Lee Cruickshank v The Information Commissioner

In this decision, ‘the Application’ is a reference to the application made to the tribunal by Mr. Lee Cruickshank under section 166 of the Data Protection Act 2018 (DPA) and ‘the Applicant’ is a reference to Mr. Cruickshank.

The Commissioner applies for the Application to be struck out under rule 8(3)(c) (no reasonable prospects of success) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.

The Commissioner submits that the remedies sought by the Applicant are not outcomes that the tribunal can grant in a section 166 application against the Commissioner. The Commissioner submits that is clear that the Applicant does not agree with the outcome of his complaint, however he submits that section 166 DPA does not provide a mechanism by which Applicants can challenge the substantive outcome of a complaint.

The Commissioner submits that the Commissioner has taken steps to comply with the procedural requirements set out in section 166 and there is no basis for the tribunal to make an order under section 166(2) DPA.

The Applicant responded to this application in an email dated 8 July 2024, in which he submits, in essence, that his personal data has not been handled by the data controller in line with its data protection obligations.

On an application to the tribunal under section 166, the tribunal has no power to deal with the merits of the complaint to the Commissioner or its outcome (confirmed in Killock & Veale & ors v Information Commissioner[2021]UKUT 299 (AAC) (Killock & Veale).

Further, once an outcome to a complaint has been provided, the tribunal has no power retrospectively to order the Commissioner to take appropriate steps to respond to the complaint, where that might lead to a different outcome. That is because once a decision has been reached, challenges to the lawfulness of the process by which it can be reached or to its rationality are a matter for judicial review by the High Court, and not a matter for the tribunal. (Killock & Vealeand R (on the application of Delo) v Information Commissioner and Wise Payments Limited [2022] EWHC 3046 (Admin), upheld by the Court of Appeal at [2023] EWCA Civ 1141.

The Applicant complained to the Commissioner on 13 September 2023. The Applicant submitted further information to the Commissioner on 20 and 24 September 2023. The Commissioner contacted the data controller for further information about the complaint and their data handling practices. The outcome of the complaint was communicated to the Applicant on 5 December 2023. That letter states that the Commissioner had considered the information available and was of the view an infringement of the data controller’s data protection obligations had not taken place, because the Commissioner was satisfied with the lawful basis relied on.

The letter of 5 December 2023 was the outcome of the complaint. The tribunal does not have any remit to consider whether or not that outcome was substantively correct.

I do not accept that there is in this Application any challenge to the ‘appropriate steps’ taken by the Commissioner. There is certainly no challenge to the appropriate steps which would not involve reopening that outcome. The notice of appeal states in terms ‘I don’t agree with the ICO decision’. I conclude therefore that this case does not fall within the narrow circumstances in which the tribunal might be able to make an order under section 166(2)(a) (appropriate steps to respond to the complaint) after the complainant has been informed of the outcome of their complaint.

For those reasons, I do not consider that there is any reasonable prospect of the tribunal making any order under section 166(2).

I have considered whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance), prospect of the Application succeeding at a full hearing. In my view, there are no reasonable prospects of the Application under section 166 succeeding.

I have considered whether I should exercise my discretion to strike the Application out. Taking into account the overriding objective, it is a waste of the time and resources of the Applicant, the tribunal and the Commissioner for this Application to be considered at a final hearing. In my view it is appropriate to strike the Application out.

As the Commissioner states in his response, if the Applicant wishes to seek an order of compliance against the data controller for breach of their data rights, the correct route for them to do so is by way of separate civil proceedings in the County Court or High Court under section 167 DPA.

For the above reasons the Application is struck out.