D Hooper v The Information Commissioner

The application under section 166 of the Data Protection Act 2018 is STRUCK OUT.

In this decision, ‘the Application’ is a reference to the application made to the tribunal by Ms. Hooper under section 166 of the Data Protection Act 2018 (DPA) and ‘the Applicant’ is a reference to Ms. Hooper

The Commissioner applies for the Application to be struck out under rule 8(3)(c) (no reasonable prospects of success) and/or rule 8(2)(a) (no jurisdiction) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.

The Commissioner submits that the remedies sought by the Applicant are not outcomes that the tribunal can grant in a section 166 application against the Commissioner. The Commissioner submits that is clear that the Applicant does not agree with the outcome of her complaint, however he submits that section 166 DPA18 does not provide a mechanism by which Applicants can challenge the substantive outcome of a complaint.

The Commissioner submits that the Commissioner has taken steps to comply with the procedural requirements set out in section 166 and there is no basis for the tribunal to make an order under section 166(2) DPA.

The Applicant responded to the application to strike out in emails dated 2 and 3 March and 2024, in which she submits as follows:

“I note that the Information Commissioner has asked the Tribunal to strike out my application, which I object to. Whilst I acknowledge, having read some data protection case laws on Bailii (and I quote) that

''The Tribunal does not have the same expertise in determining the appropriate outcome of complaints. The Commissioner is the expert regulator. He is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome. In so far as the Commissioner's regulatory judgments would not and cannot be matched by expertise in the Tribunal, it is readily comprehensible that Parliament has not provided a remedy in the Tribunal in relation to the merits of complaints''.

Nonetheless, past case laws also suggest that ''This does not leave data subjects unprotected. If the Commissioner goes outside his statutory powers or makes any other error of law, the High Court will correct him on ordinary public law principles in judicial review proceedings. The combination of a statutory remedy in the Tribunal in relation to procedures and to the supervision of the High Court in relation to substance provides appropriate and effective protection to individuals. It does not require us to strain the language of s.166 to rectify any lack of protection or to correct any defect in Parliament's enactment of the UK's obligations to protect an individual's data."

Therefore, with this in mind I respectfully invite the Tribunal to consider every single piece of evidence I had sent it, and to make its own findings as to whether or not the DWP is meeting its legal obligations towards its Citizens, as claimed by the ICO. The draconian measures taken by the DWP to extract money unlawfully from decent parents have gone on for decades, prompting thousands of fathers to take their own lives, and perhaps the DWP should be named as a second respondent in this matter.

Significantly, the concerns I have raised with the ICO are legitimate ones, and in my view justiciable, albeit I accept that my case is a complex one.”

“Time and again the Information Commissioner relies on Section 166 to get the Tribunal to strike out appellants' case but with all due respect isn't it the ICO's role to uphold information rights in the public interest?”

The Applicant has subsequently sent in a number of further emails to the tribunal along with a number of documents. I have taken them into account where relevant.

The Applicant has separately requested:

8.1.

That the matter be referred to the Upper Tribunal.

8.2.

That the DWP be joined as a party.

As the Application has been struck out it has not been necessary to formally determine these applications, although I have taken them into account as set out below.

The Applicant has also requested that only her initial and surname are used in public decisions. In my view this can be accommodated without the need to consider any application for an order under rule 14.

The grounds of the Application set out in box 5a include the following:

”I wish to appeal the decision made by the ICO that there have been no breaches of Data Protection Act by the DWP, of Protection and that the latter is meeting its legal obligations, which is certainly not the case. I therefore respectfully ask that all my correspondences are placed in front of a Judge to consider my case as I believe that the Child Maintenance Service...is conducting its business unlawfully.”

I note that in an email to the DWP forwarded to the tribunal dated 10 April 2024 the Applicant states ‘I have also taken the step of appealing against the Information Commissioner’s Office (ICO) decision to the First- tier Tribunal (Information Rights), seeking a fair and just review of the situation’.

On an application to the tribunal under section 166, the tribunal has no power to deal with the merits of the complaint to the Commissioner or its outcome (confirmed in Killock & Veale & ors v Information Commissioner [2021]UKUT 299 (AAC) ( Killock & Veale ).

Further, once an outcome to a complaint has been provided, the tribunal has no power retrospectively to order the Commissioner to take appropriate steps to respond to the complaint, where that might lead to a different outcome. That is because once a decision has been reached, challenges to the lawfulness of the process by which it can be reached or to its rationality are a matter for judicial review by the High Court, and not a matter for the tribunal. ( Killock & Veale and R (on the application of Delo) v Information Commissioner and Wise Payments Limited [2022] EWHC 3046 (Admin), upheld by the Court of Appeal at [2023] EWCA Civ 1141.

The outcome to the Applicant’s complaint to the Commissioner was communicated to the Applicant on 21 November 2023. It is clear from the grounds of the Application and other correspondence from the Applicant that she wishes to appeal that ‘decision’.

Section 166 does not provide a right to appeal the Commissioner’s decision to the tribunal. The tribunal does not have any remit to consider whether or not that outcome was substantively correct.

Nor does the tribunal have any power to consider whether the DWP acted in compliance with data protection legislation. That is not a matter within this tribunal’s remit.

The Application does not appear to challenge the steps taken by the Commissioner to respond to the complaint. In any event, where an outcome had been given there are very narrow circumstances in which the tribunal might be able to make an order under section 166(2)(a) (appropriate steps to respond to the complaint) after the complainant has been informed of the outcome of their complaint. The matter raised in this Application clearly do not fall within those narrow circumstances.

I have considered whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance), prospect of the Application succeeding at a full hearing. In my view, there are no reasonable prospects of the Application under section 166 succeeding.

As the Applicant has applied to join the DWP as a party I have considered whether this would have had any impact on the prospects of success. Even if it were appropriate to join the DWP, this would not have altered the prospects of success. The tribunal simply does not have the powers that the Applicant would like it to have. It cannot consider whether the DWP has complied with its data protection obligations, nor can it consider if the Commissioner’s conclusions were correct.

The Applicant has also asked for the matter to be transferred to the Upper Tribunal, but the Upper Tribunal also does not have jurisdiction to determine the matters which the Applicant wishes to be determined. The transfer would not be appropriate, nor would it alter the merits of the Application.

I have considered whether I should exercise my discretion to strike the Application out. Taking into account the overriding objective, it is a waste of the time and resources of the Applicant, the tribunal and the Commissioner for this Application to be considered at a final hearing. In my view it is appropriate to strike the Application out.

As the Commissioner correctly states in his response, if the Applicant wishes to seek an order of compliance against the Controller for breach of their data rights, the correct route for them to do so is by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA18.

For the above reasons the Application is struck out.