Christopher Hart v Information Commissioner

The Applicant made a data handling complaint to the Respondent on 12^th September 2024 and received an outcome decision from the Respondent on 10^th October 2024. The Applicant made an application dated 18^th November 2024 and received by the Tribunal on 19^th November for an order under section 166 of the Data Protection Act 2018. The Tribunal received some documents from the Applicant before that date but without the required GRC 1 appeal application form to set out what he was applying for.

Having seen the original complaint, it runs to 63 pages with the exhibited correspondence. He complains about access to his online health records and the criminal intent not to allow him access. He includes headings for other complaints but gave no detail and at page 11 confirmed that his renewed complaint only covered the denial of access to his medical records online. It was clear from his correspondence that there was quite a history between the Applicant and the data processor that had also involved the ICO at times.

The application form confirmed that the Applicant was making an application under section 166 of the Data Protection Act 2018 which can be made in circumstances “where the ICO fails to take appropriate procedural steps to respond to the complaint…” He sought an order that the ICO comply with section 166, and asked that the Tribunal give further consideration to the Human Rights element associated with his case and how it affected him as a disabled vulnerable adult.

The 34 page separate grounds of appeal were headed “appeal grounds against the ICO decision” and confirmed that he had made a number of complaints to the ICO and was challenging the procedural steps taken by the ICO in its statutory function, in its investigative process and how it communicated those steps in the outcome decision. He said that his complaint was in regard to his sensitive medical data being shared between medical care providers and how his confidential information had not been safeguarded. He described the events as a conspiracy that had led to attempts to deprive him of his liberty based on fraudulent assessments that had been shared. He contended that the ICO was well aware of his repeated complaints and had failed to take “appropriate steps” in the investigation. He submitted that there had been a procedural failure not to establish the facts and assess the explanation given by the data handler. He challenged the response by the data handler and the ICOs acceptance of their position. He set out in some detail his challenge to the position of the data handler and the ICO. He aligned himself with the case of EW in Killock where an order to progress was made.

The ICO responded on 13^th December 2024 and invited the Tribunal to strike out the Applicant’s application. The response identified that senior judges had confirmed that the ICO had a wide discretion to deal with complaints as an expert Regulator. It was for the ICO to conduct their investigation and it is not the function of the Tribunal to substitute its own view for that of the Regulator absent a good reason.

The chronology provided by the ICO confirmed that the ICO made some enquiries with the data handler and confirmed that online access to his medical data was not available due to the inability to redact third party data but that the surgery offered to provide the Applicant with copies in paper format or electronic format. This was conveyed to the Applicant. The Applicant was unhappy with the outcome and asked for an internal review which was undertaken and confirmed the original outcome.

The Applicant was asked to respond to the strike out application which he did within a 32 page document dated 16^th January 2025. There was reference to initial directions made and non-compliance by the ICO. This appeal/application was miscategorised as the Applicant failed to file a GRC 1 application when he sent in his documents and so the wrong standard directions were issued by the Tribunal. The ICO was correct in identifying that the wrong directions had been issued. Due to the workload of the Tribunal, that had not been actioned.

The Applicant referred to the ICO attempting to mislead the Tribunal about the nature of the Applicant’s case – he was not challenging the outcome but he appropriateness of the steps taken in the investigation. To that end, he considered the ICO was in contempt. He said that the ICO had committed a procedural violation by not advising him of his right to make an application under section 166. He submitted that the Tribunal could deal with procedural failures. The Tribunal had to look at the underlying merits of any complaint as part of the procedural focus under section 166. He cites an CJEU ruling (without providing a copy) but omits to recognise that CJEU decisions are no longer binding following Brexit. He submits that the ICO is bound to provide information at how it arrived at the decision he did. It is unclear what the Applicant says is missing noting the nature of the original complaint. He was advised why he could not have online access and an alternate solution was provided. He submitted that the Tribunal need not disregard the objective standard to which an investigation should be conducted. He said the case of EW in Killock closely matched his case. The Tribunal had jurisdiction to consider his application with a focus on the ICO’s policies and procedures. The ICO was required to obtain a documented decision from the data handler and did not do so.

He submitted that the Tribunal had jurisdiction to order the Respondent to re-issue its outcome to the extent that the first outcome was procedurally flawed.

Under s166(2), the Tribunal is given power to order the ICO to “take appropriate steps to respond to the complaint”.

Upper Tribunal Judge Wikeley in Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC) at para 31 described section 166 applications as – “the mischiefs identified by section 166(1) are all procedural failings. “Appropriate steps” mean just that, and not an “appropriate outcome”. Likewise, the FTT’s powers include making an order that the Commissioner “take appropriate steps to respond to the complaint”, and not to “take appropriate steps to resolve the complaint”, least of all to resolve the matter to the satisfaction of the complainant.”

The remit of section 166 orders was reconsidered by the Upper Tribunal in Killock v Information Commissioner [2021] UKUT 299. One of the difficulties with this judgment is that read literally the judgment of Farbey J at paras 83 to 86 may lead the reader to believe that the Tribunal can specify what appropriate steps the Commissioner should take to deal with a complaint.

But at paragraph 87 some important clarification is given –

“Moreover, s.166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question. We do not rule out circumstances in which a complainant, having received an outcome to his or her complaint under s.165(b), may ask the Tribunal to wind back the clock and to make an order for an appropriate step to be taken in response to the complaint under s.166(2)(a). However, should that happen, the Tribunal will cast a critical eye to assure itself that the complainant is not using the s.166 process to achieve a different complaint outcome.”

