Tara OFathaigh v The Information Commissioner

The Appellant’s grounds of appeal referred to some research which the Appellant had undertaken, which had stated that parent companies were likely to be either a ‘Controller in Common’ or a ‘Joint Controller’ in respect of personal data held by the parent’s subsidiary companies. The Appellant quoted the research as stating that “this is especially true if the parent company holds 100% of the shares of the subsidiary”.

The Appellant’s grounds of appeal then stated “I think it should be enough to apply to the head office of a company and ask them for a copy of my personal data.”.

The Appellant stated in her notice of appeal that the outcomes she sought from the appeal were for the Tribunal to:

The powers of the Tribunal in respect of the appeal are set out in section 166(2) (as supplemented by section 166(3)). In summary, the Tribunal is empoweredto make an order requiring the Commissioner either:

However, an application under section 166 permits a Tribunal to make any such order only if the Commissioner has failed in some procedural respect, as specified in section 166(1).

The parties consented to the appeal being determined by the Tribunal without an oral hearing.

The Tribunal considered that the appeal was suitable for determination on the papers in accordance with Rule 32 and was satisfied that it was fair and just to conduct the appeal in this way.

No bundle was provided to the Tribunal ahead of the determination of the appeal (through no fault of either party). Pursuant to the Case Management Directions, the Tribunal was satisfied that it had the necessary evidential documents and pleadings in order properly to determine the appeal. Accordingly, the appeal was determined based on the pleadings and evidence which were provided to the Tribunal by the parties in connection with the appeal, albeit without the Tribunal having a formal bundle.

All of the contents of the documents and the arguments from both parties were read and considered, even if not directly referred to in this decision.

Article 15 of the UK GDPR provides individuals with a general right of access to their personal data held by a data controller, including the right to be provided with a copy of their personal data which is being processed by the data controller.

An individual (a ‘data subject’) has a right to make a complaint to the Commissioner if that individual considers that the processing of their personal data infringes the UK GDPR and/or Parts 3 or 4 of the DPA. Section 165 sets out the position as follows:

“(1)

Articles 57(1)(f) and (2) and 77 of the UK GDPR (data subject's right to lodge a complaint) confer rights on data subjects to complain to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the UK GDPR.

(2)

A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act.”.

So far as is relevant, section 165 then goes on to provide:

“(4)

If the Commissioner receives a complaint under subsection (2), the Commissioner must—

(a)

take appropriate steps to respond to the complaint,

(b)

inform the complainant of the outcome of the complaint,

(c)

inform the complainant of the rights under section 166, and

(d)

if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.

(5)

The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—

(a)

investigating the subject matter of the complaint, to the extent appropriate, and

(b)

informing the complainant about progress on the complaint...”.

In essence, therefore, section 165(4) requires the Commissioner to take appropriate steps, as well as the specified other actions, when he receives a relevant complaint from an individual. The appropriate steps which the Commissioner must take include (in summary) investigating the complaint and informing the individual about its progress.

Section 166 provides individuals with a right to make an application to the Tribunal for an order requiring the Commissioner to take appropriate steps to respond to a relevant complaint, or to inform the individual of the progress on (or outcome of) the complaint, if the Commissioner has failed to take certain procedural actions in relation to it. So far as is relevant, that section provides:

“(1)

This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner—

(a)

fails to take appropriate steps to respond to the complaint,

(b)

fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or

(c)

if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.

(2)

The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—

(a)

to take appropriate steps to respond to the complaint, or

(b)

to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

(3)

An order under subsection (2)(a) may require the Commissioner—

(a)

to take steps specified in the order;

(b)

to conclude an investigation, or take a specified step, within a period specified in the order.”.

We comment later below on the nature and meaning of section 166 and its practical effect.

We first address the Commissioner’s strike-out application. For the reasons we have given below, we dismissed that application. We therefore went on to consider and determine the appeal itself. Accordingly, we set out below our material considerations and findings in respect of the appeal itself, following our reasons for dismissing the Commissioner’s strike-out application.

The Commissioner applied for the appeal to be struck out pursuant to Rule 8(2)(a) and/or Rule 8(3)(c) on the grounds that either the Tribunal had no jurisdiction to consider the appeal or that the appeal had no reasonable prospect of success. The grounds given in support of this application were essentially based on the same reasons given by the Commissioner in resisting the appeal.

