Graham Nightingale v The Information Commissioner

The Applicant has by Notice of Appeal dated 2 October 2023 applied for an order under s. 166 of the Data Protection Act 2018. His application concerned a letter from the Information Commissioner’s Office dated 15 August 2023 which repeated the conclusions of a letter previously sent to him on 15 September 2022. On 6 November 2023, the Registrar issued directions asking the Appellant to explain why his application was made out of time and why this appeal, if admitted, should not be struck out as having no reasonable prospects of success.

The Applicant made representations under rule 8 (4) in response to the proposed strike out and in support of an extension of time dated 8 November 2023, 9 November 2023, 13 November 2023 and 28 November 2023. The Registrar issued a decision on 15 December 2023 in which he refused to grant the Applicant an extension of time to proceed and also struck out the appeal as having no reasonable prospects of success.

The Applicant requested a judicial consideration of the matter ‘afresh’ pursuant to rule 4 (3) by emails dated 21 December and 27 December 2023. This I now do, and confirm I have read all the Applicant’s submissions.

I note that the powers of this Tribunal in determining a s. 166 application are limited to those set out in s. 166 (2). In order to exercise them, the Tribunal must be satisfied that the Commissioner has failed to progress a complaint made to the ICO under s. 165 DPA 2018. The jurisdiction to make an Order is limited to circumstances in which there has been a failure of the type set out in s. 166 (1) (a), (b) and (c). This Tribunal has no supervisory jurisdiction in relation to the handling of a complaint to the Information Commissioner’s Office and the Tribunal may not review the Information Commissioner’s decision to take no further action in relation to a complaint. This interpretation of the statute to this effect has been upheld by the Upper Tribunal, High Court and Court of Appeal and I am bound by those judgments in making my decision today.

In this case, it is clear that the ICO progressed the complaint and informed the Applicant of its outcome decision. That outcome was communicated to the Appellant over a year before he made his application to the Tribunal and repeated last year. I understand that the Applicant does not agree with it, but I am bound by the powers that Parliament has given this Tribunal.

I have therefore considered afresh whether a strike out under rule 8 (3)(c) for no prospects of success should be directed. An outcome letter has been provided by the Information Commissioner’s Office, and although the Applicant disagrees with it, this means that there is no longer any remedy which this Tribunal can provide under s. 166 DPA 2018.

I conclude that this Notice of Application has no reasonable prospects of success as the ICO has responded to the complaint and the law does not allow me to take the action which the Applicant requests. I agree with the Registrar’s decision of 15 December 2023 and now direct that this application to the Tribunal be struck out under rule 8 (3) (c) of the Tribunal’s Rules and it will accordingly proceed no further. The Applicant should consider whether the remedy he seeks is obtainable through the courts as their Data Protection Act jurisdiction is different from that of this Tribunal.

In these circumstances, I also refuse permission to proceed out of time as, were I to allow it, I would then proceed immediately to strike out the Notice of Application out for the reasons given above.