Christopher Hart v The Information Commissioner

The Tribunal issued a stay of proceedings at the request of the Appellant due to ill-health on 10^th January 2024. This followed on from previous stays for the same reason. The stay expired on 29^th February 2024.

No application was made to lift to stay and the stay lapsed. The Appellant confirmed on 6^th March 2024 that he was not making an application to lift the stay.

The Order dated 23^rd December 2024 did not make any decisions on the Appellant’s appeals/applications but confirmed that the stay had lapsed and no application had been made to lift the stay. The Order was issued to confirm administratively that the appeals had lapsed due to inactivity/being abandoned.

The Appellant has made an application dated 26^th December 2024 to reinstate his appeals/applications indicating that he believed the stay ended in February 2024 and that he wished for his cases to be active again.

The Tribunal has applied the overriding objective to the application and has reviewed each application/appeal individually.

Where separate directions are made that require the action from parties, they will be replicated in a separate Order to assist the Appellant. A summary will be provided in this Order. The Tribunal apologises about the length of this document but the Appellant has many appeals and applications to be considered.

The following appeals EA.2018.0239.GDPR, EA.2018.0240.GDPR, EA.2019.0022.GDPR, EA.2019.0023.GDPR, EA.2019.0033.GDPR, EA.2021.0130.GDPR, EA.2022.0206.GDPR and EA.2022.0420.GDPR are not reinstated and will be struck out under Rule 8(2)(a).

Appeal EA.2021.0144 is not reinstated and will be struck out.

The following appeals EA.2023.0083 and EA.2023.0251 are reinstated. Case management directions are provided in a separate document.

The Appellant has an appeal FT/EA/2024/0424 which is listed for hearing on 9^th April 2025 by CVP but also has a pending strike out application to be considered. A summary Order has been issued to confirm directions already given. That application will be reviewed on 20^th January 2025.

The application for a review of the Order dated 8^th June 2023 in case number EA.2023.0057 is refused.

The Appellant’s appeals and applications were stayed between 7^th September 2023 until 29^th February 2024 due to his ill-health. The Appellant emailed the Tribunal on 28^th February to update the Tribunal regarding his health. He did not clarify his position regarding the stay or the progress of his cases. On the 6^th March 2023 the Appellant emailed the ICO’s office and said that “I have not sought to make a further application to extend the stay at this time.” That email was sent to the Tribunal.

The Appellant was not in contact with the Tribunal between April 2024 and December 2024 in regard to his stayed appeals, the perception of which was that the Appellant had abandoned his appeals. It appears that the Tribunal had issued a further appeal/application issued on 19^th November 2024 under case number FT/EA/2024/0424. A strike out application has been made in this case and is awaiting a response from the Appellant.

The Appellant has confirmed in his application that he sought for his applications and appeals to be reinstated; and a review of the outstanding cases has taken place. Whilst there are matters that can proceed, there are applications which are considered suitable to be struck out, either because an application has been made for strike out or because the Tribunal itself considers that they cannot proceed. Those matters are the appeals marked as GDPR.

Details of the outstanding GDPR cases that the Appellant sought to reinstate -

There is a widespread misunderstanding about the role of the Commissioner when handling data protection complaints. The Commissioner retains wide discretion as to whether to investigate and what steps should be taken. The Court of Appeal at paragraph 80 of R (Delo) v The Information Commissioner [2023] EWCA Civ 1141 described the remit of the Commissioner as follows:

“the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold,…. that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint.”

And at paragraph 94 –

“It must be legitimate for the Commissioner, when deciding how to deploy the available resources, to take account not only of his own view of the likely outcome of further investigation and the likely merits, but also of any alternative methods of enforcement that are available to the data subject.”

Scores of applicants apply for orders under section 166 which are in fact appeals against the outcome of the Commissioner’s outcome. They are often accompanied by long submissions, and even after strike out are followed by applications to review or even permissions to appeal. These applications utilise considerable resources of this Tribunal and the Commissioner. It is also the often the case, as it is here, that the same applicant makes repeated applications to the Tribunal despite having been provided with a comprehensive reasons previously why such an application cannot progress.

Even in cases where an outcome is yet to be provided at the time of the application, the application for an order to progress is often responded to by an outcome from the Commissioner, which is precisely what the process is designed to achieve – an outcome for the complainant.

The leading Upper Tribunal case on section 166 applications is Killock & others v Information Commissioner [2022] 1 WLR 2241. The High Court also considered similar issues in R (Delo) v Information Commissioner [2023] 1 WLR 1327 and the Court of Appeal considered that High Court decision in R (Delo) v The Information Commissioner [2023] EWCA Civ 1141.

More senior judges than the First Tier have consistently given guidance about applications under section 166 of the Data Protection Act 2018 which need not be set out in full here but the following core principles are that –

The Order sought is an order to progress a complaint; once a complaint has an outcome, the First Tier Tribunal cannot issue an order to progress a complaint which has concluded.

The First Tier Tribunal has no appellate jurisdiction to overturn or review the outcome of the Commissioner.