Given our finding in paragraph 5 that the appeal was made pursuant to section 166, seeking an order from the Tribunal pursuant to section 166(2), it follows that we must reject the Commissioner’s argument (in respect of the first ground) that the Tribunal had no jurisdiction to determine the matters before it.

In respect of the second ground, the Commissioner argued that the Appellant’s grounds of appeal go to the merits of the Commissioner’s decision and that this was an issue which was therefore beyond the scope of the Tribunal’s powers. We deal with the nature and scope of section 166 and the Tribunal’s powers below. However, in our view, at face value the Appellant had an arguable case, in respect of a potential order that the Tribunal does have jurisdiction to make (namely, an order under section 166(2)), and the merits of the appeal would largely depend on an analysis of the legal position and the applicable facts of the case. Accordingly we also reject the Commissioner’s argument that there was no reasonable prospect of the appeal succeeding, such that it should be struck out.

We therefore turn now to address the appeal itself.

We start by addressing the nature of section 166. The Commissioner, in his response to the appeal (and associated strike-out application), referred to various authorities from case law as to the function and purpose of that section (in various Upper Tribunal decisions, as well as decisions in the High Court and the Court of Appeal). It is not necessary for us to refer to that case law again in this decision, but we accept the relevance and application to the appeal of the various authorities which the Commissioner referred to.

We consider that it suffices for us to briefly summarise the legal position based on those authorities. In essence (and so far as is relevant for current purposes) the following are the relevant legal principles.

An application under section 166:

In other words, an application under section 166 does not address the merits or substance of a complaint but rather is merely procedural in nature: it is concerned only with procedural actions which the Commissioner is required to take in respect of the complaint.

We consider that it is instructive to quote the comments of the Upper Tribunal Judge Wikeley in the case of Scranage v Information Commissioner (Footnote: ²):

“...there is a widespread misunderstanding about the reach of section 166. Contrary to many data subjects’ expectations, it does not provide a right of appeal against the substantive outcome of the Information Commissioner’s investigation on its merits. Thus, section 166(1), which sets out the circumstances in which an application can be made to the Tribunal, is procedural rather than substantive in its focus. This is consistent with the terms of Article 78(2) of the GDPR (see above). The prescribed circumstances are where the Commissioner fails to take appropriate steps to respond to a complaint, or fails to update the data subject on progress with the complaint or the outcome of the complaint within three months after the submission of the complaint, or any subsequent three-month period in which the Commissioner is still considering the complaint.”.

The test (in section 166(1)(a)) as to whether the Commissioner has failed “to take appropriate steps to respond to the complaint” is exactly as it says – namely “appropriate steps” and not an ‘appropriate outcome’ (or similar). Likewise, the Tribunal’s powers where the Commissioner has failed to take appropriate steps include making an order that the Commissioner must “take appropriate steps to respond to the complaint” (and not to ‘take appropriate steps to resolve the complaint’). Pursuant to section 166(4), an order to take appropriate steps in response to a complaint includes (as set out in section 165(5)(a)) “investigating the subject matter of the complaint, to the extent appropriate”.

In considering an application under section 166, the Tribunal must bear in mind that the Commissioner is the expert regulator and so is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome. However (using the words of Upper Tribunal Judge Wikeleyin Osifeso v Information Commissioner), (Footnote: ³) “this does not mean that the Tribunal surrenders its judicial task to the Commissioner – thus, the Commissioner’s view carries weight but is not decisive”.

As we have noted, section 166 is concerned with providing a remedy for any procedural failings on the part of the Commissioner after a complaint is made to him (not the merits of the complaint or its outcome). The Tribunal may only make an order under section 166(2) only if the Commissioner has failed in some procedural respect. The procedural failings in question are those set out in section 166(1), which (in summary and paraphrasing) are as follows:

For convenience, we refer below to each of those failings, respectively, as a ‘taking steps failure’, an ‘update failure’ and a ‘subsequent update failure’.

The background to the appeal which we noted above was not in dispute – and, indeed, was self-evident from the documents before us. For completeness, we should note that we make findings of fact regarding the relevant background we have outlined. As we noted in paragraphs 15 and 17, the Commissioner provided the Appellant with an outcome to the Complaint on 8 February 2024 and a further clarification on 13 February 2024.

