Gilbert Robertson v The Information Commissioner

A data subject has a right to make a complaint to the Commissioner if they consider that the processing of personal data relating to them infringes the General Data Protection Regulation (“GDPR”), and/or Parts 3 or 4 of the Data Protection Act 2018 (DPA) see section 165(2) DPA.

Under section 166 DPA, a data subject has a right to make an application to the Tribunal if the Commissioner has failed to take certain procedural actions in relation to their complaint. Section 166 DPA states as follows:-

Case law establishes that an application under s166 DPA is not concerned with the merits of the underlying complaint or intended to provide a right of challenge to the substantive outcome of the Commissioner’s investigation into that complaint. This was most recently confirmed in the case of R (Delo) v Information Commissioner [2022] EWHC 3046 (Admin). In that case Mostyn J said:-

Thus, it is now well established that an application under section 166 is not concerned with the merits of the underlying complaint or intended to provide a right of challenge to the substantive outcome of the Commissioner’s investigation into that complaint. The Tribunal does not have the power to alter the conclusion reached by the Commissioner on a complaint. Neither does the Tribunal have an oversight role over the Commissioner’s exercise of his functions or internal processes.

The Tribunal has the power to strike out the present application under rule 8(3)(c) of the Tribunal Rules on the ground that it has no reasonable prospect of success. The phrase ‘reasonable prospect of success’ has been explained by the Court of Appeal in Swain v Hillman & Another [1999] EWCA Civ 3053 in the context of considering the phrase for the purposes of summary judgment under Part 24 of the CPR at [7]:

In this case, by way of a Notice of Application dated 14 March 2024, the Applicant made an application to the First-tier Tribunal (the Tribunal) under section 166(2) DPA. The Commissioner opposes the application and invites the Tribunal to strike it out under rule 8(2)(a) and/or 8(3)(c) of the Tribunal Rules on the grounds either (i) that the Tribunal is without jurisdiction to consider the application or (ii) that it has no reasonable prospect of succeeding:-

The Applicant’s case involves his attempts to obtain data about himself from the Defence Business Services Civilian Personnel (DBSCP), through a Subject Access Request (SAR). In particular, the Applicant wanted to access information related to his dismissal from the Royal Fleet Auxiliary (RFA), a naval auxiliary in the Ministry of Defence (MOD).

The Applicant submitted a complaint to the Commissioner, together with some supporting evidence and, on 19 March 2024, an Information Commission Office (ICO) case officer contacted the Applicant and the data protection officer at the MOD to explain, that based on the evidence provided, they are unable to determine whether the MOD had fully complied with the requirements of the data protection legislation. As a part of the decision outcome, the MOD was instructed to review the handling of the Applicant’s SAR, ensuring that all information he is entitled to receive has been provided. The MOD had 14 days to provide the Applicant with the outcome of that review and to respond to the questions listed in the complaint, including a full explanation of the exemptions that may have been used if any information in response to his SAR had been withheld.

There was further correspondence and the Applicant received a response from the MOD. The ICO told him that if he had further complaints about the outcome then he would need to take these up with the MOD.

The Applicant issued a Notice of Application dated 14 March 2024. The Applicant says as follows:-

The Commissioner’s response was that the Applicant’s grounds are beyond the narrow matters that the Tribunal has to consider when making an order under section 166(2) DPA.

I have considered both parties’ representations and concluded that this is an appeal which cannot be permitted to go any further and should be struck out.

This is because of the very limited right to apply to the Tribunal set out in s166(2) DPA. As the case law set out above this right to apply does not engage the content of the response made by the Commissioner, but just enables the Tribunal to make an order that that appropriate steps to respond to the complaint have been made and/or to inform the complainant of progress on the complaint, or of the outcome of the complaint

What s166 DPA does not provide is any kind of avenue of challenge to an outcome with which the Applicant is dissatisfied, or any kind of substantive remedy. Given that the application of s166 DPA is limited to communicating the status of the Commissioner’s consideration of a complaint of which he is seized to the data subject, it also necessarily ceases to have application once the Commissioner has concluded his consideration of the complaint and communicated the outcome to Applicant. Section 166 DPA by its terms applies only where the claim is pending and has not reached the outcome stage.

It is clear in this case that the Commissioner has taken appropriate steps to respond to the Applicant and has reached and communicated an outcome in the case. I recognise, of course, that the Applicant is dissatisfied with the outcome communicated by the Commissioner, but the DPA (as confirmed by the case law cited above) does not provide a right to apply to the Tribunal to challenge that outcome. As the Commissioner points out if the Applicant wishes to seek an order of compliance against the MOD for breach of data rights, the correct route to do so is by way of separate civil proceedings in the County Court or High Court pursuant to s167 DPA.

In my view, given the limited nature of the application rights and the Tribunal powers under s166(2) and (3) DPA, the application has no prospect of success, and the application is struck out under rule 8(3)(c) of the Tribunal Rules.