The Tribunal has no supervisory function over the investigation of the Commissioner. Judicial review is the correct application when appealing against the discretion of a public body.

The Tribunal has no separate power to investigate or order a remedy regarding data processing complaints. Complainants have a remedy under section 167 of the DPA 2018 to bring proceedings against the data controller.

There are judicial remedies in accordance with the GDPR which allows law makers to provide for the nature of those remedies. The remedies provided are in the High Court for judicial review of the Commissioner, civil action is available against the data processor in the County Court under section 167 of the DPA 2018 and there is a complaints procedure against the Commissioner in the Parliamentary and Health Service Ombudsman,

The Commissioner has six months to investigate the complaint. At the end of that six months, the applicant has 28 days to make an application for an order to progress.

Attempts to read into paragraph 83 and 84 of the Killock judgment a freestanding power for the First Tier Tribunal to oversee a concluded complaint by directing that further “appropriate steps” are taken is misconceived. Those paragraphs must be seen in the context of the discussion about when the First Tier Tribunal is empowered to make such an order which is when a complaint is pending.

Much reliance is asserted on paragraph 87 and the references to winding the clock back -

“Moreover, s.166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question. We do not rule out circumstances in which a complainant, having received an outcome to his or her complaint under s.165(b), may ask the Tribunal to wind back the clock and to make an order for an appropriate step to be taken in response to the complaint under s.166(2)(a). However, should that happen, the Tribunal will cast a critical eye to assure itself that the complainant is not using the s.166 process to achieve a different complaint outcome”.

The judgement is clear that it is not for the First Tier Tribunal to regulate the Commissioner but it could not be said that there would not be cases where the First Tier Tribunal could intervene. Such a case was identified in the judgment where the Commissioner refused to investigate at all by incorrect reliance on Service Standard. As paragraph 116 explains – “In our judgment, by misconstruing and misapplying her own Service Standards, and thereby simply declining to investigate the complaints at all, the Commissioner did not take such steps as were appropriate to respond to the complaints.” In Delo, it was suggested that judicial review was the appropriate remedy for a failure to accept a complaint is judicial review (paragraph 66). There is then a conflict between the UT in Killock who were acting as a first instance Tribunal and Delo as to whether it was the First Tier Tribunal or the Upper Tribunal in judicial review proceedings who could make an order for an investigation to take place when one had been refused. Respectfully, it is suggested that in the light of the broad discretion of the Commissioner to decide whether an investigation should in act be undertaken, that any direction over the exercise of that discretion is a matter for judicial review and not the First Tier Tribunal. The role of the First Tier Tribunal is limited to bringing a timely conclusion to an investigation where one has not been concluded.

The reference to “winding the clock back” must be seen in context as the judgment as a whole and the subsequent judicial dicta on the scope of section 166 applications that has clarified the remit of the Tribunal. For example Mostyn J in the High Court in R (Delo) v Information Commissioner [2023] 1 WLR 1327, paragraph 57 –

More recently in the Upper Tribunal in Cortes v Information Commissioner (UA-2023-001298-GDPA) which applied both Killock and Delo in confirming that the nature of section 166 is that of a limited procedural provision only.

“The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court)….As such, the fallacy in the Applicant’s central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation, and thereby launch a collateral attack on the outcome itself with the aim of the complaint decision being re-made with a different outcome. Such a scenario would be inconsistent with the purport of Article 78.2, the heading and text of section 166 and the thrust of the decisions and reasoning in both Killock and Veale and R (on the application of Delo). It would also make a nonsense of the jurisdictional demarcation line between the FTT under section 166 and the High Court on an application for judicial review.” (paragraph 33).

All of the Appellant’s applications fall foul of the above principles either because they are applications made alter an outcome, were made pending an outcome which has been provided or seek for the Tribunal to regulate the investigation and conclusion of the Commissioner. This Tribunal has a very limited power in data protection complaints to hurry them along, the Tribunal cannot entertain applications that it has no power to consider or make orders that it has no jurisdiction to do so. Consideration of such matter wastes the previous resources of the First Tier Tribunal and detracts from appeals and applications that require the attention of the Tribunal.

The Appellant has been given an opportunity to respond to the strike out application on a few occasions and has not persuaded the Tribunal that it has power to consider his applications. The Tribunal is able to consider striking out an application even though the Commissioner has not requested strike out as part of its case management functions. It is noted that some of these applications were made shortly after the 2018 came into effect; the Commissioner is much more adept now, and with the benefit of the case-law, to make timely applications for strike out in such cases.

The GDPR cases listed above are struck out on the basis that the Tribunal has no power to consider those applications. That is an Order that the First Tier Tribunal must make in these circumstances. As the applications cannot be properly made, there are not going to be successful. I additionally strike out the applications as having no reasonable prospect of success.

Other cases that the Appellant seeks to reinstate –

Other applications outstanding which are not part of the application to reinstate -

The Appellant is reminded that he remains subject to the case management orders issued for EA.2023.0083 (which includes EA.2023.0251) and FT/EA/2024/0424.

Any application to review or appeal these orders must be made within 28 days of receipt.