UKFTT (GRC) - EA-2023-0480-GDPR
From GDPRhub
| UKFTT (GRC) - EA-2023-0480-GDPR | |
|---|---|
 | |
| Court: | UKFTT (GRC) (United Kingdom) |
| Jurisdiction: | United Kingdom |
| Relevant Law: | Section 166, Data Protection Act (DPA) |
| Decided: | 20.03.2024 |
| Published: | 28.03.2024 |
| Parties: | Wainwright v.ICO |
| National Case Number/Name: | EA-2023-0480-GDPR |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | English |
| Original Source: | First-tier Tribunal (General Regulatory Chamber) (in English) |
| Initial Contributor: | Ian Taylor |
The UK First-tier Tribunal dismissed the Data Subject's appeal, finding the ICO's response appropriate. Section 166 of the Data Protection Act limits the Tribunal's review to procedural issues, not the substantive outcome of the ICO's investigation.
English Summary
Facts
The Data Subject submitted a complaint to the ICO which was investigated by the Commissioner. The Commissioner communicated with the data controller a number of times and the outcome was communicated to the Applicant on 3 May 2023. The Data Subject was dissatisfied with the Commissioners response and made an application to the tribunal under Section 166 of the Data Protection Act 1998 (DPA) seeking to challenge the Commissioners outcome citing procedural failings and investigatory failings by the Commissioner.
Holding
The Tribunal dismissed the Data Subject's appeal, finding it had no power to reassess the ICO's decision.
The Tribunal's role under Section 166 of the Data Protection Act is limited to ensuring the ICO's complaint handling process was procedurally correct. As the ICO had already responded and concluded the case, the Tribunal had no authority to challenge the outcome or provide a remedy.
The Tribunal explained that it cannot:
- Alter the ICO's decision
- Oversee the ICO's functions or internal processes
- Challenge the ICO's exercise of its powers
The Tribunal can only order the ICO to take appropriate steps to respond to a complaint or inform the complainant of progress or outcome.
In this case, the ICO had already taken appropriate steps and reached a final decision. The Data Protection Act does not provide a right to appeal this decision to the Tribunal.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
Neutral Citation Number: [2024] UKFTT 262 (GRC)
Case Reference: EA-2023-0480-GDPR
First-tier Tribunal
General Regulatory Chamber
Section 166 DPA 1998
Heard: on the papers in Chambers
Heard on: 20 March 2024
Decision given on: 28 March 2024
Before
tribunal Judge BUckley
Between
Patrick wainwright
Applicant
and
The Information commissioner
Respondent
JUDGE BUCKLEY
Sitting in Chambers
on 20 March 2024
DECISION
1. The application under section 166 of the Data Protection Act 1998 is STRUCK OUT.
REASONS
2. In this decision, 'the Application' is a reference to the application made to the tribunal by Mr. Patrick Wainwright under section 166 of the Data Protection Act 1998 (DPA) and 'the Applicant' is a reference to Mr. Wainwright.
3. The Commissioner applies for the Application to be struck out under rule 8(3)(c) (no reasonable prospects of success) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.
4. The Commissioner submits that the remedies sought by the Applicant are not outcomes that the tribunal can grant in a section 166 application against the Commissioner. The Commissioner submits that is clear from the grounds in support of the application, that the Applicant does not agree with the outcome of his complaint, however, as the Upper Tribunal and the High Court in Killock & Veale & others v Information Commissioner [2021] UKUT 299 (AAC) and R (on the application of Delo) v Information Commissioner and Wise Payments Ltd [2022] EWHC 3046 (Admin), have already established, section 166 DPA18 does not provide a mechanism by which Applicants can challenge the substantive outcome of a complaint.
5. Further, the Commissioner submits that the Applicant seeks to challenge the investigation carried out by the Commissioner, with a view to seeking a different outcome.
6. Finally, the Commissioner submits that some of the points that have been raised by the Applicant, namely as stated in the first paragraph of the grounds that the investigation was irrational, perverse or flawed, are essentially public law complaints and as the Upper Tribunal's decision in Killock makes clear such matters are for the Administrative Court who are better equipped to consider such arguments.
7. The Applicant responded to this application in submissions dated 7 March 2023 in which he submits that the Commissioner provided a 'purported part decision' on 3 May 2023 that was perverse and contrary to the evidence. He submits that in response to a request for a review the Commissioner failed to investigate and progress the complaint and failed to produce any substantive outcome.
