Case Reference: EA-2023-0468-GDPR
Decision Given on: 29 May 2024
Section 166 DPA 2018
Before
TRIBUNAL JUDGE BUCKLEY
Between
SOLOMON BROWNE
Applicant
and
THE INFORMATION COMMISSIONER
Respondent
JUDGE BUCKLEY
Sitting in Chambers
on 24 May 2024
DECISION
The application under section 166 of the Data Protection Act 2018 is STRUCK OUT.
REASONS
In this decision, ‘the Application’ is a reference to the application made to the tribunal by Mr. Solomon Browne under section 166 of the Data Protection Act 2018 (DPA) and ‘the Applicant’ is a reference to Mr. Browne
The Commissioner applies for the Application to be struck out under rule 8(2)(a) (no jurisdiction) and/or rule 8(3)(c) (no reasonable prospects of success) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.
The Commissioner submits that the remedies sought by the Applicant are not outcomes that the tribunal can grant in a section 166 application against the Commissioner. The Commissioner submits that is clear that the Applicant does not agree with the outcome of his complaint, however he submits that section 166 DPA18 does not provide a mechanism by which Applicants can challenge the substantive outcome of a complaint.
The Commissioner submits that the Commissioner has taken steps to comply with the procedural requirements set out in section 166 and there is no basis for the tribunal to make an order under section 166(2) DPA.
The Applicant responded to this application in a document dated 6 March 2024, in which he submits as follows:
The Commissioner cannot instruct the tribunal to strike out the application and challenge the tribunal’s jurisdiction to consider an application. The request for strike out challenges the tribunal’s independence to make its own decision.
The Applicant asserts that the General Regulatory Chamber’s roles are:
“An independent function and responsible to assess decision made by government regulatory bodies”
“Evaluate and examine Data Protection Legislation
“Exercise dispute resolution”
“Enforcement of the compliance of the Data Protection Legislation
The phrase ‘to the extent appropriate’ is ambiguous. The Commissioner should not decide what it appropriate.
The Appellant disagrees with the Commissioner’s view on his complaint of a breach of GDPR.
The Commissioner’s view that he has uncontrolled discretion ‘lends insufficient credulity to his legislative tasks’.
Discussion and conclusions
The applicant makes a number of points about the appropriateness of the Commissioner’s strike out application. Such an application is permitted by the tribunal’s rules. The Commissioner is applying for a strike out, not ‘instructing’ the tribunal to strike out the claim. The decision to strike out or not to strike out is for the tribunal not the Commissioner. The list of ‘roles’ of the tribunal set out in the applicant’s reply do not accurately reflect the tribunal’s role. None of these points are persuasive.
The substantive grounds of the Application are set out in box 5a as follows:
“While it was established that a sole trader data is personal data for which Indeed had breached the publication of, duration of holding such data and failing to respond to questions as to the accuracy of such data, the ICO could not sufficiently explain why it has used a discretion not to enforce the mandate given to it. The data hold by Indeed are incorrect, inaccurate and false. AutoSpecs has not employed any admin assistant during the period mentioned and has not recruited any admin assistant through Indeed recruitment (located and represented at 20 Farrington Road, London, EC1M 3HE). It cannot be understood how Indeed can publish such information when it could not verify that such information is factual.
I am hereby seeking an injunction against the holding and publication of my personal data published by Indeed on its website, seen on google search that is written by a subscriber who have not worked in such capacity at AutoSpecs nor was hired through Indeed by AutoSpecs. The information submitted to and through Indeed breaches data accuracy, adequacy and it is misleading. As AutoSpecs no long hold an account with Indeed recruitment, it is not understood why it is using AutoSpecs & Services details to associate that with Indeed.
As mandated by the laws governing GDPR, the ICO can exercise its enforcement action by asking Indeed recruitment to respond to queries thereby explaining with reference to its terms and conditions that are in line with the GDPR guidelines. In respect of the referenced used subsection 4a) it is also not understood why the ICO course of action is directed to shielding Indeed recruitment rather than fostering data accuracy, adequacy, enforcing it regulatory oversight, law enforcement processing and the legitimate publication of such data. Where it states that it can investigate the subject matter le of the complaint, to the extent appropriate raises the question as to why the extent of its investigation does not sway to the accuracy, adequacy in examining Indeed recruitment adherence to the GDPR rather its course of action allows Indeed to remotely (other parts of the world) control individual personal data without the need to verify its use of data that are appropriately monitored and investigated. Appellant struggle to understand the course of action of the ICO where its mandates should be used to make things right.”