The only reason why EWs case was treated differently is that it was conceded that the complaint had been rejected by the Commissioner and not investigated at all due to a misinterpretation of the ICO’s policies. At para 116 Farbey J explained that – “As we have explained above, s.166 is a procedural, not a substantive, remedy which provides for a right of appeal to the Tribunal on process, where the Commissioner fails to address a complaint under s.165 DPA 2018 in a procedurally proper fashion. However, as we have concluded above, the appropriateness of the investigative steps taken by the Commissioner is an objective matter which is within the jurisdiction of the Tribunal and is not something solely within the remit of the Commissioner to determine for herself. In our judgment, by misconstruing and misapplying her own Service Standards, and thereby simply declining to investigate the complaints at all, the Commissioner did not take such steps as were appropriate to respond to the complaints.”

The case of Killock highlights that the outcome may result in a decision to take no action. The outcome is not necessarily a determination of a breach of GDPR and action on a breach. The complaint may remain on record or advice given. The ICO has a broad discretion both in terms of investigation and outcome.

The issue was further considered by the High Court and then by the Court of Appeal in the case of Delo v Information Commissioner [2023] EWCA Civ 1141.

At paragraph 94 of the Court of Appeal’s decision in Delo – “I do not accept Mr Delo’s argument that the Commissioner is obliged to operate the complaints regime as a cost-free alternative to a claim under Article 79. The Commissioner has a discretion. The funding obligation enshrined in Recital 120 is not to be read as a blank cheque, or as authorising unnecessary or wasteful regulatory action. It must be legitimate for the Commissioner, when deciding how to deploy the available resources, to take account not only of his own view of the likely outcome of further investigation and the likely merits, but also of any alternative methods of enforcement that are available to the data subject.” That case definitively set out that the Commissioner does not have to reach an outcome decision on the details of the complaint and that he may decide how to investigate the merits of the complaint. The Court of Appeal is a higher authority than the Upper Tribunal in the event of any conflict between decisions.

The issue was revisited in Cortes v information Commissioner [2023] UA-2023-001298 by UTJ Wikeley where he helpfully summarised the authoritative cases of Killock and Delo. At para 31 Judge Wikeley responded to the submission that section 166 in effect enabled an Applicant to challenge whether the Commissioner had investigated the subject matter of the complaint to the extent appropriate and thus as a potential failure to take appropriate steps to respond to the complaint. In response, UTJ Wikleley said “But this is just another example of the “sleight of hand” identified by Mostyn J in R (on the application of Delo); it is an attempt to clothe a merits-based outcome decision with the garments of procedural failings. If the FTT were to order the Commissioner under section 166 to take further alternative steps, in the absence of quite exceptional circumstances such as those in EW v IC, then the outcome of the complaint would necessarily be subject to an impermissible collateral challenge – a challenge that the case law confirms beyond any doubt could only be launched by way of a judicial review.”

At para 32 of Mostyn J’s decision in Delo he acknowledged the very wide scope of the Commissioner’s discretion to handle complaints under section 166 as he thinks best. Indeed, it extended as far as permitting the Commissioner to take no further action on even a non-spurious complaint, a finding echoed by the Court of Appeal. He was clear that the Commissioner had handled the Appellant’s complaint albeit the Appellant was not satisfied with the outcome. He said that the purpose of section 166 is also evident from its heading – it provides for “Orders to progress complaints”, not for “Orders to re-open or re-investigate complaints”. As his complaint had been progressed to an outcome, and so there was no longer any scope for a section 166 order to bite. As Mostyn J held, section 166 “by its terms applies only where the claim is pending and has not reached the outcome stage and the Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question”

What the consistent case-law advises is that there will be rare cases where the Tribunal, other than in a delayed and pending investigation of a complaint, may make an order to progress in cases, for example, where the Commissioner has declined to accept the complaint in circumstances where it should be accepted. There is some minor dispute whether that is a power exercisable by the First Tier Tribunal or by judicial review. The jurisprudence is absolutely clear about the broad discretion of the Commissioner as to the nature of the investigation and range of outcome actions at his disposal. This Tribunal has no power to supervise the Commissioner or review the appropriateness of an investigation.

It is clear from the documents that the Commissioner accepted Mr Hart’s complaint, spoke to the data handler and decided to recommend an alternate solution to provide Mr Hart with the information he needed in a way that the data handler could provide. Mr Hart believes the Commissioner should have done more, albeit has not specified what else the Commissioner should have done. The Appellant has conflated his complaint with other complaints that he has previously made which he appeared equally dissatisfied about. Whilst it is unfortunate that Mr Hart is unhappy with the outcome, Mr Hart’s case is very different to that of EW who had not had a complaint accepted or investigated at all.

On any objective examination, the Appellant is seeking to re-open the investigation to obtain a different outcome, whether or not that is explicitly stated and that is also outside of this Tribunals’ jurisdiction. There is no realistic prospect of him being successful.

Mr Hart mentions in his response that he wishes to certify a contempt of court against the Commissioner on the basis that the Commission has misled the Tribunal about the basis of the appeal. Mr Hart has not lodged any such application which would need to be on the correct application in any event but it was clear from the Commissioner’s response that in effect Mr Hart was challenging the outcome. He wanted a different investigation and for it to lead to a different outcome; otherwise why would he challenge the investigation. There was no misrepresentation of his case in my judgment and no basis for any allegation of contempt. The Respondent dealt with all the issues thoroughly in the response document.

The Tribunal has considered the documents lodged in the appeal and respective submissions on the strike out application. The Appellant’s application was made after an investigation that led to an outcome. The Tribunal had no basis to consider his application on the basis that his complaint had been considered and responded to, and additionally his application was bound to fail.

Accordingly, the application is struck out under Rule 8(2)(a) and 8(3)(c).