Thomas Deacon v The Information Commissioner

A data subject has a right to make a complaint to the Commissioner if they consider that the processing of personal data relating to them infringes the General Data Protection Regulation (“GDPR”), and/or Parts 3 or 4 of the Data Protection Act 2018 (DPA) see section 165(2) DPA.

Under section 166 DPA, a data subject has a right to make an application to the Tribunal if the Commissioner has failed to take certain procedural actions in relation to their complaint. Section 166 DPA states as follows:-

Case law establishes that an application under s166 DPA is not concerned with the merits of the underlying complaint or intended to provide a right of challenge to the substantive outcome of the Commissioner’s investigation into that complaint. This was most recently confirmed in the case of R (Delo) v Information Commissioner [2022] EWHC 3046 (Admin). In that case Mostyn J said:-

Thus, it is now well established that an application under section 166 is not concerned with the merits of the underlying complaint or intended to provide a right of challenge to the substantive outcome of the Commissioner’s investigation into that complaint. The Tribunal does not have the power to alter the conclusion reached by the Commissioner on a complaint. Neither does the Tribunal have an oversight role over the Commissioner’s exercise of his functions or internal processes.

The Tribunal has the power to strike out the present application under rule 8(3)(c) of the Tribunal Rules on the ground that it has no reasonable prospect of success. The phrase ‘reasonable prospect of success’ has been explained by the Court of Appeal in Swain v Hillman & Another [1999] EWCA Civ 3053 in the context of considering the phrase for the purposes of summary judgment under Part 24 of the CPR at [7]:

By way of a Notice of Application dated 22 November 2023, the Applicant made an application to the First-tier Tribunal (the Tribunal) under section 166(2) DPA. The Commissioner opposes the application and invites the Tribunal to strike it out under rule 8(2)(a) and/or 8(3)(c) of the Tribunal Rules on the grounds either (i) that the Tribunal is without jurisdiction to consider the application or (ii) that it has no reasonable prospect of succeeding:-

The Applicant’s case involves his attempts to obtain personal information about his employment, from Interpath Advisory (Interpath). On 1 July 2023, the Applicant submitted a complaint to the Commissioner, together with some supporting evidence, about the way in which Interpath had responded to his subject access request.

The Commissioner noted that the Applicant had highlighted specific data, believing that this assisted to narrow the scope of the Applicant’s request, and asked that Interpath consider his issues again and respond directly within the next 28 days. On the same day, the Commissioner contacted Interpath, advising that following a review of the complaint, the Commissioner would like them to revisit the Applicant’s Subject Access Request (SAR) and asked them to contact the Applicant directly within the next 28 days to resolve matters.

There was further communication with Interpath. On 25 October 2023 the Commissioner provided a further outcome to the Applicant. The Commissioner was satisfied that Interpath had responded appropriately and noted that they had provided extra assistance in explaining what data they did and did not have and how it was stored. It was explained to the Applicant that there was no further advice and guidance that the Commissioner could offer and he was satisfied that Interpath understood their data protection obligations. On 18 December 2023, the Reviewing Officer found that the complaint had been dealt with appropriately and provided further explanatory material about the Commissioner’s findings and the requirements of the legislation.

The Applicant issued a Notice of Application dated 22 November 2023. He disagreed with the Commissioner’s decision that Interpath had provided him with all the personal data to which he was entitled, and he set out details of his case. The outcome the Applicant sought was ‘To obtain my employment records including grievances and outcomes’.

The Commissioner’s response was that the Applicant’s grounds are beyond the narrow matters that the Tribunal has to consider when making an order under section 166(2) DPA. The Applicant was asked for a response on 21 February 2024 by email but there has been no response.

I have considered both parties’ representations and concluded that this is an appeal which cannot be permitted to go any further and should be struck out.

This is because of the very limited right to apply to the Tribunal set out in s166(2) DPA. As the case law sets out above this right to apply does not engage the content of the response made by the Commissioner, but just enables the Tribunal to make an order that that appropriate steps to respond to the complaint have been made and/or to inform the complainant of progress on the complaint, or of the outcome of the complaint.

What s166 DPA does not provide is any kind of avenue of challenge to an outcome with which the Applicant is dissatisfied, or any kind of substantive remedy. Given that the application of s166 DPA is limited to communicating the status of the Commissioner’s consideration of a complaint of which he is seized to the data subject, it also necessarily ceases to have application once the Commissioner has concluded his consideration of the complaint and communicated the outcome to Applicant. Section 166 DPA by its terms applies only where the claim is pending and has not reached the outcome stage.

It is clear in this case that the Commissioner has taken appropriate steps to respond to the Applicant and has reached and communicated an outcome in the case. I recognise, of course, that the Applicant is dissatisfied with the outcome communicated by the Commissioner, but the DPA (as confirmed by the case law cited above) does not provide a right to apply to the Tribunal to challenge that outcome. As the Commissioner points out if the Applicant wishes to seek an order of compliance against Interpath for breach of data rights, the correct route to do so is by way of separate civil proceedings in the County Court or High Court pursuant to s167 DPA.

In my view, given the limited nature of the application rights and the Tribunal powers under s166(2) and (3) DPA, the application has no prospect of success, and the application is struck out under rule 8(3)(c) of the Tribunal Rules.