Patrick Wainwright v The Information Commissioner

The application under section 166 of the Data Protection Act 1998 is STRUCK OUT.

In this decision, ‘the Application’ is a reference to the application made to the tribunal by Mr. Patrick Wainwright under section 166 of the Data Protection Act 1998 (DPA) and ‘the Applicant’ is a reference to Mr. Wainwright.

The Commissioner applies for the Application to be struck out under rule 8(3)(c) (no reasonable prospects of success) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.

The Commissioner submits that the remedies sought by the Applicant are not outcomes that the tribunal can grant in a section 166 application against the Commissioner. The Commissioner submits that is clear from the grounds in support of the application, that the Applicant does not agree with the outcome of his complaint, however, as the Upper Tribunal and the High Court in Killock & Veale & others v Information Commissioner[2021] UKUT 299 (AAC) and R (on the application of Delo) v Information Commissioner and Wise Payments Ltd[2022] EWHC 3046 (Admin), have already established, section 166 DPA18 does not provide a mechanism by which Applicants can challenge the substantive outcome of a complaint.

Further, the Commissioner submits that the Applicant seeks to challenge the investigation carried out by the Commissioner, with a view to seeking a different outcome.

Finally, the Commissioner submits that some of the points that have been raised by the Applicant, namely as stated in the first paragraph of the grounds that the investigation was irrational, perverse or flawed, are essentially public law complaints and as the Upper Tribunal’s decision in Killock makes clear such matters are for the Administrative Court who are better equipped to consider such arguments.

The Applicant responded to this application in submissions dated 7 March 2023 in which he submits that the Commissioner provided a ‘purported part decision’ on 3 May 2023 that was perverse and contrary to the evidence. He submits that in response to a request for a review the Commissioner failed to investigate and progress the complaint and failed to produce any substantive outcome.

The Applicant further submits that the response to the appeal is inaccurate, incomplete, incoherent and inconsistent with the facts.

The Applicant submits that the Commissioner acknowledged that the data controller was in breach of data protection legislation by repeatedly writing to the controller.

The Applicant acknowledges that up to and including 24 March 2023 the Commissioner had investigated the Applicant’s complaint with diligence and procedural correctness and in accordance with the scope and remit of the Enforcement notice of the Commissioner. After 24 March 2023 the Applicant submits that there were procedural failings and procedural irregularities coupled with investigatory failings by the Commissioner which led to a perverse and incomplete outcome.

The Applicant submits that the tribunal has power to order the Commissioner to take appropriate steps to investigate a complaint, and argues that after 24 March 2023 the Commissioner failed to do so.

Finally the Applicant submits that the Application has more than reasonable prospects of success because the issues in this matter have already been determined by Commissioner’s investigation and the Commissioner’s substantive outcome in the issuing of the Enforcement notice against the data controller.

The grounds of the Application are set out in box 5a as follows:

On an application to the tribunal under section 166, the tribunal has no power to deal with the merits of the complaint to the Commissioner or its outcome (confirmed in Killock & Veale & ors v Information Commissioner[2021]UKUT 299 (AAC) (Killock & Veale).

Further, once an outcome to a complaint has been provided, the tribunal has no power retrospectively to order the Commissioner to take appropriate steps to respond to the complaint, where that might lead to a different outcome. That is because once a decision has been reached, challenges to the lawfulness of the process by which it can be reached or to its rationality are a matter for judicial review by the High Court, and not a matter for the tribunal. (Killock & Vealeand R (on the application of Delo) v Information Commissioner and Wise Payments Limited[2022] EWHC 3046 (Admin), upheld by the Court of Appeal at [2023] EWCA Civ 1141.

The Applicant complained to the Commissioner on 22 December 2022. The Commissioner communicated with the data controller a number of times and the outcome was communicated to the Applicant on 3 May 2023. That letter states that the Commissioner had considered all the information available and was satisfied with the data controller’s response to the subject access request. The letter confirms that the Commissioner was not going to take any further action. I do not accept that this was only a ‘part’ outcome.

The letter of 3 May 2023 was the outcome of the complaint. The tribunal does not have any remit to consider whether or not that outcome was substantively correct.

I do not accept that there is in this Application any challenge to the ‘appropriate steps’ taken by the Commissioner which would not involve reopening that outcome. I conclude therefore that this case does not fall within the narrow circumstances in which the tribunal might be able to make an order under section 166(2)(a) (appropriate steps to respond to the complaint) after the complainant has been informed of the outcome of their complaint.

In particular, allegations that the decision was ‘procedurally flawed irrational and perverse’ are a matter for judicial review by the High Court, and not a matter for the tribunal.

For those reasons, I do not consider that there is any reasonable prospect of the tribunal making any order under section 166(2).

I have considered whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance), prospect of the Application succeeding at a full hearing. In my view, there are no reasonable prospects of the Application under section 166 succeeding.

I have considered whether I should exercise my discretion to strike the Application out. Taking into account the overriding objective, it is a waste of the time and resources of the Applicant, the tribunal and the Commissioner for this Application to be considered at a final hearing. In my view it is appropriate to strike the Application out.

As the Commissioner correctly states in his response, if the Applicant wishes to seek an order of compliance against the Controller for breach of their data rights, the correct route for them to do so is by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA18.

For the above reasons the Application is struck out.