View source for First-tier Tribunal - Miles v Information Commissioner

{{COURTdecisionBOX

|Jurisdiction=United Kingdom
|Court-BG-Color=
|Courtlogo=Courts_logo1.png
|Court_Abbrevation=GRC
|Court_Original_Name=First-tier Tribunal (General Regulatory Chamber)
|Court_English_Name=First-tier Tribunal (General Regulatory Chamber)
|Court_With_Country=First-tier Tribunal (General Regulatory Chamber)

|Case_Number_Name=Miles v Information Commissioner
|ECLI=

|Original_Source_Name_1=Bailii
|Original_Source_Link_1=https://www.bailii.org/cgi-bin/format.cgi?doc=/uk/cases/UKFTT/GRC/2023/955.html&query=(GDPR)
|Original_Source_Language_1=English
|Original_Source_Language__Code_1=EN
|Original_Source_Name_2=
|Original_Source_Link_2=
|Original_Source_Language_2=
|Original_Source_Language__Code_2=

|Date_Decided=10.11.2023
|Date_Published=
|Year=2023

|GDPR_Article_1=
|GDPR_Article_Link_1=
|GDPR_Article_2=
|GDPR_Article_Link_2=

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|National_Law_Name_1=Section 165(2), DPA
|National_Law_Link_1=https://www.legislation.gov.uk/ukpga/2018/12/section/165/enacted
|National_Law_Name_2=Section 166, DPA
|National_Law_Link_2=https://www.legislation.gov.uk/ukpga/2018/12/section/166/enacted
|National_Law_Name_3=
|National_Law_Link_3=
|National_Law_Name_4=
|National_Law_Link_4=

|Party_Name_1=David Miles
|Party_Link_1=
|Party_Name_2=The Information Commissioner
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=
|Party_Name_4=
|Party_Link_4=

|Appeal_From_Body=
|Appeal_From_Case_Number_Name=
|Appeal_From_Status=
|Appeal_From_Link=
|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=Not appealed
|Appeal_To_Link=

|Initial_Contributor=Gazal Gupta
|
}}

The decision highlights the Tribunal's role in assessing the appropriateness of the Information Commissioner's actions in response to complaints, not the merits of the complaint itself.

== English Summary ==

=== Facts ===
In September 2021, David Miles submitted a subject access request (SAR) to Brentwood Ursuline Convent High School (BUCHS). Dissatisfied with their response, Miles complained to the Information Commissioner in February 2022. When no progress was made on his complaint, Miles applied to the Tribunal in March 2023, seeking a directive for a response from the Information Commissioner's Office (ICO). His application to the Tribunal was prompted by the lack of action from the ICO in addressing his complaint. Subsequently, the ICO communicated with BUCHS and reported back to Miles, asserting that appropriate steps had been taken. The application was filed to prompt action from the ICO, which had not effectively responded to his initial complaint about BUCHS's handling of his SAR.

=== Holding ===
The First-tier Tribunal (General Regulatory Chamber) struck out the application, finding no reasonable prospect of success for the appellant's case. The ruling emphasized that the Tribunal's role is not to judge the merits of the underlying complaint or the substantive outcome of the Commissioner’s investigation but to assess the appropriateness of the Commissioner's steps in response to a complaint. The Commissioner’s actions post-application were deemed appropriate, rendering the application unnecessary and disproportionate to continue.

== Comment ==
This ruling highlights the Tribunal's purview in examining the Information Commissioner's activities, emphasizing procedural appropriateness above the substantive merits of the complaints. It demonstrates the difficulties people encounter when attempting to file a complaint with the Tribunal about the ICO's handling of their data protection grievances. The case also highlights how the Data Protection Act of 2018 strikes a balance between individual rights to data protection and regulatory discretion.

== Further Resources ==
''Share blogs or news articles here!''

== English Machine Translation of the Decision ==
The decision below is a machine translation of the English original. Please refer to the English original for more details.

<pre>
[New search] [Context] [View without highlighting] [Printable PDF version] [Help]

Neutral Citation Number: [2023] UKFTT 955 (GRC)

Appeal Reference: EA/2023/0167

First-tier Tribunal
(General Regulatory Chamber)
Information Rights
Section 166 Data Protection Act 2018

Decided without a hearing
On 20 October 2023

Decision Given On: 10 November 2023

B e f o r e :

TRIBUNAL JUDGE HEALD
____________________

Between:

DAVID MILES
Applicant

- and -

THE INFORMATION COMMISSIONER
Respondent

____________________

____________________

HTML VERSION OF DECISION
____________________

Crown Copyright ©

DECISION

The application is struck out.

REASONS

Background

In September 2021 David Miles ("Mr Miles") made a subject access request ("SAR") to Brentwood Ursuline Convent High School ("BUCHS"). He was not satisfied with their reply and on 14 February 2022 made a complaint ("the Complaint") to the Information Commissioner ("the Commissioner") pursuant to section 165(2) Data Protection Act 2018 ("DPA").

The Complaint was not progressed by the Commissioner. On 17 March 2023 Mr Miles made an application ("the Application") to the Tribunal pursuant to section 166(2) DPA in which the outcome sought was "I would like the tribunal to direct a response from the ICO, please"

The Commissioner then took steps to progress the Complaint and on 24th March 2023 wrote to BUCHS and reported to Mr Miles.

