Robin Levi v The Information Commissioner [2023] UKFTT 1033 (GRC)

[2023] UKFTT 01033 (GRC)

First-tier Tribunal

(General Regulatory Chamber)

Date 18 December 2023

Section 166 Data Protection Act 2018

Appeal Reference: EA/2023/0371

Decided without a hearing

On 8 December 2023

Before

TRIBUNAL Judge HEALD

Between

ROBIN LEVIApplicant

THE INFORMATION COMMISSIONERRespondent

Decision and Reasons

[1]The Application is struck out. Background summary

[2]In the course of purchasing a vehicle from Group 1 Auto (“Group1”) Robin Levi (“the Applicant”) became concerned that they had passed on his data to a third party without his permission.

[3]On Friday 16 June 2023 he raised this with Group1. They indicted they would investigate and on Monday 19 June 2023 reported back to say:- “Unfortunately…..it appears that we had incorrectly added your house number on a document when registering with the DVLA, we have contacted DVLA to correct and update this information”

[4]The writer added:- “We take Customer Data very seriously and take every opportunity to mitigate against human error but on this occasion have failed. I have logged this as a Data Breach and further training will be issued. For your ease and convenience I have given the below contact details for the Information Commissioners Office (ICO), however I would hope now we have rectified our mistake we can consider the matter closed.”

[5]On 21 June 2023 Mr Levi made a complaint to the Commissioner by section 165 Data Protection Act 2018 (“the DPA”) about Group1 and the data breach. On 25 July 2023 the Commissioner told Mr Levi amongst other things:- “We have considered the issues that you have raised with us and based on this information, it is our view that there is more work for the organisation to do. We have therefore raised your complaint with the Chief Executive, via the Data Protection Officer, explaining that we want them to work with you to resolve any outstanding matters.”

[6]Mr Levi was told of the final outcome of the complaint on 18 August 2023. In effect this was that, because Group1 had by then responded to his complaint and corrected the data, the Commissioner considered that they were taking data protection law seriously and that “I can confirm we are not taking any Regulatory action in relation to your complaint”

[7]The letter from the Commissioner told Mr Levi of other remedies that might be available to him. The Application

[8]On 18 August 2023 Mr Levi issued this Application. The outcome sought by him is:- “I want Group One Ford to face an appropriate penalty and the ICO to explain why they feel that Group One Ford are blameless in this matter.” The Commissioner's Response

The Commissioner's Response

[9]The Commissioner has provided a response to the Application dated 16 October 2023. As well as opposing the Application it asks that the Tribunal strike it out on the basis that is has no prospect of success by rule 8(3)(c) Tribunal Procedure (First -tier Tribunal) (General Regulatory Chamber) Rules 2009 (“2009 Rules”). Applicant’s Reply

[10]Mr Levi opposes the strike out and in reply to the Commissioner's Response as well as repeating the factual position, as he sees it, says:- “The Information Commissioner seeks to have my application thrown out by the use of Section 166. The Information Commissioner claims that the Tribunal has no authority to override decisions because Section 166 is so well established as giving the Information Commissioner absolute power of enforcement or not. The Information Commissioner shall not be challenged or defied! However, it is self evident that jurisprudence today is a matter of the balancing of many different and often conflicting considerations. I submit that the principle of putting the victim at the centre of justice trumps Section 166. I further submit that consideration of human rights trumps Section 166. I therefore invite the Tribunal not to strike out the application on the basis of Section 166 but instead to instruct the Commissioner to apply the appropriate sanction to Group 1 Ford.” Strike out

Strike out

[11]Rule 8(3) 2009 Rules provides that: - “The Tribunal may strike out the whole or a part of the proceedings if (c) the Tribunal considers there is no reasonable prospect of the appellant's case, or part of it, succeeding.”

[12]As required by rule 8(4) 2009 Rules Mr Levi was given an opportunity to make representations in relation to the proposed striking out which he did.

[13]In HMRC -v- Fairford Group (in liquidation) and Fairford Partnership Group (in liquidation)

[2014] UKUT 0329

the Upper Tribunal summarised the task to be carried out by a Tribunal in these circumstances:

“..The Tribunal must consider whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance) prospect of succeeding on the issue at a full hearing…..A ‘realistic’ prospect of success is one that carries some degree of conviction and not one that is merely arguable……..The tribunal must avoid conducting a ‘mini-trial’….”

