Information Rights
Section 166 Data Protection Act 2018
Appeal Reference: EA/2023/0194
Decided without a hearing
On 23rd October 2023
Before
TRIBUNAL JUDGE HEALD
Between
CATHERINE MOORE
Applicant
and
THE INFORMATION COMMISSIONER
Respondent
Decision
The application is struck out.
REASONS
Background
Catherine Moore (“the Applicant”) worked for a charity (“the Charity”) as the Superintendent of the Killough Shiels Houses. The Applicant believes that a false allegation was made against her. The Commissioner for Older People for Northern Ireland (“COPNI”) became involved with the allegation.
On 9 August 2022 the Applicant made a subject access request (“SAR”) to COPNI. Due, they said, to issues of confidentiality, legal privilege and an exemption provided by the GDPR they decided not to respond to the SAR. After further correspondence on 7 November 2022 COPNI confirmed its decision.
On 19 December 2022, the Applicant made a complaint (“the Complaint”) to the Information Commissioner (“the Commissioner”) about the response from COPNI.
In response to the Complaint the Commissioner wrote to the Applicant on 3 February 2023 outlining its view and explaining that it would contact COPNI and ask that they review how they had handled the SAR and to consider what further steps they could take to resolve the Complaint. The Applicant was informed of the right to seek to have data corrected.
There was then correspondence and dialogue with the parties. COPNI explained to the Commissioner the reason it considered its response to have been appropriate. The Commissioner provided guidance to COPNI about what it should consider doing to be fully satisfied with their position and to ensure the Applicant was kept informed.
On 3 March 2023 COPNI sent a further letter to the Applicant in which she was told a further review had taken place and a limited amount of personal data was provided but that they maintained their stance on the SAR generally. Also, on 3 March 2023, COPNI reported to the Commissioner that they had provided further information to the Applicant with a further explanation of the exemption relied upon. The Applicant was not satisfied by this.
On 7 March 2023 the Commissioner responded to the Complaint saying amongst other things: -
“Based on the information available, we are satisfied with the response that you have received from the organisation. This is because COPNI have confirmed that they have provided you with all the personal information you are entitled to receive within the scope of your SAR. Any further information COPNI have been unable to provide you with, it is our view that they have given you their justifications and provided you with any exceptions they are relying on. We have no choice but to accept these assurances in the absence of evidence to the contrary. The ICO does not have adequate evidence to suggest that COPNI has failed to comply with its obligations under the data protection legislation to justify investigating this matter further.”
The letter went on to inform the Applicant that it could not arbitrate in disputes between individuals and data controllers.
The Applicant was informed that the Commissioner would not be taking the matter further but advised as to the ability to seek alternative remedies from a court.
Proceedings
On 22 March 2023 this application was made (“the Application”) in which the outcome sought is: -
“The release of information, either in redacted format, or in COPNI’s own words to enable me to make a submission on the material.”
The Commissioner opposes the Application and has provided a response dated 7 September 2023 (“the Response”) and invites the Tribunal to strike out the Application by rule 8(3)(c) Tribunal Procedure (First-tier Tribunal) (General Regulatory) Rules 2009 (as amended) (“2009 Rules”).
The Applicant was informed of the strike out application as required by rule 8(4) 2009 Rules and replied to the Response (“the Reply”) on 19 September 2023.
Strike out
Rule 8 of the 2009 Rules provides that: -
The Tribunal may strike out the whole or a part of the proceedings if (c) the Tribunal considers there is no reasonable prospect of the appellant's case, or part of it, succeeding.
In HMRC -v- Fairford Group (in liquidation) and Fairford Partnership Group (in liquidation) [2014] UKUT 0329 the Upper Tribunal summarised the task to be carried out by a Tribunal in these circumstances:
In our judgment an application to strike out in the FTT under Rule 8(3)(c) should be considered in a similar way to an application under CPR 3.4 in civil proceedings (whilst recognising that there is no equivalent jurisdiction in the First-tier Tribunal Rules to summary judgment under Part 24). The Tribunal must consider whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance) prospect of succeeding on the issue at a full hearing, see Swain v Hillman [2001] 2 All ER 91 and Three Rivers (see above) Lord Hope at [95]. A ‘realistic’ prospect of success is one that carries some degree of conviction and not one that is merely arguable, see ED & F Man Liquid Products v Patel [2003] EWCA Civ 472. The tribunal must avoid conducting a ‘mini-trial’. As Lord Hope observed in Three Rivers, the strike out procedure is to deal with cases that are not fit for a full hearing at all.
