Olufunke Osifeso v The Information Commissioner

This appeal concerns the role and powers of the First-tier Tribunal on an application made under section 166 of the Data Protection Act 2018.

The procedural history of this appeal is not in dispute and so can be dealt with in short order. On 1 July 2019, and then again on 9 December 2019, Ms Osifeso made complaints to the Information Commissioner about how the Royal Bank of Scotland (RBS) had handled her personal data. Dissatisfied with the Information Commissioner’s response, she then applied to the General Regulatory Chamber (GRC) of the First-tier Tribunal under section 166 of the Data Protection Act (DPA) 2018. On 31 January 2020 a GRC registrar struck out Ms Osifeso’s application on the basis that it had no reasonable prospect of success. Ms Osifeso applied for the matter to be considered afresh by a Judge. On 20 February 2020 Judge Macmillan carried out that reconsideration but reaffirmed the strike out ruling imposed by the GRC registrar. She also refused permission to appeal to the Upper Tribunal on 30 March 2020.

Ms Osifeso then applied to the Upper Tribunal for permission to appeal, which was granted by Upper Tribunal Judge Gray in a ruling dated 24 August 2020. Ms Osifeso’s further appeal was subsequently stayed pending the outcome of the proceedings before the three-judge panel (Footnote: ¹) of the Upper Tribunal in Killock and Veale v Information Commissioner; EW v Information Commissioner; Coghlan (on behalf of C) v Information Commissioner [2021] UKUT 299 (AAC), [2022] 1 WLR 2241 (referred to in this decision simply as ‘Killock and Veale v IC’). Both parties have since had the opportunity to make further written submissions in the light of the decision in Killock and Veale v IC. Neither party has requested an oral hearing. I am also satisfied it is fair and just to deal with this appeal on the papers, not least given the quality of those written submissions.

It is instructive to trace the legislative framework from the Recitals of the General Data Protection Regulation (GDPR), through the relevant Article in the GDPR, and finally to the corresponding section of the DPA 2018. The key legislative provisions are as follows (for more detail see paragraphs 42-60 of the decision in Killock and Veale v IC).

Recital 141 of the GDPR (so far as material) states:

Article 77(1) of the GDPR gives every data subject the right to complain to a supervisory authority (in the domestic context, the Information Commissioner) if they consider that the processing of their personal data infringes their GDPR rights. The relevant provisions of section 165 of the DPA 2018 accordingly provide as follows (or at least they did before the amendments made with effect from December 31, 2020, by  the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (SI 2019/419), but which matter not for present purposes and so are omitted):

What then if the Information Commissioner fails to act in some way? By Recital 143 (so far as material) it is provided that:

Accordingly, Article 78(2) of the GDPR further provides data subjects with the right to an “effective judicial remedy” if the supervisory authority (here the Information Commissioner) does not take appropriate steps to respond to the complaint:

The rights contained in Article 78(2) are given effect to by section 166 of the DPA 2018 (again, in its original terms):

Having set out the terms of section 166, the First-tier Tribunal concluded as follows:

Judge Macmillan accordingly reaffirmed the strike out decision made by the GRC registrar.

In the grant of permission to appeal, Upper Tribunal Judge Gray neatly summarised both the Appellant’s case and the issue raised by her appeal as follows:

Judge Gray further analysed the central issue in the following terms:

The Upper Tribunal’s decision in Killock and Veale v IC was handed down on 24 November 2021. The panel’s analysis of the scope of section 166 began as follows:

In the passage that then followed this extract (paragraphs 78-82), the Upper Tribunal reviewed various arguments based on EU law, which are not material for present purposes. The panel then returned to analyse the respective roles of the Information Commissioner and the First-tier Tribunal in section 166 cases (at paragraphs 83-88; Ms Lester QC appeared for Messrs Killock and Veale, Mr Black for Mrs Coghlan and Mr Milford QC for the Information Commissioner):

Ms Osifeso also drew my attention to paragraph 116 of the Upper Tribunal’s decision, where the panel summarised its approach as follows:

In her notice of appeal, the Appellant set out her position as follows (in summary). She argued that the Information Commissioner had failed to take appropriate steps to respond to her complaint (DPA 2018, section 166(1)(a)) by failing to investigate the subject matter of her complaint to the extent appropriate (DPA 2018, section 165(5)). She denied that she was challenging the Information Commissioner’s substantive response to her complaint. The effect of paragraph 14 of the First-tier Tribunal’s decision (see paragraph 10 above) was wrong in law in that it meant that once the Information Commissioner had provided a letter of response, then his investigatory duty had been automatically satisfied under section 165(5). Furthermore, paragraph 15 of the decision was wrong in law as the decision to determine to what extent it is appropriate to investigate any complaint lies with the First-tier Tribunal (DPA 2018, section 166(2)(a) and (4)), and not with the Information Commissioner.

The Information Commissioner resists the appeal, setting out his submissions in a written response drafted by Ms Harini Iyengar of Counsel, supplemented by a shorter supplementary response, prepared by the Information Commissioner’s in-house Legal Services team and dealing with the effect of the decision in Killock and Veale v IC. Ms Iyengar’s core submission was that there was no error of law in the decision by Judge Macmillan, as the Appellant’s section 166 claim had no reasonable prospect of success. This was because the Information Commissioner had handled her complaint(s) promptly, had taken appropriate steps, and had informed Ms Osifeso of the progress and outcome of her complaint(s), as well as notifying her of her rights to make an application under section 166. The true position, Ms Iyengar submitted, was that the Appellant’s real complaint was about what she believed was a substantive breach of her data protection rights. Any further remedies lay by way of proceedings in the county court or High Court (under section 167 of the DPA 2018) and not via section 166 in the First-tier Tribunal.

In his supplementary written submission, the Information Commissioner submitted that Killock and Veale v IC reaffirmed the strictly procedural focus of section 166 (see paragraph 74 of the Upper Tribunal’s decision). Furthermore, the Upper Tribunal stated that when considering the appropriateness of steps carried out by the Information Commissioner in relation to a complaint, a tribunal will be bound to give weight to the views of the Commissioner as an expert regulator (paragraphs 76 and 85). Thus, section 166(1) of the DPA 2018 is concerned with procedural failings (i.e. the failure of the Commissioner to give appropriate, timely and transparent consideration to the complaint), and not the merits of a complaint or its outcome (paragraphs 74 - 75 and 87 – 88). The Information Commissioner also referred to my ruling refusing permission to appeal in Kanter-Webber v Information Commissioner (GIA/928/2021, unreported), where I stated that “The question is not simply what is meant by the ordinary English word ‘investigate’. Rather, it is what is meant by the whole phrase ‘investigating the subject matter of the complaint, to the extent appropriate’. The expression ‘to the extent appropriate’ necessarily qualifies the verb ‘investigating’….Depending on the circumstances, it may well be that reading the complaint may be sufficient in and of itself to establish that no further investigatory action is needed.”

In reply, Ms Osifeso argues that the decision in Killock and Veale v IC supports her own appeal for the following reasons. First, the appeal is concerned with a ‘procedural’ failing under section 166(1)(a) in that the Information Commissioner failed to take appropriate steps to respond to the complaint by failing to investigate the subject matter of the complaint to the extent appropriate (section 165(5)) (see paragraphs 74 and 75). Second, the Information Commissioner cannot determine for himself the “appropriateness of the investigative steps taken” by exercising a “regulatory judgement”: (see paragraphs 84, 85 and 116). Third, the Upper Tribunal stated that the First-tier Tribunal will “cast a critical eye to assure itself that” the appeal for “…an order for an appropriate step to be taken in response to the complaint under s.166(2)(a)” is not being used “…to achieve a different complaint outcome”, notwithstanding (a) the “forward looking nature” of section 166 and (b) the provision of an outcome by the Commissioner (paragraph 87).

