Edward Yan v The Information Commissioner

Mr Yan applied for orders to progress to be made under s166 Data Protection Act 2018 (DPA18).

Application number EA/2021/0338.GDPR arises from the Commissioner’s reference IC-111113-Z3J5. In the Applicant’s further undated grounds of Application he seeks a formal statement from the company and that the Commissioner should make an apology in writing. The application relates to the subject access request that Mr Yan had made to a company to obtain copies of data he has told the tribunal was relevant to an Employment Tribunal Case (Footnote: ¹). The complaint to the Commissioner was made on 7 June 2021. The Commissioner sent a response to Mr Yan’s concerns on 11 October 2021 explaining that the company was required to contact Mr Yan and demonstrate its compliance with data protection laws to him. Mr Yan was not satisfied with what he had received and after some correspondence the Commissioner provided him with a review of the handling of his data protection complaint.

On 20 October 2021 the Commissioner responded to the Applicant. The case officer said that the company was correct in saying that it would not hold the Applicant’s personal data and further clarified the reasons for his view. The Commissioner also suggested that the Applicant contact his former employer for any personal data that he may require. The Commissioner confirmed that the case was now closed and advised the Applicant of his right to request a case review which he requested that same day.

In that review provided on 25 October 2021 the Commissioner indicated that in his opinion the company would not be under any obligation to provide the testing reports to Mr Yan under the legislation regulated by the Commissioner. Mr Yan was referred to the Parliamentary and Health Service Ombudsman [PHSO] if he felt he had not been treated properly or fairly by the Information Commissioner.

The application number EA/2021/0381.GDPR relates to a subject access request made to Mr Yan’s former employer. In his Notice of Application the Applicant seeks a list of outcomes from this Application relating to the documents that he wishes his former employer to provide. His complaint to the Commissioner on 13 July 2021 was allocated case reference IC-117546-R6N3. Having written to the former employer requesting further information and correspondence with Mr Yan the ICO case officer wrote to Mr Yan on 17 November 2021 to provide an outcome to the complaint he had made.

The Commissioner explained that Tesco had not complied with its obligations under data protection law because he was not satisfied that Tesco had responded to the Mr Yan’s right of access request in a sufficiently prompt manner due to confusion that had developed about the provision of identification documents. However, the case officer also advised on behalf of the Commissioner that he did not otherwise believe that Tesco had failed to make a comprehensive disclosure of Mr Yan’s personal data to which he would be entitled.

Having received a complaint from Mr Yan the matter was reviewed and On 18 November 2021 an ICO reviewing officer wrote to the Applicant to provide a case review outcome agreeing with the outcome provided to Mr Yan on 17 November 2021. Again Mr Yan was referred to the PHSO if he was not happy with the way the Commissioner had handled the complaint he had made.

This case has a complex procedural history that it is not necessary to set out in this decision. It is sufficient to note that the case management directions made in this case were subject to an appeal to the Upper Tribunal but permission to appeal was refused.

Mr Yan has sometimes indicated that he wished for there to be a hearing and at other times suggested the applications should be determined on the papers. There was a hearing scheduled at Norwich Magistrates’ Court. Mr Yan did not attend the hearing and was not represented. He had written to the tribunal on 12 April 2023 to say he was “unwell” and thus unable to participate. This followed a previous communication in which Mr Yan’s application for a postponement had been refused. Mr Yan was asked to provide a note from his GP but none was received before the hearing was scheduled to begin. On that occasion I proceeded to hear the case in Mr Yan’s absence as I was satisfied that the tribunal rules (rule 36) were satisfied. However, medical evidence was subsequently provided supporting his inability to attend. Thus the decision was set aside.

The Respondent consents to a paper determination. The Tribunal may make a decision without a hearing pursuant to rule 32 where that decision disposes of proceedings under rule 8 (striking out a party's case). In the light of his health conditions and the issues on which I have received and considered Mr Yan’s written submissions I have decided that it is appropriate to determine these matters without a hearing.

Mr Yan has made lengthy submissions. I have read and considered these submissions contained in the numerous emails he has sent to the tribunal in these two applications.

After the hearing at Norwich, Mr Yan provided further submissions in response to the proposed striking out of the applications that I have considered. In those submissions he says (in summary)

In the responses to the applications the Information Commissioner has applied for this case to be struck out pursuant to rule 8(3)(a) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009. It is argued that as there has been an outcome provided to the Applicant, Mr Yan, in both cases the Tribunal no longer has any power to make an order under s166 and thus her application has no reasonable prospect of succeeding.

Since the DPA18 came into force a person can apply to this Tribunal for an “order to progress complaints” under section 166.

A data subject has a right to make a complaint to the Commissioner if they consider that, in connection with the processing of personal data relating to them, there is an infringement of the [UK] General Data Protection Regulations [GDPR] (now the UKGDPR in effect since 31 December 2020), and/or Parts 3 or 4 of the DPA18: see Article 77 [UK]GDPR, and section 165 (1) & (2) DPA2018.

Under section 166 DPA18, a data subject has a right to make an application to the Tribunal if they consider that the Commissioner has failed to take certain procedural actions in relation to their complaint.

Section 166 DPA18 as relevant states:

The powers of the Tribunal in considering such applications have been considered by the Upper Tribunal. These cases are binding on the First Tier Tribunal of which the General Regulatory Chamber is a part. They are therefore binding on me as to how I must approach Mr Yan’s applications even if he does not accept that binding nature.