In AW-v-Information Commissioner and Blackpool CC [2013] 30 ACC the Upper Tribunal at paragraphs 7 and 8 set out the principles governing the application of rule 8(3)(c) of the 2009 Rules. These included: -
…It is well established in the ordinary courts that the historic justification for striking out a claim is that the proceedings are an abuse of process …. On that basis, the power should only be exercised in plain and obvious cases
More recent rulings from the superior courts point to the need to look at the interests of justice as a whole ….It is, moreover, plainly a decision which involves a balancing exercise and the exercise of a judicial discretion, taking into account in particular the requirements of Rule 2 of the GRC Rules.
Rule 2 of the 2009 Rules refers to the overriding objective of the 2009 Rules which is “to enable the Tribunal to deal with cases fairly and justly.” Rule 2(3) of the 2009 Rules provides that the Tribunal “must seek to give effect to the overriding objective when it (a) exercises any power under these rules or (b) interprets any rule or practice direction.”
The DPA
Section 166 of the DPA provides as follows: -
This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner
fails to take appropriate steps to respond to the complaint,
fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or
if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
The Tribunal may, on an application by the data subject, make an order requiring the Commissioner
to take appropriate steps to respond to the complaint, or
to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.
An order under subsection (2)(a) may require the Commissioner
to take steps specified in the order.
to conclude an investigation, or take a specified step, within a period specified in the order.
Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).
Relevant parts of section 165 DPA provide: -
If the Commissioner receives a complaint under subsection (2), the Commissioner must
take appropriate steps to respond to the complaint,
inform the complainant of the outcome of the complaint,
inform the complainant of the rights under section 166, and
if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.
The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—
(a)investigating the subject matter of the complaint, to the extent appropriate…
The Commissioner’s position
The Commissioner’s position in summary is that it is an expert regulator, with a wide discretion to deal with complaints and that a section 166 DPA application is not concerned with the merits of the original complaint, nor does it provide a forum for an applicant to challenge the substantive outcome of the Commissioners actions.
The Commissioner refers to several authorities including Scranage -v- Information Commissioner [2020] UKUT 196 (ACC) and Leighton -v- Information Commissioner (no 2) [2020] UKUT 23 (ACC) in which the Upper Tribunal held: -
I note that in Platts v Information Commissioner (EA/2018/0211/GDPR) the FTT accepted a submission made on behalf of the Commissioner that “s.166 DPA 2018 does not provide a right of appeal against the substantive outcome of an investigation into a complaint under s.165 DPA 2018” (at paragraph [13]). Whilst that is a not a precedent setting decision, I consider that it is right as a matter of legal analysis. Section 166 is directed towards providing a tribunal based remedy where the Commissioner fails to address a section 165 complaint in a procedurally proper fashion. Thus, the mischiefs identified by section 166(1) are all procedural failings. “Appropriate steps” mean just that, and not an “appropriate outcome”. Likewise, the FTT’s powers include making an order that the Commissioner “take appropriate steps to respond to the complaint”, and not to “take appropriate steps to resolve the complaint”, least of all to resolve the matter to the satisfaction of the complainant. Furthermore, if the FTT had the jurisdiction to determine the substantive merits of the outcome of the Commissioner’s investigation, the consequence would be jurisdictional confusion, given the data subject’s rights to bring a civil claim in the courts under sections 167-169 (see further DPA 2018 s.180).
The Commissioner also refers to Killock &Veale & others -v-Information Commissioner [2021] UKUT 299 (ACC) (para 76) in which it was held that: -
The Tribunal does not have the same expertise in determining the appropriate outcome of complaints. The Commissioner is the expert regulator. She is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome. In so far as the Commissioner’s regulatory judgments would not and cannot be matched by expertise in the Tribunal, it is readily comprehensible that Parliament has not provided a remedy in the Tribunal in relation to the merits of complaints.