The proper scope and import of section 166 of the DPA 2018 is now much clearer as a result of the Upper Tribunal’s authoritative decision in Killock and Veale v IC. First and foremost, the section is concerned with providing a remedy for procedural failings on the part of the Information Commissioner. Thus, “on an application under s.166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome” (paragraph 74). This is, of course, entirely consistent with the language used in Article 78(2) of the GDPR – the right to an effective judicial remedy arises where the relevant supervisory authority “does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77”. In effect, the test for whether the Information Commissioner “does not handle a complaint” is if he “fails to take appropriate steps to respond to the complaint” (section 166(1)(a)). If he has so failed, then the First-tier Tribunal may make an order requiring the Commissioner “to take appropriate steps to respond to the complaint” (section 166(2)(a)). Taking appropriate steps in response to a complaint includes “investigating the subject matter of the complaint, to the extent appropriate” (section 165(5)(a)).

In considering an application under section 166, the First-tier Tribunal must bear in mind that the Information Commissioner is “the expert regulator” and “is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome” (paragraph 76). However, this does not mean that the Tribunal surrenders its judicial task to the Commissioner – thus, the Commissioner’s view carries weight but is not decisive (see paragraphs 84 and 85). As such, “where it is established that the Commissioner has exercised a regulatory judgment, the Tribunal will need good reason to interfere (which may in turn depend on the degree of regulatory judgment involved) and cannot simply substitute its own view” (paragraph 86). An example where the Commissioner’s view did not prevail was in EW v Information Commissioner, heard alongside Killock and Veale v IC, where the Commissioner misconstrued and misapplied the ICO’s own Service Standards, leading to a refusal to investigate the data subject’s complaints at all (see paragraph 116). In those circumstances, the Commissioner had not taken such steps as were appropriate to respond to EW’s complaints. Such an approach is consistent with Recital 143, which declares that courts (and so tribunals) “exercise full jurisdiction, which should include jurisdiction to examine all questions of fact and law relevant to the dispute before them”. To the same effect, Killock and Veale v IC shows that tribunals are not confined to a narrow judicial review approach (paragraph 84). To sum up, the degree of judicial oversight appropriate for section 166 applications could be described as relatively light touch but not hands-off.

The question then is whether the First-tier Tribunal’s decision is in accord with those principles. The core passage in its reasoning is set out in paragraphs 12-15 of its decision (see paragraph 10 above). Judge Macmillan, of course, did not have the benefit of having before her the principles and guidance as laid down by the Upper Tribunal in Killock and Veale v IC. The First-tier Tribunal’s reasoning is also undoubtedly compressed, but that reflects in part the absence of previous authority (the permission ruling in Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC), the first occasion on which the Upper Tribunal had given any consideration to section 166, was not published until 19 February 2020, literally the day before Judge Macmillan’s decision, and so was unlikely to have been before her). There is, in any event, no challenge based on the adequacy of the Tribunal’s reasoning.

For the following reasons I find that the decision of the First-tier Tribunal does not involve any material error of law. Paragraph 12 of the decision is simply an explanation or paraphrase of what is meant by “appropriate steps” by reference to the terms of sections 165 and 166. Paragraph 13 of the decision accurately summarises the circumstances in which the First-tier Tribunal can make an order under section 166(1) – merely describing the first such instance as where the Information Commissioner “has failed to respond to a complaint”, rather than “has failed to take appropriate steps to respond to a complaint”, is not an error of law, given that the passage is just a summary. Paragraph 14 is no more than a factual statement as to the outcome of the complaints and was plainly a conclusion that was open to the Tribunal to reach.

Paragraph 15 of the First-tier Tribunal’s decision is the one passage which is arguably closest to disclosing a possible error of law. For convenience it is repeated here:

There can be no quibbling with the description in this paragraph of the Tribunal’s powers under section 166. For example, “requiring the Commissioner to consider a complaint” is no more than convenient shorthand for “requiring the Commissioner to take appropriate steps to respond to the complaint”. Furthermore, the observation that the section 166(2) orders “do not relate to the outcome of a complaint, but rather to the Commissioner taking some action in order to reach an outcome” is entirely consistent with the principles expounded in Killock and Veale v IC.

