Case Reference: FT/EA/2024/0384/GDPR
Information Rights
Decided without a hearing
Before
JUDGE STEPHEN ROPER
Between
ARAM PANOSSIAN
Applicant
and
THE INFORMATION COMMISSIONER
Respondent
Decision: The application is struck out
REASONS
Preliminary matters
In this decision, I use the following terms to denote the meanings shown:
Applicant: | Aram Panossian. |
Application: | The Applicant’s application dated 23 September 2024 for an order by the Tribunal under section 166(2) in respect of the Complaint (see paragraph 15). |
Board: | NHS Bedfordshire, Luton and Milton Keynes Integrated Care Board. |
Commissioner: | The Information Commissioner (the Respondent). |
Complaint: | The Applicant’s complaint to the Commissioner, submitted via email dated 14 June 2024, concerning the Board’s handling of the Request. |
DPA: | |
Request: | The request made to the Board by the Applicant, dated 17 October 2022, as referred to in paragraph 11. |
Tribunal Rules: | The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009. |
UK GDPR: | The General Data Protection Regulation (EU) 2016/679, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018. |
Unless the context otherwise requires (or as otherwise expressly stated), references in this decision:
to numbered paragraphs are references to paragraphs of this decision so numbered;
to a section are references to the applicable section of the DPA; and
to a Rule are references to the applicable rule of the Tribunal Rules.
The Applicant has provided detailed information regarding his personal circumstances and needs, which I acknowledge and understand. I also confirm, with regard to a specific request made by the Applicant, that his address will not be not published in connection with the Application.
Nothing I say in this decision should be treated as the Tribunal’s view regarding the merits of the Commissioner’s decision (outcome) in respect of the Complaint. That is not a matter which is within the powers of the Tribunal to determine, for the reasons I refer to below.
Summary of this decision
This decision relates to the Applicant’s application for an order by the Tribunal under section 166(2) (see paragraph 15).
The Commissioner made an application to strike out the Application.
Pursuant to Rule 8(3)(c), the Tribunal may strike out proceedings if it considers that there is no reasonable prospect of a case succeeding.
Having considered the relevant evidence and submissions of the parties, I conclude that the Application should be struck out as having no reasonable prospect of success. I set out my reasons below.
The Complaint
The Applicant complained to the Commissioner in respect of the Board’s handling of the Request.
The Applicant stated in the Complaint that the information he requested by way of the Request was his personal data “as identified by reference to” his late father and his sister.
However, the Request actually asked for “copies of all health records held relating to my father” and was sent by email under the subject heading of “APPLICATION FOR ACCESS TO HEALTH RECORDS”.
In my view, the Applicant was therefore not seeking his own personal data but rather seeking the health records of his late father. Potentially this would mean that the Applicant had no valid basis to make the Complaint (or therefore the Application), as he was not the data subject for the purposes of the Request. However, (as I address below) given that the Commissioner dealt with the Complaint and provided an outcome to it, I have concluded that this issue is not material for current purposes.
The Application
The Application was made by the Applicant via form GRC3 (the correct form), dated 23 September 2024.
The Application stated that the Commissioner had failed to take appropriate steps to respond to the Complaint and had failed to provide the Applicant with information about progress on the Complaint, or of the outcome of the Complaint. The Application specifically referred to the Applicant seeking an order pursuant to section 166(2).
I therefore find that the Application was brought pursuant to section 166, seeking an order from the Tribunal pursuant to section 166(2). I also find that the Application was brought within time (see Rule 22(6)(f)).
The Tribunal’s powers and role
The relevant powers of the Tribunal are set out in section 166(2) (as supplemented by section 166(3)). In summary, the Tribunal is empoweredto make an order requiring the Commissioner either:
to take appropriate steps to respond to an applicable complaint; or
to inform the complainant of the progress on that complaint, or of the outcome of that complaint, within a period which the Tribunal may specify.
However, an application under section 166 permits the Tribunal to make any such order only if the Commissioner has failed in some procedural respect, as specified in section 166(1).
The relevant statutory framework (Footnote: 1)
The right of access for data subjects
Article 15 of the UK GDPR provides individuals with a general right of access to their personal data held by a data controller, including the right to be provided with a copy of their personal data which is being processed by the data controller.
The right to complain to the Commissioner
An individual (a ‘data subject’) has a right to make a complaint to the Commissioner if that individual considers that the processing of their personal data infringes the UK GDPR and/or Parts 3 or 4 of the DPA. Section 165 sets out the position as follows:
“(1) Articles 57(1)(f) and (2) and 77 of the UK GDPR (data subject's right to lodge a complaint) confer rights on data subjects to complain to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the UK GDPR.
(2) A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act.”.
So far as is relevant, section 165 then goes on to provide:
“(4) If the Commissioner receives a complaint under subsection (2), the Commissioner must—
(a) take appropriate steps to respond to the complaint,
(b) inform the complainant of the outcome of the complaint,
(c) inform the complainant of the rights under section 166, and
(d) if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.