The Commissioner provided its response to the Application on the 19 April 2023 ("the Response"). In it the Commissioner, while accepting there had been delay and apologising for it, said that it had now been in communication with BUCHS and that the steps taken were, in its view, appropriate.

The Commissioner, in the absence of the Application being withdrawn, has sought an Order that it be struck out pursuant to rule 8(3)(c) of the Tribunal Procedure (First -tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended) ("the 2009 Rules")

Strike out

Rule 8 of the 2009 Rules provides that: -

(3) The Tribunal may strike out the whole or a part of the proceedings if-

(c) the Tribunal considers there is no reasonable prospect of the appellant's case, or part of it, succeeding.

In HMRC -v- Fairford Group (in liquidation) and Fairford Partnership Group (in liquidation) [2014] UKUT 0329 the Upper Tribunal summarised the task to be conducted by a Tribunal in these circumstances: -

41..The Tribunal must consider whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance) prospect of succeeding on the issue at a full hearing..A 'realistic' prospect of success is one that carries some degree of conviction and not one that is merely arguable..The tribunal must avoid conducting a 'mini-trial'.

In AW-v-Information Commissioner and Blackpool CC [2013] 30 ACC the Upper Chamber set out the principles governing the application of rule 8(3)(c) of the 2009 Rules. These included: -

8. More recent rulings from the superior courts point to the need to look at the interests of justice as a whole .It is, moreover, plainly a decision which involves a balancing exercise and the exercise of a judicial discretion, taking into account in particular the requirements of rule 2 of the GRC Rules.

Rule 2 of the 2009 Rules provides that the overriding objective of the 2009 Rules is to enable the Tribunal to deal with cases fairly and justly. Rule 2(3) of the 2009 Rules provides that the Tribunal: - "must seek to give effect to the overriding objective when it- (a) exercises any power under these Rules; or (b) interprets any rule or practice direction."

As required by rule 8(4) of the 2009 Rules Mr Miles was notified of the Commissioner's application to seek a strike out of the Application. He was given until 3 October 2023 to respond but the does not appear to have done so.

Section 166 DPA

Section 166 DPA provides as follows: -

(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner-

(a) fails to take appropriate steps to respond to the complaint,

(b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or

(c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.

(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner-

(a) to take appropriate steps to respond to the complaint, or

(b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

(3) An order under subsection (2)(a) may require the Commissioner

(a) to take steps specified in the order.

(b) to conclude an investigation, or take a specified step, within a period specified in the order.

(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).

Relevant parts of sections 165(4) and (5) DPA provide: -

(4) If the Commissioner receives a complaint under subsection (2), the Commissioner must

(a) take appropriate steps to respond to the complaint,

(b) inform the complainant of the outcome of the complaint,

(c) inform the complainant of the rights under section 166, and

(d) if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.

(5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes

(a) investigating the subject matter of the complaint, to the extent appropriate, and

(b) informing the complainant about progress on the complaint .

The Commissioner's position

Much of the Response is a review of the steps taken after the commencement of the Application. The Commissioner's position, in summary, is that an application under section 166(2) DPA is not concerned with the merits of the underlying complaint nor does it provide a right of challenge to the substantive outcome of the Commissioners investigation. It is an expert regulator, with a wide discretion.

In support of its position the Commissioner cites several authorities including Killock & Veale & others -v-Information Commissioner [2021] UKUT 299 ACC. Killock is also authority as to the role of the Tribunal when considering whether the steps taken by the Commissioner were appropriate for the purposes of sections 166(1)(a) and (2)(a) DPA. While the question of what amounts to an appropriate step is not simply determined by the opinion of the Commissioner: -

85. ..in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator.

The Commissioner wrote to BUCHS on the 24 March 2023. BUCHS was informed that, due to their delay in responding to the SAR, they had not complied with their data protection obligations. Under the heading "Action Required" BUCHS were told they should take steps to improve their information rights practice, review the Applicant's SAR and ensure all personal data he is entitled to is provided unless already disclosed.

On 24 March 2023 the Commissioner reported to the Applicant on the steps now taken. He was also advised that the Commissioner did not intend to take any further action regarding the Complaint and was given guidance about alternative remedies.

On 11 April 2023 the Applicant informed the Commissioner that he had not had a final response from BUCHS. The Commissioner wrote to BUCHS again on the 17 April 2023 and reported this to the Applicant.

Decision

By the time the Application was made the Commissioner had taken no effective steps, and the Applicant asked the Tribunal to require the Commissioner to respond to the Complaint. The Commissioner then did so and considers those steps to be appropriate. The stated purpose of the Application has been achieved and accordingly there is no need for the Application to proceed nor would it be proportionate for it to do so.

Having considered whether I should exercise my discretion to strike out the Application I have concluded that there is no reasonable prospect of the Application or part of it succeeding and therefore it is struck out under rule 8(3)(c) 2009 Rules.

Signed Simon Heald Judge of the First-tier Tribunal Date:20 October 2023
</pre>