The potentially problematic statement in this passage is that “it is for the Commissioner as regulator to determine to what extent it is appropriate to investigate any complaint”. On a narrow reading, this statement could be construed as meaning that the Information Commissioner has the sole power to determine the degree to which it is appropriate to investigate any complaint. If so, that would amount to an error of law, given Killock and Veale v IC. However, this does involve reading the statement as being “it is exclusively for the Commissioner as regulator to determine to what extent it is appropriate to investigate any complaint”.

It is important to remember that this is not an exercise in statutory construction but rather the interpretation of a first instance tribunal decision written under time pressures. As Lord Hope observed in R (on the application of Jones) v First-tier Tribunal [2013] UKSC 19, [2013] 2 AC 48, “it is well established, as an aspect of tribunal law and practice, that judicial restraint should be exercised when the reasons that a tribunal gives for its decision are being examined. The appellate court should not assume too readily that the tribunal misdirected itself just because not every step in its reasoning is fully set out in it” (at paragraph 25). It follows that appellate courts and tribunals must be careful not to seize on a particular phrase or passage and take it out of context. As the Court of Appeal held in Re F (Children) [2016] EWCA Civ 546 (at paragraph [23]):

“It is not the function of an appellate court to strive by tortuous mental gymnastics to find error in the decision under review when in truth there has been none. The concern of the court ought to be substance not semantics. To adopt Lord Hoffmann’s phrase, the court must be wary of becoming embroiled in ‘narrow textual analysis’.”

Applying that more contextual approach, the First-tier Tribunal’s statement can be read just as no more or less than a statement about institutional competence – it is for the Information Commissioner as expert regulator to decide what amounts to appropriate steps in handling any given complaint. As such, it chimes with Killock and Veale v IC. Indeed, there could have been no complaint whatsoever if the statement that “it is for the Commissioner as regulator to determine to what extent it is appropriate to investigate any complaint” had been preceded by the phrase “in the first instance” or even by the single word “initially”. The inclusion of that one word might have been optimal, but its omission does not amount to a material error of law. Reading the First-tier Tribunal’s decision as a whole, it is implicit that the Tribunal accepted that the Commissioner had investigated the subject matter of the complaint to the extent appropriate. For example, the Tribunal acknowledged that the Information Commissioner had concluded that RBS had complied with its legal obligations, and that finding was referred to without any adverse comment (paragraphs 4 and 14).

If I am wrong about this, and the First-tier Tribunal’s decision does involve an error of law, I would as a matter of discretion decline to set its decision aside in any event. This is because on the facts the Tribunal came to the only decision that was realistically available to it. Ms Osifeso had lodged her complaint with the ICO on 1 July 2019. But as the Information Commissioner’s response to the original section 166 application explained (at paragraph 13):

Ms Osifeso may disagree with the substance of that outcome, but that is not in point for the purposes of section 166. Given that background, it is evident that the Information Commissioner complied with his statutory duties in this case in that he (i) handled the Appellant’s complaint promptly, (ii) took appropriate steps to investigate the complaint to the extent appropriate in the circumstances, and (iii) informed the Appellant of the outcome of the complaint. As such, the section 166 application had no reasonable prospect of success and so the strike out decision was justified.

The reality, despite the Appellant’s protestations, is that she is seeking to challenge the substantive outcome of the Information Commissioner’s handling of her complaint and/or RBS’s approach to her data protection rights, which she argues have been breached. As to the former, “any attempt by a party to divert a Tribunal from the procedural failings listed in s.166 towards a decision on the merits of the complaint must be firmly resisted by Tribunals” (Killock and Veale v IC at paragraph 74) – any remedy must be pursued in the High Court by way of judicial review. As to the latter, any remedy against a data controller or data processor lies in the county court or High Court (section 167 of the DPA 2018).

It follows that I must dismiss this appeal.

Notwithstanding that outcome, which I appreciate will be disappointing for the Appellant, I should put on record my agreement with Upper Tribunal Judge Gray’s observation about the quality of Ms Osifeso’s written submissions. They have been drafted with both a careful attention to relevance and a clarity, crispness and economy of style which is singularly impressive.