Stephen Laughton v The Information Commissioner

The application under section 166 of the Data Protection Act 2018 is STRUCK OUT.

In this decision, ‘the Application’ is a reference to the application made to the tribunal by Mr. Stephen Laughton under section 166 of the Data Protection Act 2018 (DPA) and ‘the Applicant’ is a reference to Mr. Laughton.

The Commissioner applies for the Application to be struck out under rule 8(3)(c) (no reasonable prospects of success) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.

The Commissioner submits that the remedies sought by the Applicant are not outcomes that the tribunal can grant in a section 166 application against the Commissioner. The Commissioner submits that is clear that the Applicant does not agree with the outcome of his complaint, however he submits that section 166 DPA18 does not provide a mechanism by which Applicants can challenge the substantive outcome of a complaint.

The Commissioner submits that the Commissioner has taken steps to comply with the procedural requirements set out in section 166 and there is no basis for the tribunal to make an order under section 166(2) DPA.

The Applicant responded to this application in an email dated 3 March 2024, in which he submits as follows:

“I agree that there is a distinction between ‘appropriate steps” and “appropriate outcome”, and it would clearly be unreasonable for an applicant to complain simply because they were unhappy with the outcome; that is however not the substance of my complaint. A public body which has a duty to investigate and respond to those issues brought to their attention, must do so with due consideration in the facts. It is of course possible to respond in such a way to create an impression that due consideration to both the facts and one’s responsibilities has been applied, while never actually having done so: one might fob-off a complainant not in so many words, but in long form - this is indeed what has happened here. The ICO have not in fact responded in substance, and therefore have not discharged their duties, but have in fact responded in a way to create the impression to a casual observer that they have done so.

I repeat my claim therefore that the ICO should fulfil their statutory duty, and not simply write long-form responses in order to erroneously create the impression that they have done so, without ever having considered the facts.”

The grounds of the Application are set out in box 5a as follows:

I believe the ICO's decision to my data collection complaint is manifestly wrong on three grounds:

“1)

Firstly, the ICO has found in effect, that it is reasonable to collect information from participants in running races via the establishment of categories which are themselves irrelevant to the event. For example, while sex and age are well established as determinants of athletic performance, aspects of personality such as religion, sexuality, or a belief in a particular philosophical system are not. If the ICO's decision were to stand, it would open the possibility that event organisers could establish categories, for which participants are obliged to provide their details in order to participate, purely for the purpose of collecting that information. The event organiser failed to provide any grounds that collecting participants "gender identity" was reasonable in order to stage a running event, and yet despite a complete lack of reasoning, the ICO has found in their favour.

2)

Secondly, in collecing information to enable categorisation by "gender identity", LME has failed to provide an option for those who do not believe in this philosophical system: if the ICO's decision were to stand, this would be evidence of direct discrimination by the event organisers against those who do not hold this particular belief. This can therefore only be either: a) a failure to collect information accurately as required by GDPR, or, b) direct discrimination.

3)

Lastly, the ICO has found "no evidence" of a failure of the event organiser to ensure that information collected is accurate, for example by ensuring that questions asked are clear, reasonable and unambiguous, despite that I have provided ICO of such evidence, and I am aware of at least two other instances of such evidence. The ICO have failed in their primary obligation to consider and investigate the information provided to them, instead attempting simply to brush it off.”

Ground one is, in essence, a complaint that the Commissioner’s decision was wrong, particularly where there was a complete lack of reasoning from the data controller.

Ground two is, in essence, a complaint that the Commissioner’s decision is either wrong or amounts to a finding of direct discrimination by the data controller.

Ground three is, in essence, a complaint that the Commissioner was wrong to conclude that there was ‘no evidence’ of a failure by the data controller to ensure that the information is accurate, despite that fact that the applicant provided the Commissioner with such evidence and he is aware of at least two other instances of this evidence. As part of this ground the Applicant states that that this is a failure ‘to consider and investigate the information provided’, instead of attempting simply to ‘brush it off’.

On an application to the tribunal under section 166, the tribunal has no power to deal with the merits of the complaint to the Commissioner or its outcome (confirmed in Killock & Veale & ors v Information Commissioner [2021]UKUT 299 (AAC) (Killock & Veale).

Further, once an outcome to a complaint has been provided, the tribunal has no power retrospectively to order the Commissioner to take appropriate steps to respond to the complaint, where that might lead to a different outcome. That is because once a decision has been reached, challenges to the lawfulness of the process by which it can be reached or to its rationality are a matter for judicial review by the High Court, and not a matter for the tribunal. (Killock & Veale and R (on the application of Delo) v Information Commissioner and Wise Payments Limited [2022] EWHC 3046 (Admin), upheld by the Court of Appeal at [2023] EWCA Civ 1141.

The Applicant complained to the Commissioner on 14 June 2023. The Commissioner sought further information from the data controller and the outcome was communicated to the Applicant on 19 December 2023. That letter states that the Commissioner had considered the information available and was satisfied that the data controller processing personal data in line with its data protection obligations. The letter confirms that the Commissioner was not going to take any further action.

The letter of 19 December 2023 was the outcome of the complaint. The tribunal does not have any remit to consider whether or not that outcome was substantively correct.

I do not accept that there is in this Application any challenge to the ‘appropriate steps’ taken by the Commissioner which would not involve reopening that outcome. I conclude therefore that this case does not fall within the narrow circumstances in which the tribunal might be able to make an order under section 166(2)(a) (appropriate steps to respond to the complaint) after the complainant has been informed of the outcome of their complaint.

In particular, allegations that the decision failed to take account of relevant evidence are a matter for judicial review by the High Court, and not a matter for the tribunal.

For those reasons, I do not consider that there is any reasonable prospect of the tribunal making any order under section 166(2).

I have considered whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance), prospect of the Application succeeding at a full hearing. In my view, there are no reasonable prospects of the Application under section 166 succeeding.

I have considered whether I should exercise my discretion to strike the Application out. Taking into account the overriding objective, it is a waste of the time and resources of the Applicant, the tribunal and the Commissioner for this Application to be considered at a final hearing. In my view it is appropriate to strike the Application out.

As the Commissioner correctly states in his response, if the Applicant wishes to seek an order of compliance against the Controller for breach of their data rights, the correct route for them to do so is by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA18.

For the above reasons the Application is struck out.