D Hooper v The Information Commissioner

The application under section 166 of the Data Protection Act 2018 is STRUCK OUT.

In this decision, ‘the Application’ is a reference to the application made to the tribunal by Ms. Hooper under section 166 of the Data Protection Act 2018 (DPA) and ‘the Applicant’ is a reference to Ms. Hooper

The Commissioner applies for the Application to be struck out under rule 8(3)(c) (no reasonable prospects of success) and/or rule 8(2)(a) (no jurisdiction) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.

The Commissioner submits that the remedies sought by the Applicant are not outcomes that the tribunal can grant in a section 166 application against the Commissioner. The Commissioner submits that is clear that the Applicant does not agree with the outcome of her complaint, however he submits that section 166 DPA18 does not provide a mechanism by which Applicants can challenge the substantive outcome of a complaint.

The Commissioner submits that the Commissioner has taken steps to comply with the procedural requirements set out in section 166 and there is no basis for the tribunal to make an order under section 166(2) DPA.

The Applicant responded to the application to strike out in emails dated 2 and 3 March and 2024, in which she submits as follows:

The Applicant has subsequently sent in a number of further emails to the tribunal along with a number of documents. I have taken them into account where relevant.

The Applicant has separately requested:

As the Application has been struck out it has not been necessary to formally determine these applications, although I have taken them into account as set out below.

The Applicant has also requested that only her initial and surname are used in public decisions. In my view this can be accommodated without the need to consider any application for an order under rule 14.

The grounds of the Application set out in box 5a include the following:

I note that in an email to the DWP forwarded to the tribunal dated 10 April 2024 the Applicant states ‘I have also taken the step of appealing against the Information Commissioner’s Office (ICO) decision to the First- tier Tribunal (Information Rights), seeking a fair and just review of the situation’.

On an application to the tribunal under section 166, the tribunal has no power to deal with the merits of the complaint to the Commissioner or its outcome (confirmed in Killock & Veale & ors v Information Commissioner [2021]UKUT 299 (AAC) (Killock & Veale).

Further, once an outcome to a complaint has been provided, the tribunal has no power retrospectively to order the Commissioner to take appropriate steps to respond to the complaint, where that might lead to a different outcome. That is because once a decision has been reached, challenges to the lawfulness of the process by which it can be reached or to its rationality are a matter for judicial review by the High Court, and not a matter for the tribunal. (Killock & Veale and R (on the application of Delo) v Information Commissioner and Wise Payments Limited [2022] EWHC 3046 (Admin), upheld by the Court of Appeal at [2023] EWCA Civ 1141.

The outcome to the Applicant’s complaint to the Commissioner was communicated to the Applicant on 21 November 2023. It is clear from the grounds of the Application and other correspondence from the Applicant that she wishes to appeal that ‘decision’.

Section 166 does not provide a right to appeal the Commissioner’s decision to the tribunal. The tribunal does not have any remit to consider whether or not that outcome was substantively correct.

Nor does the tribunal have any power to consider whether the DWP acted in compliance with data protection legislation. That is not a matter within this tribunal’s remit.

The Application does not appear to challenge the steps taken by the Commissioner to respond to the complaint. In any event, where an outcome had been given there are very narrow circumstances in which the tribunal might be able to make an order under section 166(2)(a) (appropriate steps to respond to the complaint) after the complainant has been informed of the outcome of their complaint. The matter raised in this Application clearly do not fall within those narrow circumstances.

I have considered whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance), prospect of the Application succeeding at a full hearing. In my view, there are no reasonable prospects of the Application under section 166 succeeding.

As the Applicant has applied to join the DWP as a party I have considered whether this would have had any impact on the prospects of success. Even if it were appropriate to join the DWP, this would not have altered the prospects of success. The tribunal simply does not have the powers that the Applicant would like it to have. It cannot consider whether the DWP has complied with its data protection obligations, nor can it consider if the Commissioner’s conclusions were correct.

The Applicant has also asked for the matter to be transferred to the Upper Tribunal, but the Upper Tribunal also does not have jurisdiction to determine the matters which the Applicant wishes to be determined. The transfer would not be appropriate, nor would it alter the merits of the Application.

I have considered whether I should exercise my discretion to strike the Application out. Taking into account the overriding objective, it is a waste of the time and resources of the Applicant, the tribunal and the Commissioner for this Application to be considered at a final hearing. In my view it is appropriate to strike the Application out.

As the Commissioner correctly states in his response, if the Applicant wishes to seek an order of compliance against the Controller for breach of their data rights, the correct route for them to do so is by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA18.

For the above reasons the Application is struck out.