Dr. Stephen Fox v Information Commissioner

By way of an application form dated 2 April 2024, the applicant made an application to the Tribunal pursuant to section 166(2) of the Data Protection Act 2018 (“2018 Act”)

In summary, the applicant made a complaint to the Information Commissioner (“ICO”) on 25 November 2023 identifying concerns that the DVLA had, following a Subject Access Request made by the applicant, “withheld information” from him.

The applicant summarises the factual background which led to the complaint, in the following terms:

“15.

The data complaint concerned the appellants applications for a driving licence exchange in March, June, twice in September and lastly in October 2023. The DVLA sent the appellant formal denial letters in respect of all of those rejected applications but asked the denial letters be returned with the appellant’s next application.

16.

The SAR concerned the appellants applications for a driving licence exchange in March, June and twice September 2023 and the DVLA’s repeated rejections. The DVLA sent the appellant denial letters for these requested exchanges. When the appellant made his SAR to the DVLA he received a response from the DVLA on the 31st October 2023 stating “I have conducted a search of our records under your personal details and driver number and have found the attached data.”

17.

The data they released was a computer print out of the last three ‘Case File Enquiry’ reports, of 5th September 2023, 21st September 2023 and 18th October 2023 which contain short summations of the DVLA Reasons for Rejection for those applications only [attached “B”] and not the applications of March 2023 and June 2023.

18.

The DVLA referred the matter of whether they had the statutory right to refuse the appellant’s request, to an Independent Complaint Assessor (ICA), Mr Stephen Shaw. Mr Shaw produced a report, dated March 2023, and in paragraph 25 of the report, Mr Shaw quotes a DVLA letter to himself; “My understanding is that when you applied on 17 March, your Canadian licence had expired. You have advised us that you returned to Canada and applied for a temporary extension on your Canadian licence. You have said this was extended until 11 July. We then received a further application on 23 May which was returned to you on 8 June as we required further confirmation from the relevant authority regarding the test pass.”

19.

In paragraph 34, Mr Shaw states that on 22nd January 2024 the DVLA informed him; “Mr Fox’s second application was returned to him on 8 June as we required further confirmation from the licensing authority regarding his test pass. Along with Mr Fox’s short-term extended licence we also required a letter of entitlement from him. Mr Fox was advised of this in writing.”

20.

In summary the DVLA confirmed to the ICA that they received and then rejected applications by the appellant in March and June 2023. Furthermore, when they communicated with Mr Shaw in 2024 they clearly had some means of referencing the DVLA rejections of March and June 2023.

21.

Compare this to the DVLA response to the appellant on 13th November 2023 [attached “C”] “I can confirm that the SAR reply sent 31/10/2023 contained all the available information you requested. It may be of help for me to explain that rejected applications are not stored on your driver record and are stored only for a short period of time (usually no longer than 3 months) before being deleted.”

22.

The DVLA are clearly withholding material from the appellant that they have retained and that they have ready access to, as evidenced by their communications with the ICA. The DVLA have not disclosed those rejection letters or the ‘Case File Enquiry’ reports for March and June 2023, such as they did for the rejections of September and October 2023. They have also not disclosed the 2nd stage complaint communications as per their own complaint protocol [attached “D”].

23.

Incidentally the DVLA, in the interim period, have made significant changes to the second step of the complaints process due to legal advice arising from this matter. Absolving the Chief Executive of the DVLA from responsibility for these responses and now transferring that responsibility to the Head of Complaints.

24.

The appellant has always made it clear to the Commissioner that the following material was initially withheld and remains withheld:

i.

The ‘Case File Enquiry’ report of March 2023

ii.

The ‘Case File Enquiry’ report of June 2023

iii.

The rejection letter of March 2023

iv.

The rejection letter of June 2023

v.

The internal communications concerning the DVLA’s 2nd stage complaint process in this matter, and the reasons why the appellant never received a response to his complaint at that stage.”

On 6th March 2024, the applicant telephoned the ICO Helpline requesting an update to his complaint. The ICO Helpline advised the applicant that his complaint had been assigned to an ICO case officer, and allocated case file reference IC-273502-T3Q9. The applicant also sent an email requesting an estimated timetable for the investigation on the same date. The applicant sent a further chaser on 13 March.

On 13 March 2024, the case officer wrote to the applicant in the following terms:

“We have considered the issues you have raised with us. Based on the evidence provided, it is not clear whether or not there has been an infringement of the legislation, however we feel there is more work for the DVLA to do in order to resolve your concerns. We have therefore referred your complaint to them and asked them to look at the issues raised and respond to you fully within the next 14 days. We have allowed the organisation 14 days to consider these issues and we expect them to be in contact with you in due course.”

On the same date, the ICO contacted the DVLA requesting that they look into the issues raised by the applicant and respond to the applicant within 14 days.

