First-tier Tribunal - EA/2023/0478/GDPR - Grzeszkowiak v. ICO
From GDPRhub
| First-tier Tribunal - EA/2023/0478/GDPR - Grzeszkowiak v. ICO | |
|---|---|
 | |
| Court: | First-tier Tribunal (United Kingdom) |
| Jurisdiction: | United Kingdom |
| Relevant Law: | Section 166, Data Protection Act (DPA) |
| Decided: | 03.07.2024 |
| Published: | 03.07.2024 |
| Parties: | ICO |
| National Case Number/Name: | EA/2023/0478/GDPR - Grzeszkowiak v. ICO |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | English |
| Original Source: | First-tier Tribunal (General Regulatory Chamber) (in English) |
| Initial Contributor: | Mgrd |
The UK First-tier Tribunal strucked out a casa since ICO has taken appropriate steps to respond to the Data Subject complaint and had communicated the outcome. According to Section 166 of the Data Protection Act, the Tribunal can only challenge an outcome if a claim is pending and has not reached the outcome stage.
English Summary
Facts
The Data Subject made request to have access and obtain his personal data to the University of Edinburgh. However, he was dissatisfied with the University's response and on 31 March 2023, he lodged a complaint with the ICO regarding the handling of his data subject access request.
After the Commissioner's investigation, which found that there was a delay, but eventually all entitled data was disclosed, the Data Subject was still not satisfied with the result, claiming that not all his data was provided by the controller.
Holding
The Tribunal decided to strike out a Data Subject's appeal. The decision was based on the Tribunal’s interpretation that its role under Section 166 of the Data Protection Act (DPA) is not to reassess the substantive outcome of the Commissioner's decisions, but solely to ensure that the complaint handling process was procedurally correct.
Since the Commissioner had already responded and concluded the case with the outcome communicated to the Data Subject, the Tribunal ruled that it had no authority to challenge this outcome or provide a substantive remedy.
Therefore, the application was struck out, with the Tribunal stating that there was no reasonable prospect of success for the appeal, as it did not present issues within the Tribunal’s purview to correct, only addressing procedural elements which were already satisfied.
The Tribunal does not have the power to alter the conclusion reached by the Commissioner on a complaint. Neither does the Tribunal have an oversight role over the Commissioner’s exercise of his functions or internal processes.
The Tribunal can only make an order to determine the appropriate steps to respond to the complaint have been made and/or to inform the complainant of progress on the complaint, or of the outcome of the complaint.
According to the Tribunal, it was clear that the ICO has taken appropriate steps to respond to the Data Subject and has reached to a final decision and communicated the outcome. Also, it was highlighted that the Data Protection Act does not provide a right to apply to the Tribunal to challenge that outcome.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
[New search] [Context] [View without highlighting] [Printable PDF version] [Help]
NCN: [2024] UKFTT 574 (GRC)
Case Reference: EA/2023/0478/GDPR
First-tier Tribunal
General Regulatory Chamber
Information Rights
Heard: Determined on the papers
Heard on: 1 July 2024
Decision given on: 3 July 2024
Before
RECORDER CRAGG KC sitting as a Judge of the FTT
Between
ERYK JAN GRZESZKOWIAK
Appellant
And
THE INFORMATION COMMISSIONER
Respondent
DECISION ON STRIKE OUT APPLICATION
1. Decision: The Respondent's Strike Out Application dated 15 February 2024 made pursuant to rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal)(General Regulatory Chamber) Rules 2009 ("the Rules") on the grounds that there is no reasonable prospect of the appeal succeeding, is granted.
REASONS
1. A data subject has a right to make a complaint to the Commissioner if they consider that the processing of personal data relating to them infringes the General Data Protection Regulation ("GDPR"), and/or Parts 3 or 4 of the Data Protection Act 2018 (DPA) see section 165(2) DPA.
2. Under section 166 DPA, a data subject has a right to make an application to the Tribunal if the Commissioner has failed to take certain procedural actions in relation to their complaint. Section 166 DPA states as follows:-
(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or
(c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commissioner
(a) to take steps specified in the order.
(b) to conclude an investigation, or take a specified step, within a period specified in the order.
(4) ...
3. Case law establishes that an application under s166 DPA is not concerned with the merits of the underlying complaint or intended to provide a right of challenge to the substantive outcome of the Commissioner's investigation into that complaint. This was most recently confirmed in the case of R (Delo) v Information Commissioner [2022] EWHC 3046 (Admin). In that case Mostyn J said:-
129. In Killock and Veale v ICO (Information rights - Freedom of Information - exceptions: practice and procedure) [2021] UKUT 299 (AAC) Farbey J and UTJ De Waal held at [74]:
"The remedy in s.166 is limited to the mischiefs identified in s.166(1). We agree with Judge Wikeley's conclusion in Leighton (No 2) that those are all procedural failings. They are (in broad summary) the failure to respond appropriately to a complaint, the failure to provide timely information in relation to a complaint and the failure to provide a timely complaint outcome. We do not need to go further by characterising s.166 as a "remedy for inaction" which we regard as an unnecessary gloss on the statutory provision. It is plain from the statutory words that, on an application under s.166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the s.166 remedy as reflecting the provisions of Article 78(2) which are procedural. Any attempt by a party to divert a Tribunal from the procedural failings listed in s.166 towards a decision on the merits of the complaint must be firmly resisted by Tribunals"
130. I fully agree with this...
131.....if an outcome has been pronounced, I would rule out any attempt by the data subject to wind back the clock and to try by sleight of hand to achieve a different outcome by asking for an order specifying an appropriate responsive step which in fact has that effect.