Given that the Commissioner considered the Complaint and responded to it (providing an outcome to it), we find that there was no ‘taking steps failure’ by the Commissioner in respect of the Complaint. Further, as those responses from the Commissioner (both the response with the outcome on 8 February 2024 and the subsequent clarification on 13 February 2024) occurred within three months of the date of the Complaint, we find that there was no ‘update failure’. Also, as the Commissioner’s response to the Complaint was concluded (an outcome provided) within three months from its date, it follows that we must also find that there was no ‘subsequent update failure’ (on the basis that no subsequent three month period was applicable).

For the above reasons, we find that the Commissioner took appropriate steps to respond to the Complaint. It is important to reiterate that, for the purposes of section 166, it is not the merits or substance of the Complaint which is relevant but rather only the procedural actions which the Commissioner is required to take in respect of it.

For completeness, we address some other specific points raised by the Appellant in her reply to the Commissioner’s response to the appeal.

The Appellant took issue with the request for a signed letter of authority – in particular, considering that this was a ‘device’ used by organisations when challenges were made. The Appellant also queried the veracity of any letter of authority which might be provided, asserting that it would not confirm the Appellant’s identity. The Appellant also questioned the manner in which the letter of authority was requested, considering that the correct approach would have been for the Commissioner to write by letter to the Appellant at her home address “and inform them that an individual was corresponding on their behalf and inviting a response if they objected to this situation”.

As we have noted, section 166 is procedural, rather than substantive, in its focus and we are required to be mindful of the role of the Commissioner as the expert regulator. Accordingly, it is not for the Tribunal to consider or address the merits of the steps which the Commissioner took in respect of the Complaint. We would separately just observe, though, that requesting a letter of authority appears to us to be an appropriate thing to do (and it would be for the Commissioner to satisfy itself of the authenticity of any such letter of authority, if provided) and there are obvious risks with the Appellant’s view that the Commissioner could correspond with a third party on behalf of a complainant in the absence of receiving an objection from the complainant.

We also note, incidentally, that evidently no such letter of authority was ever provided. Indeed, rather than simply provide a letter of authority to the Commissioner, as requested, the Appellant took the steps of issuing the appeal before us.

The Appellant also stated that it was difficult to understand exactly the Commissioner’s position regarding the appeal. The Appellant considered that the Commissioner appeared to believe that the Appellant sought to challenge the Commissioner’s jurisdiction or procedure, but stated that this was misconceived because “the challenge is far more fundamental”. The Appellant went on to state that the Commissioner had misunderstood the law on the basis that he believes that a commercial entity may direct an individual making a subject access request to apply to its affiliates without requiring the parent organisation to “gather in” the individual’s personal data. The Appellant’s position in this regard was, instead, that an individual should be able to make a subject access request to one entity (a head office) in a group of companies and that entity should then be required to ‘gather’ the personal data requested, to save the individual having to make several requests to different entities.

We make three observations in respect of the points in the preceding paragraph (which also address the first outcome which the Appellant sought in the appeal, as we noted in paragraph 22). First, the appeal is indeed (to an extent) about the Commissioner’s procedures, insofar as an application under section 166 requires there to have been some procedural failing on the part of the Commissioner. Secondly (and for the other reasons we have given), there is no jurisdiction in the current appeal for the Tribunal to address the rights of data subjects and/or the obligations of organisations which respond to them. Thirdly (and we reiterate that this is an observation only for current purposes), we consider that the Appellant is mistaken in her view of how subject access requests should be made and responded to in respect of group companies (and, likewise, we consider that the research findings which the Appellant referred to in her grounds of appeal, as noted in paragraph 20, are erroneous) – but this is not for us to address in this appeal.

Finally, we briefly address the remaining outcome which the Appellant sought in the appeal, as noted in paragraph 22 – namely, a direction to Arriva for the provision of a copy of her personal data. As we have outlined, the Tribunal’s powers (had the appeal been successful) would only extend to making an order for the Commissioner to either take appropriate steps to respond to the Complaint, or to inform the Appellant of progress on (or the outcome of) the Complaint. Consequently, the relief which was sought by the Appellant would not have been an available remedy even if the appeal had succeeded. We note that the Commissioner has indicated to the Appellant (in his response to the appeal) an alternative means by which this outcome might be pursued by the Appellant, by reference to section 167. We make no comment on this point, save that the Appellant should note that the remedy in that section applies to an application to the relevant court (not the Tribunal).

For all of the reasons we have given, we find that the Commissioner has complied with the procedural requirements set out in section 166(1), and that there is accordingly no basis for the Tribunal to make an order under section 166(2).

We therefore dismiss the appeal.