The DVLA responded on 18 March. On 21 March, the applicant contacted the ICO indicating that he was not satisfied with the DVLA’s response. On the same date, the case officer sent an email to the applicant acknowledging that the DVLA had provided a final response and, on review of that letter, she explained that it was evident that mistakes had been made by the DVLA, but that it appeared that they were now complying with their data protection obligations because they had looked at his concerns, provided an appropriate response and explained the next steps that he needed to take. The case officer further stated that the ICO would not be taking further action. The Tribunal has been provided with a copy of this email.

In response to correspondence from the applicant, the ICO wrote on the 26 March advising that an ‘outcome’ had been provided on 13 March 2024, and that it had also corresponded on 19 and 21 March responding to outstanding issues. The case officer noted that the applicant had received a response from DVLA on 22 March 2024 and that the matter had now been resolved. The ICO again confirmed that it would be taking no further action.

Before the Tribunal, the applicant asserts, amongst other things, that:

The ICO contends that it has taken steps to consider and respond to the applicant’s complaint and has provided an outcome. The Tribunal cannot therefore provide a remedy to the applicant. The applicant is not entitled to challenge the substantive outcome of the complaint before the Tribunal. The Tribunal has no power to award compensation, which is an outcome sought by the applicant. The ICO further maintains that if the applicant wishes to seek an order of compliance against the DVLA for breach of their data rights, the correct route for them to do so is by way of separate civil proceedings in the County Court or High Court under section 167 of the 2018 Act.

Section 166 of the 2018 Act provides –

“166 (1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner—

(a)

fails to take appropriate steps to respond to the complaint,

(b)

fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or

(c)

if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.

(2)

The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—

(a)

to take appropriate steps to respond to the complaint, or

(b)

to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

(3)

An order under subsection (2)(a) may require the Commissioner—

(a)

to take steps specified in the order;

(b)

to conclude an investigation, or take a specified step, within a period specified in the order.”

As stated by the Upper Tribunal in Killock & others v Information Commissioner [2022] 1 WLR 2241

“74.

The remedy in s.166 is limited to the mischiefs identified in s.166(1). We agree with Judge Wikeley’s conclusion in Leighton (No 2) that those are all procedural failings. They are (in broad summary) the failure to respond appropriately to a complaint, the failure to provide timely information in relation to a complaint and the failure to provide a timely complaint outcome. We do not need to go further by characterising s.166 as a “remedy for inaction” which we regard as an unnecessary gloss on the statutory provision. It is plain from the statutory words that, on an application under s.166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the section 166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a tribunal from the procedural failings listed in section 166 towards a decision on the merits of the complaint must be firmly resisted by tribunals.”

The Upper Tribunal has also provided guidance on the approach to be taken by this Tribunal when considering whether to strike out a case as having no reasonable prospect of success. In HMRC v Fairford Group (in liquidation) and Fairford Partnership Limited (in liquidation) [2014] UKUT 0329 (TCC), the Upper Tribunal stated:

“…an application to strike out in the FTT under rule 8 (3) (c) should be considered in a similar way to an application under CPR 3.4 in civil proceedings (whilst recognising that there is no equivalent jurisdiction in the First-tier to summary judgement under Part 24). The Tribunal must consider whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance) prospect of succeeding on the issue at a full hearing…The Tribunal must avoid conducting a “mini-trial.” As Lord Hope observed in Three Rivers the strike out procedure is to deal with cases that are not fit for a full hearing at all.”

I find that the applicant’s application to the Tribunal is brought pursuant to section 166 of the 2018 Act and it is brought within time (see Rule 22(6)(f) of the 2009 Rules).

Having carefully considered the parties’ submissions, I conclude that the proceedings should be struck out as having no reasonable prospect of success.

The appropriateness of any investigative steps taken is an objective matter which is within the jurisdiction of this Tribunal. However, as stated in paragraph 87 of Killock, section 166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. This Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given. It will do so in the context of securing the progress of the complaint in question. The Tribunal has no powers to alter the outcome or any enforcement steps thereafter.

The Upper Tribunal has more recently considered section 166 in Cortes v Information Commissioner (UA-2023-001298-GDPA) stating, inter alia at [33]:

“The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court)….As such, the fallacy in the Applicant’s central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation, and thereby launch a collateral attack on the outcome itself with the aim of the complaint decision being re-made with a different outcome. Such a scenario would be inconsistent with the purport of Article 78.2, the heading and text of section 166 and the thrust of the decisions and reasoning in both Killock and Veale and R (on the application of Delo). It would also make a nonsense of the jurisdictional demarcation line between the FTT under section 166 and the High Court on an application for judicial review.”

The ICO has clearly progressed the applicant’s complaint and provided the applicant with an outcome to that complaint. Whether the circumstances are such that the ICO ought to be taking further action in relation to the DVLA in response to this particular complaint, is a paradigm example of a matter falling within the ICO’s regulatory competence. The rationality of the outcome provided by the ICO is not a matter for this Tribunal, and there is no basis in the present case for the Tribunal to interfere with it. In short, this Tribunal cannot provide a remedy to the applicant.

None of what is said above should be treated as the Tribunal having formed a view as to the merits of the ICO’s decision (outcome) not to take further regulatory action in relation to the DVLA. This is not a matter which is relevant to the instant application.