4. Thus, it is now well established that an application under section 166 is not concerned with the merits of the underlying complaint or intended to provide a right of challenge to the substantive outcome of the Commissioner's investigation into that complaint. The Tribunal does not have the power to alter the conclusion reached by the Commissioner on a complaint. Neither does the Tribunal have an oversight role over the Commissioner's exercise of his functions or internal processes.
5. The Tribunal has the power to strike out the present application under rule 8(3)(c) of the Tribunal Rules on the ground that it has no reasonable prospect of success. The phrase 'reasonable prospect of success' has been explained by the Court of Appeal in Swain v Hillman & Another [1999] EWCA Civ 3053 in the context of considering the phrase for the purposes of summary judgment under Part 24 of the CPR at [7]:
"...the court now has a very salutary power, both to be exercised in a claimant's favour or, where appropriate, in a defendant's favour. It enables the court to dispose summarily of both claims or defences which have no real prospect of being successful. The words "no real prospect of being successful or succeeding" do not need any amplification, they speak for themselves. The word "real" distinguishes fanciful prospects of success or, as Mr Bidder submits, they direct the court to the need to see whether there is a "realistic" as opposed to a "fanciful" prospect of success."
6. By way of a Notice of Application dated 7 November 2023, the Applicant made an application to the First-tier Tribunal (the Tribunal) under section 166(2) DPA. The Commissioner opposes the application and invites the Tribunal to strike it out under rule 8(2)(a) and/or 8(3)(c) of the Tribunal Rules on the grounds either (i) that the Tribunal is without jurisdiction to consider the application or (ii) that it has no reasonable prospect of succeeding:-
Rule 8(2)(a)
(2)The Tribunal must strike out the whole or a part of the proceedings if the Tribunal
(a) does not have jurisdiction in relation to the proceedings or that part of them.
Rule 8(3)(c)
(3) The Tribunal may strike out the whole or a part of the proceedings if
(c) the Tribunal considers there is no reasonable prospect of the appellant's case, or part of it, succeeding.
FACTUAL BACKGROUND
7. The Applicant's case involves his attempts to obtain personal information from the University of Edinburgh. On 31 March 2023, the Applicant submitted a complaint to the Commissioner, together with some supporting evidence, with a concern as to the manner in which the University had responded the Applicant's subject access request (SAR). After contacting the University the Commissioner's case officer, and after information was disclosed by the University, and following further communication, the case officer emailed the Applicant the outcome of the complaint on 10 October 2023. The case officer was satisfied that, although there had been serious delay which amounted to an infringement of the Applicant's data protection obligations by the University, all the personal information to which the Applicant was entitled had been disclosed.
8. The Applicant issued a Notice of Application dated 7 November 2023. He disagreed with the Commissioner's decision that the University had provided him with all the personal data to which he was entitled, and he set out details of his case.
9. The Commissioner's response was that the Applicant's grounds are beyond the narrow matters that the Tribunal has to consider when making an order under section 166(2) DPA. The Applicant was asked for a response on 21 February 2024 by email but there has been no response.
DISCUSSION
10. I have considered both parties' representations and concluded that this is an appeal which cannot be permitted to go any further and should be struck out.
11. This is because of the very limited right to apply to the Tribunal set out in s166(2) DPA. As the case law sets out above this right to apply does not engage the content of the response made by the Commissioner, but just enables the Tribunal to make an order that that appropriate steps to respond to the complaint have been made and/or to inform the complainant of progress on the complaint, or of the outcome of the complaint
12. What s166 DPA does not provide is any kind of avenue of challenge to an outcome with which the Applicant is dissatisfied, or any kind of substantive remedy. Given that the application of s166 DPA is limited to communicating the status of the Commissioner's consideration of a complaint of which he is seized to the data subject, it also necessarily ceases to have application once the Commissioner has concluded his consideration of the complaint and communicated the outcome to Applicant. Section 166 DPA by its terms applies only where the claim is pending and has not reached the outcome stage.
13. It is clear in this case that the Commissioner has taken appropriate steps to respond to the Applicant and has reached and communicated an outcome in the case. I recognise, of course, that the Applicant is dissatisfied with the outcome communicated by the Commissioner, but the DPA (as confirmed by the case law cited above) does not provide a right to apply to the Tribunal to challenge that outcome. As the Commissioner points out if the Applicant wishes to seek an order of compliance against the University for breach of data rights, the correct route to do so is by way of separate civil proceedings in the County Court or High Court pursuant to s167 DPA.
14. In my view, given the limited nature of the application rights and the Tribunal powers under s166(2) and (3) DPA, the application has no prospect of success, and the application is struck out under rule 8(3)(c) of the Tribunal Rules.
Signed: Judge S Cragg
Date: 1 July 2024
