Aamir Shahzad v The Information Commissioner

The applicant made a subject access request on behalf of this father to Croydon University Hospital (the hospital) for a copy of his father’s medical records. On 14 September 2023 the applicant made a complaint to the Commissioner, on behalf of his father, about the hospital’s handling of the subject access request.

The Commissioner contacted the hospital and informed it of the complaint and set out steps it expected the hospital to take and gave a deadline for a response. The Commissioner wrote to the applicant and informed him of the steps taken, advising that an outcome would be provided once the hospital had responded.

On 18 January 2024 the hospital responded directly to the applicant and sent a copy of the response to the Commissioner. The hospital confirmed that a complete response to the applicant’s request had not initially been provided, but that this had been rectified. The hospital stated that it was not possible to arrange the response chronologically or to paginate it because of the resources that this would require. The hospital indicated that the applicant could commission this himself at a cost.

The applicant contacted the Commissioner on 9 February 2024 and essentially raised two issues in relation to the hospital’s provision of his father’s medical notes. Firstly, they had not been provided in the chronological order in which they would have been recorded making it impossible to confirm whether the records were complete, and that given the disorder of around 4,000 pages of notes, it was not possible to assess the continuity of care provided to his father.

On 14 February 2024 the Commissioner sent an outcome to the applicant. The Commissioner explained that his role was to determine whether organisations are complying with their obligations as data controllers and not to act as an intermediary between a complainant and an organisation. The Commissioner noted that the hospital had provided the requested information and stated that if the applicant remained dissatisfied, he could escalate the matter with the hospital. The Commissioner advised that he did not intend to take any further action and that he considered the complaint was closed.

The applicant expressed dissatisfaction with the outcome and on 13 March 2024 the Commissioner addressed the areas that the applicant considered had been overlooked and outlined the case review process. On 1 April 2024 the applicant requested a case review.

On 15 August 2024 the applicant purported to lodge a notice of appeal. In his notice of appeal he stated that he was challenging a failure of the Commissioner to respond to his request for an internal review made on 1 April 2024. He asks the tribunal to order the Commissioner to complete its review and/or order the Commissioner to obtain his father’s medical notes in ‘unedited, coherent and continuous form in proper chronological order’.

On 6 September 2024 the Commissioner explained his finding that the hospital had met its obligation and that no further action was necessary. The Commissioner advised the applicant that he could pursue legal action against the hospital and/or complain to the Parliamentary and Health Service Ombudsman if he was dissatisfied.

On 27 September 2024 the respondent provided his response to the application pursuant to rule 23 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (the Procedure Rules). The respondent opposes the application and makes an application for strike out pursuant to rule 8(3)(c) of the Procedure Rules. I note that elsewhere the Commissioner also relies on rule 8(3)(a). The grounds on which the Commissioner seeks strike out can be summarised as follows:

The applicant provided a reply pursuant to rule 24. The applicant disputes the Commissioner’s interpretation of section 166, and contends that Killock & Veale is authority for the proposition that the tribunal can interfere with the decision of the Commissioner with good reason.

Although the applicant lodged a notice of appeal, there is no right of appeal against the substance of a complaint outcome in relation to matters under the DPA. If there is a challenge to the outcome of a complaint, the appropriate remedy is by way of an application for judicial review. It is for this reason that the applicant’s notice of appeal was treated as an application for an order under section 166(2) of the DPA.

The Upper Tribunal held in Killock & Veale & others v Information Commissioner [2021] UKUT 299 (AAC), that there is a strict procedural focus in section 166. The Upper Tribunal stated:

The applicant was provided with an outcome to his complaint by the Commissioner. He does not agree with the outcome, but this tribunal does not have the power to consider an appeal against the Commissioner’s substantive findings. Despite what he argues, Killock & Veale is not authority for the proposition that the tribunal can do what the applicant is asking. At the time he made his application, he had received all that the tribunal could order under section 166(2) in relation to the applicant’s complaint about the hospital’s handling of his subject access request. There is no remedy the tribunal could order and accordingly, I find that there is no jurisdiction to consider the application and even if there were, the application would have no reasonable prospect of success for the same reasons.

The notice of application is struck out and no further action will be taken in relation to it.