In essence the grounds of the application appear to be:
The appellant does not understand why the Commissioner decided that Indeed were not in breach of their data protection obligations.
The appellant seeks an injunction against Indeed to prevent them from publishing his personal data.
The Commissioner should have made inquiries with Indeed recruitment.
The Commissioner’s actions in investigating the complaint were directed to protecting Indeed recruitment rather than fostering data accuracy, adequacy, enforcing its regulatory oversight, law enforcement processing and the legitimate publication of personal data.
On an application to the tribunal under section 166, the tribunal has no power to deal with the merits of the complaint to the Commissioner or its outcome (confirmed in Killock & Veale & ors v Information Commissioner[2021]UKUT 299 (AAC) (Killock & Veale).
Further, once an outcome to a complaint has been provided, the tribunal has no power retrospectively to order the Commissioner to take appropriate steps to respond to the complaint, where that might lead to a different outcome. That is because once a decision has been reached, challenges to the lawfulness of the process by which it can be reached or to its rationality are a matter for judicial review by the High Court, and not a matter for the tribunal. (Killock & Vealeand R (on the application of Delo) v Information Commissioner and Wise Payments Limited [2022] EWHC 3046 (Admin), upheld by the Court of Appeal at [2023] EWCA Civ 1141.
As the Upper Tribunal put it in a refusal of permission to appeal in Cortes v The Information Commissioner (Appeal No: UA2023-001298-GDPA):
“The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question” (Killockand Veale, paragraph 87). As such, the fallacy in the Applicant’s central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation” [33]
The Applicant complained to the Commissioner on 9 June 2023. The Commissioner reviewed the correspondence and communicated the outcome to the Applicant on 12 July 2023. That letter states that the Commissioner’s view was that that Indeed Recruitment had not breached their data protection legislation, because the Commissioner did not consider that the data was personal data. After a query by the Applicant based on the fact that the business was a sole trader, the Commissioner responded in a letter dated 19 July giving some further information about data protection law, including confirming that information about a sole trader could be considered to be personal data and that whilst personal data has to be accurate, it can be difficult to conclude that an opinion is inaccurate.
There followed an exchange of correspondence in which the Applicant attempted to persuade the Commissioner to investigate further and the Commissioner stated that it did not intend to contact Indeed.
The Applicant ultimately requested a review by the Commissioner. The reviewing officer stated that it was satisfied that the case handler had dealt with the complaint appropriately and in line with the Commissioner’s case handling procedures.
The letter of 12 July 2023 was the outcome of the complaint. The tribunal does not have any remit to consider whether or not that outcome was substantively correct. Thus the tribunal cannot consider whether the Commissioner’s conclusions about personal data were correct, nor does it have the power to issue an injunction.
The tribunal has no power to consider the adequacy of the Commissioner’s reasons or order it to explain or justify its conclusions.
The Applicant complains that the Commissioner did not take appropriate steps because they did not contact Indeed, but I do not accept that this is a challenge which would not involve reopening the outcome to the complaint. Once the applicant has been informed of the outcome, there are narrow circumstances in which the tribunal might be able to make an order under section 166(2)(a) (appropriate steps to respond to the complaint). I conclude that this case does not fall within those narrow circumstances.
For those reasons, I do not consider that there is any reasonable prospect of the tribunal making any order under section 166(2).
I have considered whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance), prospect of the Application succeeding at a full hearing. In my view, there are no reasonable prospects of the Application under section 166 succeeding.
I have considered whether I should exercise my discretion to strike the Application out. Taking into account the overriding objective, it is a waste of the time and resources of the Applicant, the tribunal and the Commissioner for this Application to be considered at a final hearing. In my view it is appropriate to strike the Application out.
For the above reasons the Application is struck out.
Signed Sophie Buckley
Judge of the First-tier Tribunal
Date: 24 May 2024
Promulgated on: 29 May 2024