(5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—
(a) investigating the subject matter of the complaint, to the extent appropriate, and
(b) informing the complainant about progress on the complaint...”.
In essence, therefore, section 165(4) requires the Commissioner to take appropriate steps, as well as the specified other actions, when he receives a relevant complaint from an individual. The appropriate steps which the Commissioner must take include (in summary) investigating the complaint and informing the individual about its progress.
The right to apply to the Tribunal
Section 166 provides individuals with a right to make an application to the Tribunal for an order requiring the Commissioner to take appropriate steps to respond to a relevant complaint, or to inform the individual of the progress on (or outcome of) the complaint, if the Commissioner has failed to take certain procedural actions in relation to it. So far as is relevant, section 166 provides:
“(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or
(c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner—
(a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a period specified in the order.”.
Discussion and findings
The nature and effect of section 166
I start by addressing the nature and effect of section 166. The Commissioner, in his response to the Application (and his associated strike-out application), referred to various authorities from case law in that regard (in decisions of the Upper Tribunal, the High Court and the Court of Appeal). It is not necessary for me to refer to that case law again in this decision, but I accept the relevance to the Application of the various authorities which the Commissioner referred to.
I consider that it is appropriate, though, to briefly summarise the legal position based on those authorities. In essence (and so far as is relevant for current purposes) the following are the relevant legal principles.
An application under section 166:
is not concerned with the merits of the relevant complaint; and
does not provide a right of challenge to the substantive outcome of the Commissioner’s investigation into that complaint.
In other words, an application under section 166 does not address the merits or substance of a complaint but rather is merely procedural in nature: it is concerned only with procedural actions which the Commissioner is required to take in respect of the complaint.
The test (in section 166(1)(a)) as to whether the Commissioner has failed “to take appropriate steps to respond to the complaint” is exactly as it says – namely “appropriate steps” and not an ‘appropriate outcome’ (or similar). Likewise, the Tribunal’s powers where the Commissioner has failed to take appropriate steps include making an order that the Commissioner must “take appropriate steps to respond to the complaint” (and not to ‘take appropriate steps to resolve the complaint’).
The Commissioner’s strike-out application
The Commissioner applied for the Application to be struck out pursuant to Rule 8(2)(a) or Rule 8(3)(c) on the grounds that either the Tribunal had no jurisdiction to consider the Application or that the Application had no reasonable prospect of success.
Given my finding that the Application was made pursuant to section 166, seeking an order from the Tribunal pursuant to section 166(2), it follows that I must reject the Commissioner’s argument (in respect of the first ground) that the Tribunal had no jurisdiction to determine the matters before it.
In respect of the second ground, the Commissioner argued that the Application had no reasonable prospect of success, on the basis that an outcome to the Complaint has been provided by the Commissioner and consequently an order could not be made by the Tribunal under section 166(2).
Case law has established the principles to be followed by the Tribunal when considering whether to strike out a case as having no reasonable prospect of success. In essence, the Tribunal must consider whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance), prospect of the case succeeding at a full hearing.
Was there a procedural failing by the Commissioner?
As I have noted, section 166 is concerned with providing a remedy for any procedural failings on the part of the Commissioner after a complaint is made to him (not the merits of the complaint or its outcome). The Tribunal may only make an order under section 166(2) only if the Commissioner has failed in some procedural respect.
Based on the evidence and submissions before me, there had been some procedural failings on the part of the Commissioner in respect of the Complaint at the time of the Application. In particular, at the time of the Application (which was more than three months after the date of the Complaint), there was no response from the Commissioner to the Complaint.
However, the Commissioner subsequently did deal with the Complaint. The Commissioner stated in his response to the Application (and his associated strike-out application) that he provided the Applicant with an outcome to the Complaint on 15 October 2024. This was supported by evidence and I therefore find that the Commissioner did investigate the Complaint and provide the Applicant with an outcome to it.
Given that the Commissioner subsequently investigated the Complaint and responded to it (providing an outcome to it), it is not open to the Tribunal to make an order under section 166(2). This is because, as I have outlined, the Tribunal’s powers (had the Application been successful) would only extend to making an order for the Commissioner to either take appropriate steps to respond to the Complaint, or to inform the Applicant of progress on (or the outcome of) the Complaint. Accordingly, the Commissioner has now done all that the Tribunal could have ordered him to do.
For the above reasons, I find that the Commissioner has taken appropriate steps to respond to the Complaint and has provided the Applicant with information about the outcome of the Complaint. It is important to reiterate that, for the purposes of section 166, it is not the merits or substance of the Complaint which is relevant but rather only the procedural actions which the Commissioner is required to take in respect of it.
Final conclusions
For the reasons I have given, I find that there is no basis for the Tribunal to make an order under section 166(2). The proceedings are therefore struck out under Rule 8(3)(c) as there is no reasonable prospect of the Applicant’s case succeeding.
Signed: Stephen Roper Date: 20 May 2025
Judge of the First-tier Tribunal