David Miles v The Information Commissioner

The application is struck out.

In September 2021 David Miles (“Mr Miles”) made a subject access request (“SAR”) to Brentwood Ursuline Convent High School (“BUCHS”). He was not satisfied with their reply and on 14 February 2022 made a complaint (“the Complaint”) to the Information Commissioner (“the Commissioner”) pursuant to section 165(2) Data Protection Act 2018 (“DPA”).

The Complaint was not progressed by the Commissioner. On 17 March 2023 Mr Miles made an application (“the Application”) to the Tribunal pursuant to section 166(2) DPA in which the outcome sought was “I would like the tribunal to direct a response from the ICO, please”

The Commissioner then took steps to progress the Complaint and on 24th March 2023 wrote to BUCHS and reported to Mr Miles.

The Commissioner provided its response to the Application on the 19 April 2023 (“the Response”). In it the Commissioner, while accepting there had been delay and apologising for it, said that it had now been in communication with BUCHS and that the steps taken were, in its view, appropriate.

The Commissioner, in the absence of the Application being withdrawn, has sought an Order that it be struck out pursuant to rule 8(3)(c) of the Tribunal Procedure (First -tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended) (“the 2009 Rules”)

Rule 8 of the 2009 Rules provides that: -

The Tribunal may strike out the whole or a part of the proceedings if-

the Tribunal considers there is no reasonable prospect of the appellant's case, or part of it, succeeding.

In HMRC -v- Fairford Group (in liquidation) and Fairford Partnership Group (in liquidation) [2014] UKUT 0329 the Upper Tribunal summarised the task to be conducted by a Tribunal in these circumstances: -

In AW-v-Information Commissioner and Blackpool CC [2013] 30 ACC the Upper Chamber set out the principles governing the application of rule 8(3)(c) of the 2009 Rules. These included: -

More recent rulings from the superior courts point to the need to look at the interests of justice as a whole ….It is, moreover, plainly a decision which involves a balancing exercise and the exercise of a judicial discretion, taking into account in particular the requirements of rule 2 of the GRC Rules.

Rule 2 of the 2009 Rules provides that the overriding objective of the 2009 Rules is to enable the Tribunal to deal with cases fairly and justly. Rule 2(3) of the 2009 Rules provides that the Tribunal: - “must seek to give effect to the overriding objective when it- (a) exercises any power under these Rules; or (b) interprets any rule or practice direction.”

As required by rule 8(4) of the 2009 Rules Mr Miles was notified of the Commissioner’s application to seek a strike out of the Application. He was given until 3 October 2023 to respond but the does not appear to have done so.

Section 166 DPA provides as follows: -

This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner-

fails to take appropriate steps to respond to the complaint,

fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or

if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.

The Tribunal may, on an application by the data subject, make an order requiring the Commissioner-

to take appropriate steps to respond to the complaint, or

to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

An order under subsection (2)(a) may require the Commissioner

to take steps specified in the order.

to conclude an investigation, or take a specified step, within a period specified in the order.

Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).

Relevant parts of sections 165(4) and (5) DPA provide: -

If the Commissioner receives a complaint under subsection (2), the Commissioner must

take appropriate steps to respond to the complaint,

inform the complainant of the outcome of the complaint,

inform the complainant of the rights under section 166, and

if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.

The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes

investigating the subject matter of the complaint, to the extent appropriate, and

informing the complainant about progress on the complaint …….

Much of the Response is a review of the steps taken after the commencement of the Application. The Commissioner’s position, in summary, is that an application under section 166(2) DPA is not concerned with the merits of the underlying complaint nor does it provide a right of challenge to the substantive outcome of the Commissioners investigation. It is an expert regulator, with a wide discretion.

In support of its position the Commissioner cites several authorities including Killock & Veale & others -v-Information Commissioner [2021] UKUT 299 ACC. Killock is also authority as to the role of the Tribunal when considering whether the steps taken by the Commissioner were appropriate for the purposes of sections 166(1)(a) and (2)(a) DPA. While the question of what amounts to an appropriate step is not simply determined by the opinion of the Commissioner: -

…..in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator.

The Commissioner wrote to BUCHS on the 24 March 2023. BUCHS was informed that, due to their delay in responding to the SAR, they had not complied with their data protection obligations. Under the heading “Action Required” BUCHS were told they should take steps to improve their information rights practice, review the Applicant’s SAR and ensure all personal data he is entitled to is provided unless already disclosed.

On 24 March 2023 the Commissioner reported to the Applicant on the steps now taken. He was also advised that the Commissioner did not intend to take any further action regarding the Complaint and was given guidance about alternative remedies.

On 11 April 2023 the Applicant informed the Commissioner that he had not had a final response from BUCHS. The Commissioner wrote to BUCHS again on the 17 April 2023 and reported this to the Applicant.

By the time the Application was made the Commissioner had taken no effective steps, and the Applicant asked the Tribunal to require the Commissioner to respond to the Complaint. The Commissioner then did so and considers those steps to be appropriate. The stated purpose of the Application has been achieved and accordingly there is no need for the Application to proceed nor would it be proportionate for it to do so.

Having considered whether I should exercise my discretion to strike out the Application I have concluded that there is no reasonable prospect of the Application or part of it succeeding and therefore it is struck out under rule 8(3)(c) 2009 Rules.