Killock is also an authority as to the role of the Tribunal when considering whether steps taken (by the Commissioner) were appropriate: -
There is nothing in the statutory language to suggest that the question of what amounts to an appropriate step is determined by the opinion of Commissioner. As Mr Black submitted, the language of s.165 and s.166 is objective in that it does not suggest that an investigative step in response to a complaint is appropriate because the Commissioner thinks that it is appropriate: her view will not be decisive. Nor has Parliament stated that the Tribunal should apply the principles of judicial review which would have limited the Tribunal to considering whether the Commissioner’s approach to appropriateness was reasonable and correct in law. In determining whether a step is appropriate, the Tribunal will decide the question of appropriateness for itself.
However, in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. The GRC is a specialist tribunal and may deploy (as in Platts) its non-legal members appointed to the Tribunal for their expertise. It is nevertheless our view that, in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations.
The Applicant’s position.
The Reply expands on the information provided in the Application and sets out the Applicant’s position in detail. In summary this is that when considering appropriateness the Tribunal should interfere in this case. The Applicant says that the Commissioner: -
“..should have conducted a detailed examination of the facts under the “appropriate action” clause, and that (presuming that COPNI forwarded the whole file to their regulator for review) the [Commissioner] knew or ought to have known that COPNI were wrong in data law and upheld the Applicant’s appeal on the original [SAR]”
Under “key points for consideration” in summary the matters raised by the Applicant include: -
detail as to the Applicant’s role, the assumed identity and possible motives of the person said to have made a complaint about the Applicant.
COPNI failed to carry out their obligations as a regulator.
that the Applicant has already made a SAR to the Charity and obtained information during a Workplace Relations Commission hearing, and that this resulted in the release of an email between the Charity and COPNI which, the Applicant says, demonstrates a failure by COPNI to act as a reasonable regulator.
that COPNI used the protection of Legal Professional Privilege to hide information and that the Commissioner is expected to know the law relating to privilege and apply it properly.
criticism of COPNI staff in that they sided with the Charity
the view that either COPNI deliberately withheld data from the Commissioner or that the Commissioner failed in its duty of care and is “thus not an expert regulator”
the presumption of innocence and an allegation of the absence of fairness including by a failure to provide an appropriate explanation to the Applicant.
her response to the Commissioner’s comment about the possibility of her taking her own action against the COPNI in which she says “this raised the spectre of inequality of arms due to the resources of the Applicant versus the [Commissioner]” and “this negates the right of the citizen to access the judicial decision making bodies of the [UK], the right to good public administration and justice and effectively attempts to throw a unscalable barrier to justice before the Applicant”
that “…the [Commissioner]has failed, refused or neglected to correctly investigate and interrogate the data within the Appeal, or in the alternative has stood idly by as an ‘economy of the truth’ has been served to the ‘expert regulator’.
Decision
In the Reply the Applicant asks: -
That GRC remit this matter to the [Commissioner] and order that the matter be reinvestigated in light of the evidence that several different data rights were not given due consideration as set out in the exemptions prescribed by data law.
The GRC affirm that a matter of law , that the Applicant has a right to rectification where such information as is held by a public body is erroneous or misleading in a material aspect or in the alternative that the GRC affirm that the Applicants rights of data access are considered in tandem on a document by document basis within excepted UK case- law alongside the complainant’s rights within the balancing and proportionality principles of the Data Protection Act 2018.
The Application is pursuant to section 166 DPA. I do not consider that the remedies sought by the Applicant at ii) above fall within the scope of Section 166 DPA. Accordingly, there is no reasonable prospect of that part of the Application succeeding.
i) above refers to the assertion that the Commissioner has failed to take appropriate steps in response to the Complaint and that there is a concern relating to the way in which the Applicant has been kept informed.
By Section 166 DPA the Tribunal’s role is to consider the appropriateness of the steps taken by the Commissioner. Much of content of key points for consideration in the Reply, while useful back ground information, does not directly relate to the role of the Commissioner.
While the question of whether the steps taken by the Commissioner were appropriate is not determined by the Commissioner, in deciding the question of appropriateness I have taken the Commissioner’s views into consideration and given weight to those views. On this basis and having considered the position of both parties, the authorities, and the overriding objective I have concluded that there is also no reasonable prospect of this part of the Application succeeding.
I have assumed that the remedies sought in the Reply were intended to replace and/or expand on the ‘outcome sought’ in the Application as they came later in time. For completeness and on the same basis I conclude that ‘the outcome sought’ also has no reasonable prospect of succeeding.
Accordingly, the Application is struck out under rule 8(3)(c) of the 2009 Rules.
Signed Simon Heald
Judge of the First-tier Tribunal
Date:23 October 2023