Penny Bence v The Information Commissioner

The Applicant has by Notice of Application dated 15 October 2023 applied for an order under s. 166 of the Data Protection Act 2018. Her application concerned a letter from the Information Commissioner’s Office dated 21 September 2023 which informed her that the Information Commissioner would be taking no further action on her complaint. In filing its Response to the Notice of Application, the Respondent applied for the appeal to be struck out under rule 8 (3) (c) of the Tribunal’s Rules, on the basis that it had no reasonable prospects of success.

The Applicant made representations under rule 8 (4) in response to the proposed strike out. She asked for it not to be struck out, and repeated the request in her Notice of Application for certain directions to be issued to the data controller.

I note that the powers of this Tribunal in determining a s. 166 application are limited to those set out in s. 166 (2). In order to exercise them, the Tribunal must be satisfied that the Commissioner has failed to progress a complaint made to the ICO under s. 165 DPA 2018. The jurisdiction to make an Order is limited to circumstances in which there has been a failure of the type set out in s. 166 (1) (a), (b) and (c). This Tribunal has no supervisory jurisdiction in relation to the handling of a complaint to the Information Commissioner’s Office and the Tribunal may not review the Information Commissioner’s decision to take no further action in relation to a complaint. This interpretation of the statute to this effect has been upheld by the Upper Tribunal, High Court and Court of Appeal and I am bound by those judgments in making my decision today.

In this case, it is clear that the ICO progressed the complaint and informed the Applicant of its outcome decision. That outcome was clearly communicated to the Applicant. I understand that she does not agree with it, but I am required to operate within the powers that Parliament has given this Tribunal. I have no power to overturn the Information Commissioner’s Decision or to issue directions to third parties, as the Applicant requests. These are matters for the Courts.

I have therefore considered whether a strike out under rule 8 (3)(c) for no prospects of success should be directed. I note that an outcome letter has been provided by the Information Commissioner’s Office, and although the Applicant disagrees with it, this means that there is no longer any remedy which this Tribunal can provide under s. 166 DPA 2018.

I therefore conclude that this Notice of Application has no reasonable prospects of success as the ICO has responded to the complaint and the law does not allow me to take the action which the Applicant requests. I now direct that this application to the Tribunal be struck out under rule 8 (3) (c) of the Tribunal’s Rules and it will accordingly proceed no further. The Applicant should consider whether the remedy she seeks is obtainable through the Courts as their Data Protection Act jurisdiction is different from that of this Tribunal.