8. The Applicant further submits that the response to the appeal is inaccurate, incomplete, incoherent and inconsistent with the facts.
9. The Applicant submits that the Commissioner acknowledged that the data controller was in breach of data protection legislation by repeatedly writing to the controller.
10. The Applicant acknowledges that up to and including 24 March 2023 the Commissioner had investigated the Applicant's complaint with diligence and procedural correctness and in accordance with the scope and remit of the Enforcement notice of the Commissioner. After 24 March 2023 the Applicant submits that there were procedural failings and procedural irregularities coupled with investigatory failings by the Commissioner which led to a perverse and incomplete outcome.
11. The Applicant submits that the tribunal has power to order the Commissioner to take appropriate steps to investigate a complaint, and argues that after 24 March 2023 the Commissioner failed to do so.
12. Finally the Applicant submits that the Application has more than reasonable prospects of success because the issues in this matter have already been determined by Commissioner's investigation and the Commissioner's substantive outcome in the issuing of the Enforcement notice against the data controller.
Discussion and conclusions
13. The grounds of the Application are set out in box 5a as follows:
1. The decision of the respondent not to pursue the complaint of the applicant is procedurally flawed irrational and perverse.
2. The complaint of the appellant falls under the scope and remit of the enforcement notice of the respondent and should have been investigated by the respondent accordingly.
3. In its decision making process and procedure the respondent has ignored its own enforcement notice and other evidence in support of the complaint.
4. To date contrary to current data protection legislation and the respondent decision the appellant has received no personal information, no personal data or any other supplementary information in response to his subject access request dated 14 October 2022. This is clear ongoing infringement and breach of current data protection legislation that the respondent has failed to investigate in its decision making process and procedure.
14. On an application to the tribunal under section 166, the tribunal has no power to deal with the merits of the complaint to the Commissioner or its outcome (confirmed in Killock & Veale & ors v Information Commissioner [2021] UKUT 299 (AAC) (Killock & Veale).
15. Further, once an outcome to a complaint has been provided, the tribunal has no power retrospectively to order the Commissioner to take appropriate steps to respond to the complaint, where that might lead to a different outcome. That is because once a decision has been reached, challenges to the lawfulness of the process by which it can be reached or to its rationality are a matter for judicial review by the High Court, and not a matter for the tribunal. (Killock & Veale and R (on the application of Delo) v Information Commissioner and Wise Payments Limited [2022] EWHC 3046 (Admin), upheld by the Court of Appeal at [2023] EWCA Civ 1141.
16. The Applicant complained to the Commissioner on 22 December 2022. The Commissioner communicated with the data controller a number of times and the outcome was communicated to the Applicant on 3 May 2023. That letter states that the Commissioner had considered all the information available and was satisfied with the data controller's response to the subject access request. The letter confirms that the Commissioner was not going to take any further action. I do not accept that this was only a 'part' outcome.
17. The letter of 3 May 2023 was the outcome of the complaint. The tribunal does not have any remit to consider whether or not that outcome was substantively correct.
18. I do not accept that there is in this Application any challenge to the 'appropriate steps' taken by the Commissioner which would not involve reopening that outcome. I conclude therefore that this case does not fall within the narrow circumstances in which the tribunal might be able to make an order under section 166(2)(a) (appropriate steps to respond to the complaint) after the complainant has been informed of the outcome of their complaint.
19. In particular, allegations that the decision was 'procedurally flawed irrational and perverse' are a matter for judicial review by the High Court, and not a matter for the tribunal.
20. For those reasons, I do not consider that there is any reasonable prospect of the tribunal making any order under section 166(2).
21. I have considered whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance), prospect of the Application succeeding at a full hearing. In my view, there are no reasonable prospects of the Application under section 166 succeeding.
22. I have considered whether I should exercise my discretion to strike the Application out. Taking into account the overriding objective, it is a waste of the time and resources of the Applicant, the tribunal and the Commissioner for this Application to be considered at a final hearing. In my view it is appropriate to strike the Application out.
23. As the Commissioner correctly states in his response, if the Applicant wishes to seek an order of compliance against the Controller for breach of their data rights, the correct route for them to do so is by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA18.
24. For the above reasons the Application is struck out.
Signed Sophie Buckley
Judge of the First-tier Tribunal
Date: 20 March 2024