[14]In AW-v-Information Commissioner and Blackpool CC [2013] 30 ACC the Upper Tribunal set out the principles governing the application of rule 8(3)(c) 2009 Rules. These included: - “ …It is well established in the ordinary courts that the historic justification for striking out a claim is that the proceedings are an abuse of process …. On that basis, the power should only be exercised in plain and obvious cases” “More recent rulings from the superior courts point to the need to look at the interests of justice as a whole ….It is, moreover, plainly a decision which involves a balancing exercise and the exercise of a judicial discretion, taking into account in particular the requirements of Rule 2 of the GRC Rules.”

[15]Rule 2 refers to the overriding objective which is “to enable the Tribunal to deal with cases fairly and justly.” Rule 2(3) 2009 Rules provides that the Tribunal “must seek to give effect to the overriding objective when it(a) exercises any power under these rules or

(b) interprets any rule or practice direction.” The DPA

[16]Mr Levi’s application is by section 166(2) DPA. Section 166 provides as follows: -(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.

(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner(a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

(3) An order under subsection (2)(a) may require the Commissioner (a) to take steps specified in the order. (b) to conclude an investigation, or take a specified step, within a period specified in the order.

(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).

[17]Relevant parts of section 165 DPA provide: - (4) If the Commissioner receives a complaint under subsection (2), the Commissioner must(a) take appropriate steps to respond to the complaint,

(b) inform the complainant of the outcome of the complaint,

(d) if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint. (5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes— (a)investigating the subject matter of the complaint, to the extent appropriate… Section 166

[18]The Commissioner’s position, in summary, is that an application under section 166(2) DPA is not concerned with the merits of the underlying complaint nor does it provide a right of challenge to the substantive outcome of the Commissioners investigation. It is an expert regulator, with a wide discretion.

[19]In support of its position the Commissioner cites several authorities including Killock & Veale & others -v-Information Commissioner

[2021] UKUT 299

ACC. In Killock (para 76) it was held that:- “The Tribunal does not have the same expertise in determining the appropriate outcome of complaints. The Commissioner is the expert regulator. She is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome. In so far as the Commissioner’s regulatory judgments would not and cannot be matched by expertise in the Tribunal, it is readily comprehensible that Parliament has not provided a remedy in the Tribunal in relation to the merits of complaints.”

[20]Killock is also authority for the role of the Tribunal when considering whether the steps taken (by the Commissioner) were appropriate. Appropriateness is not conclusively determined by the Commissioner but: - “85…..in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. ….. in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations.”

[21]The nature of the Commissioner's discretion to deal with complaints under section 166 DPA was considered in R (on the application of Delo) v Information Commissioner and Wise Payments Ltd

[2022] EWHC 3046 (Admin)

. In Delo the Court found for example at para 128:- “…..Sections 166(2) and (3) allow the Tribunal to order the Commissioner to take steps specified in the order to respond to the complaint. In my judgment, this would not extend to telling the Commissioner that he had to reach a conclusive determination on a complaint where the Commissioner had rendered an outcome of no further action without reaching a conclusive determination. This is because s.166 by its terms applies only where the claim is pending and has not reached the outcome stage. It applies only to alleged deficiencies in procedural steps along the way and clearly does not apply to a merits-based outcome decision.”

[22]Also from Delo at paras 66, 70 and 85:- “...a contextual or inferential construction of Article 57.1(f) clearly leads to an interpretation that allows the Commissioner to decide, after investigating a complaint to a limited extent, that no further action should be taken on it.” “If the Commissioner has the power, after minimal investigation, to reject a complaint as spurious then it must follow that it is a lawful exercise of power by the Commissioner to decide after investigating a complaint to a limited extent that, although it is not spurious, nonetheless no further action should be taken on it.” “…... the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation, and, if so, to what extent. ….this discretion properly recognises that the Commissioner is an expert Regulator who is best placed to determine on which cases he should focus.” Conclusion

Conclusion

[23]While Mr Levi does not express his application directly in the language of section 166 DPA it seems to me that his concern is that he does not consider the Commissioner has taken appropriate steps to respond to his complaint.

[24]A Tribunal can require the Commissioner to take appropriate steps but in considering whether to do so it must considerthe actions of the Commissioner by reference to its obligation by section 165 DPA and the relevant legal authorities including Killock and Delo.

[25]I have reviewed the interaction between Group1, the Applicant and the Commissioner and the position of the parties including the outcome sought by Mr Levi. I have considered the overriding objective. I conclude that Mr Levi has no reasonable prospect of succeeding on his Application and that it would therefore be right for me to exercise the discretion to strike it out. Decision