noted that the information the Applicant had raised concerns about were notes concerning the care of a patient, which he had input into. The case officer went onto add that as the notes related the care of the patient, this would be considered as being their personal data and not that of the Applicant. The Applicant may have input into the notes, the notes would not concern him and therefore would not be considered his personal information.

The Commissioner argues that it is apparent that the Applicant is of the view that their information rights continue to be infringed by, in this instance, the Trust. Notwithstanding any conclusion reached by the Commissioner, if the Applicant wishes to seek an order of compliance against the Data Controller for breach of their data rights, the correct route, argues the Commissioner, is for them to do so by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA18.

In terms of the Applicant’s claim for costs, the Commissioner argues that this is misconceived. There are limited circumstances under which such an order can be granted in accordance with Rule 10 of the Tribunal Rules, to instances of wasted costs, and unreasonable behaviour. The Commissioner submits that neither ground is applicable here and the claim for costs should accordingly fail.

The Applicant also suggests that the Commissioner failed to inform him of his rights under section 166 DPA18 as is required under section 165(4)(c) of the DPA18. The Commissioner denies this and submits this information was provided in the acknowledgement of the Applicant’s complaint, something which the Applicant appears to acknowledge at paragraph 2 of his grounds of appeal. Section 165(4)(c) does not require that this information be provided when the outcome of the complaint is provided. In any event, the Commissioner submits that in effect the appellant seeks these issues to be considered by the Tribunal pursuant to section 166 of the Data Protection Act 2018 (“the 2018 Act”) and he argues there is no order to be made in this respect under section 166DPA18.

Article 77(1) of the GDPR gives every data subject the right to complain to a supervisory authority (in the domestic context, the Information Commissioner) if they consider that the processing of their personal data infringes their GDPR rights. The relevant provisions of section 165 of the 2018 Act accordingly provide as follows: - “165 Complaints by data subjects: -

Section 166 of the 2018 Act reads:

“The powers of the Tribunal in considering such applications have been considered by the Upper Tribunal. These cases are binding on the First Tier Tribunal of which the General Regulatory Chamber is a part.”

In Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC) Upper Tribunal Judge Wikeley said at paragraph 31-“Appropriate steps” mean just that, and not an “appropriate outcome”. Likewise, the FTT’s powers include making an order that the Commissioner “take appropriate steps to respond to the complaint”, and not to “take appropriate steps to resolve the complaint”, least of all to resolve the matter to the satisfaction of the complainant.”

Further in the case of : Scranage v Information Commissioner [2020] UKUT 196 (AAC) the Upper Tribunal went further saying :

“... there is a widespread misunderstanding about the reach of section 166. Contrary to many data subjects’ expectations, it does not provide a right of appeal against the substantive outcome of the Information Commissioner’s investigation on its merits. Thus, section 166(1), which sets out the circumstances in which an application can be made to the Tribunal, is procedural rather than substantive in its focus. This is consistent with the terms of Article 78(2) of the GDPR (see above). The prescribed circumstances are where the Commissioner fails to take appropriate steps to respond to a complaint, or fails to update the data subject on progress with the complaint or the outcome of the complaint within three months after the submission of the complaint, or any subsequent three month period in which the Commissioner is still considering the complaint.”

The Tribunal is limited in its powers to those given by Parliament as interpreted by the Upper Tribunal. The First tier Tribunal does not have power to make a decision on the merits of the complaint, and this Tribunal will not interfere with an exercise of regulatory judgement without good reason.

Furthermore, a person who wants a data controller (or processor) to rectify personal data, compensate them, or otherwise properly comply with the Data Protection Act 2018 or General Data Protection Regulations in relation to personal data must go to the civil courts not a tribunal pursuant to sections 167-169 & 180 of the Data Protection Act 2018. This Tribunal express no opinion one way or another about whether the Applicant can do so, or whether they should do so; that is a matter for the Applicant, about which this Tribunal cannot give advice.

This Tribunal does not have an oversight function in relation to the Information Commissioner’s Office and does not hold them to account for their internal processes. The Parliamentary and Health Service Ombudsman is the body which has that function. This Tribunal expresses no opinion one way or another about whether this applicant can or whether they should raise the issue with the Ombudsmen; again, that is a matter for the applicant, about which this Tribunal cannot advise.

The Applicant does not agree with the outcome of the handling of his complaint, but this Tribunal has no power to consider an appeal against the Information Commissioner’s substantive findings.

This Tribunal has no power to make a decision about the merits of that outcome, whether it be right or wrong. This is the case regardless of the nature of the complaint made or its evidential basis. The quality, adequacy or merits of the outcome fall outside the scope of s.166 and outside the jurisdiction of this Tribunal. Furthermore, the Tribunal does not have any power to supervise or mandate the performance of the Commissioner’s functions.

There is accordingly no basis for the Tribunal to make an order under section 166(2) DPA18.

Having considered whether this Tribunal could provide the Applicant with any other remedy while there may be a remedy available from other courts (about which no conclusions can be given herein) there is no other remedy available from this Tribunal in relation to this application.

For this application to proceed there must be a realistic prospect of its success and for the reasons set out above, this Tribunal would not be able to provide the outcome(s) sought and that therefore the application is hopeless, or in other words has no reasonable prospect of success.

Having considered all the above the Tribunal has therefore decided to strike out this application pursuant to 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 because there is no reasonable prospect of the application succeeding.