The Tribunal is limited in its powers to those given by Parliament as interpreted by the Upper Tribunal. As stated in Killock & others v Information Commissioner [2022] 1 WLR 2241 by Mrs Justice Farbey

This Tribunal may consider whether a step is appropriate; the Information Commissioner’s view on this will not be determinative but should be taken into account by this Tribunal and accorded due weight given the Commissioner is an expert regulator in the best position to decide what investigations she should undertake into any particular issue and how she should do so. This Tribunal will not interfere with an exercise of regulatory judgement without good reason. See Killock paras 84 to 86.

The appropriateness of any investigative steps taken is an objective matter which is within the jurisdiction of this Tribunal. However, as stated in paragraph 87 of Killock, s.166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. This Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given. It will do so in the context of securing the progress of the complaint in question. It may be possible to wind back the clock and to make an order for an appropriate step to be taken in response to the complaint under s.166(2)(a). However, if invited to do so this Tribunal will cast a critical eye to assure itself that the complainant is not using the s.166 process to achieve a different complaint outcome.

Moreover, the Upper Tribunal said in Killock that if the Commissioner goes outside her statutory powers or makes any other error of law, it is for the High Court to correct her on ordinary public law principles in judicial review proceedings. The assessment of the appropriateness of a response already given is for the High Court and not this Tribunal. The combination of a statutory remedy in the Tribunal in relation to procedures and to the supervision of the High Court in relation to substance provides appropriate and effective protection to individuals.

This approach has been confirmed by the High Court and the Court of Appeal. Mostyn J in the High Court in R (Delo) v Information Commissioner [2023] 1 WLR 1327, paragraph 57 –

Mostyn J’s decision in Delo was upheld by the Court of Appeal, see [2023] EWCA Civ 1141 –

“For the reasons I have given I would uphold the conclusion of the judge at [85] that the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint.” See paragraph 80, Warby LJ.

More recently in the Upper Tribunal in Cortes v Information Commissioner (UA-2023-001298-GDPA) which applied both Killock and Delo in confirming that the nature of section 166 is that of a limited procedural provision only.

“The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court)….As such, the fallacy in the Applicant’s central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation, and thereby launch a collateral attack on the outcome itself with the aim of the complaint decision being re-made with a different outcome. Such a scenario would be inconsistent with the purport of Article 78.2, the heading and text of section 166 and the thrust of the decisions and reasoning in both Killock and Veale and R (on the application of Delo). It would also make a nonsense of the jurisdictional demarcation line between the FTT under section 166 and the High Court on an application for judicial review.” (paragraph 33)

Furthermore, a person who wants a data controller (or processor) to rectify personal data, compensate them, or otherwise properly comply with the Data Protection Act 2018 or [UK] General Data Protection Regulations in relation to personal data must go to the civil courts (Footnote: ²) not a tribunal pursuant to sections 167-169 & 180 of the Data Protection Act 2018. I express no opinion one way or another about whether the Applicant can do so, or whether they should do so; that is a matter for Mr Yan , about which this Tribunal cannot give advice.

This Tribunal does not have an oversight function in relation to the Information Commissioner’s Office and does not hold them to account for their internal processes. The Parliamentary and Health Service Ombudsman (Footnote: ³) is the body which has that function as Mr Yan was informed. I express no opinion one way or another about whether he can or whether he should raise the issue with the Ombudsmen; again, that is a matter for him, about which this Tribunal cannot advise him.

Mr Yan was provided with a response to their complaints as set out above and these outcomes were each in turn reviewed and upheld under the Respondent’s case review processes. Mr Yan does not agree with the outcomes with which he has been provided, but this Tribunal has no power to consider an appeal against the Information Commissioner’s substantive findings.

The Tribunal has no power to do what the Applicant is asking for in his applications. By the time Mr Yan made his applications in each of these cases he had received all that which this Tribunal could order under s166(2) DPA18.

Section 166 Data Protection Act 2018 does not provide a right of appeal against the substantive outcome of an investigation into a complaint under s.165 Data Protection Act 2018.

Furthermore, the Tribunal does not have any power to supervise or mandate the performance of the Commissioner’s functions.

Mr Yan’s submissions amount to an attempt to wind back the clock in order to seek a preferred outcome. There is thus no basis for the Tribunal to make an order under section 166(2) DPA18.

Having considered whether this tribunal could provide the Applicant with any other remedy I have concluded that while there may be a remedy available from the courts (about which I make no conclusions or give any indication) having considered the nature of the issues raised by Mr Yan there is no other remedy available from this Tribunal in relation to the applications EA/2021/0338.GDPR and EA/2021/0381.GDPR. This Tribunal can only act within the scope of its power and cannot provide Mr Yan with the remedies he seeks.

In order either of these applications to proceed there must be a realistic prospect of its success. For the reasons set out above, I have concluded that this Tribunal would not be able to provide the outcome(s) sought by Mr Yan in both these applications and that therefore the applications he has made are hopeless, or in other words have no reasonable prospect of success.

I have considered whether there is any other order the Tribunal could make rather than accede to the Respondent’s application however there is no case management direction that can be made that would alter the hopeless nature of the applications. There is no matter that is properly triable at a hearing within the scope of the Tribunal’s powers.

Having taken account of all relevant considerations, I strike out applications EA/2021/0338.GDPR and EA/2021/0381.GDPR pursuant to 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 because there is no reasonable prospect of either application succeeding.