“I am not sure, because this appeal in reference to IC-206527-B3Q7 is not out of time. However, it appears that the ICO may rely on a previous complaint where no outcome was provided and/or transparent to me until April 2022. That case ref is IC-84886-T4Z0. My Solicitors made a new DSAR request to Genting in Feburary 2022 because we were not sure why Genting were saying that the ICO was satisified with their response (after confirming that Genting were breach of GDPR). The ICO on6 September 2021 gave different decisions at the same time to both parties and this has now caused this confusion. Genting now relying on that my Solictors DSAR request is now "somehow" mainefstly unfounded or excessive because according to them ICO stated that they were satisified with their response on6 September 2021 and matter concluded. However ICO told me otherwise that matter was not concluded and still under investigation. If the ICO rely that this matter is related to previous request and subsequently submit that this appeal is out of time then I kindly request the Tribunal to consider the reason for this is because ICO gave different decisions to both parties at the same time on6 September 2021 and this has caused so much confusion and delays.”
“We request that you revisit the way this subject access request has been handled and provide them with all of the information they are entitled to. If your organisation is withholding data please provide the ICO with details of the reasons why and the relevant exemptions that apply under data protection laws.”
“I am writing to you regarding the data protection concern you raised with us relating to Genting Casinos. We have seen a copy of the response sent to you, dated 20 August, and pending any further developments in this matter we do not intend to take any further action. Though we do not intend to take action at this time, we will keep a record of this and should we take action in the future this may form part of the intelligence we use to do so. Thank you for bringing this matter to our attention.”
“Thank you for your email of20 August 2021 . We are satisfied with the provided response and pending any further developments consider the matter concluded.”
“I apologise that you are unclear on the current status of this complaint. Status of your complaint At this time your complaint is closed as we are satisfied with the response provided to us by Genting Casino. As expressed to you in our email of18 October 2021 this case is being kept in our records, in line with our retention policy. You mentioned that you had further evidence to provide following legal advice and we advised that if you provided this we would be able to take any appropriate action. We would like to apologise that this has caused confusion regarding the status of your case. As we are taking no further action at this time, it is considered closed, pending any new information provided to us.”
“It is my understanding that you are unhappy with our decision as you believe that Genting have failed to provide you with all of the personal data you are entitled to in response to your SAR. I have reviewed the actions taken by Corey Davies and I agree with the decision reached in that Genting Casinos have complied with their data protection obligations in respect of your SAR. This is because they have provided you with a response that explains what information you have been provided, what has been withheld and why this information has been withheld, including appropriate explanations of the exemptions they have applied in this instance. We informed you of our decision in September 2021 and stated that we would review this decision if further evidence could be provided.”
“Thank you for registering a second personal data concern with the Information Commissioner's Office ('ICO') about Genting Casinos UK Limited ('Genting'), part of the Genting Group of companies, and their refusal to respond to your subject access request ('SAR'). We understand this is substantially the same as, and linked to, your previous concern - our case reference: IC84886-T4Z0. We note that you were disappointed with the outcome in that case and, following a review, were subsequently referred to The Parliamentary and Health Service Ombudsman (PHSO). The ICO also notes from Genting's letter of22 April 2022 to your solicitors that they consider your request(s) to be "manifestly unfounded and / or excessive" and that they refuse to respond further. Genting have stated the legal basis on which they are relying in refusing your SAR. It is our opinion that this is now clearly a matter for the courts to decide. As such we will be taking no further action in this matter and refer you back to your legal advisors. This Case will now close. However, your complaint has been noted and will serve as intelligence towards any future regulatory action the ICO considers necessary. Thank you for bringing this matter to our attention.”
“Analysis and discussion 74. The remedy in s.166 is limited to the mischiefs identified in s.166(1). We agree with Judge Wikeley’s conclusion in Leighton (No 2) that those are all procedural failings. They are (in broad summary) the failure to respond appropriately to a complaint, the failure to provide timely information in relation to a complaint and the failure to provide a timely complaint outcome. We do not need to go further by characterising s.166 as a “remedy for inaction” which we regard as an unnecessary gloss on the statutory provision. It is plain from the statutory words that, on an application under s.166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the s.166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a Tribunal from the procedural failings listed in s.166 towards a decision on the merits of the complaint must be firmly resisted by Tribunals. 75. We do not accept that the limits of s.166 mean that the rights of data subjects are not protected to the extent required by the GDPR or by the CFR. Infringement of rights under data protection legislation is remediable in the courts (ss.167-169 DPA). In addition, if a data subject decides to complain to the Commissioner, s.166 provides procedural protections in order to ensure that the complaint receives appropriate, timely and transparent consideration. The Tribunal as a judicial body has expertise in procedural matters. It is therefore apt for a Tribunal to provide a remedy against procedural failings in complaints handling. 76. The Tribunal does not have the same expertise in determining the appropriate outcome of complaints. The Commissioner is the expert regulator. She is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome. In so far as the Commissioner’s regulatory judgments would not and cannot be matched by expertise in the Tribunal, it is readily comprehensible that Parliament has not provided a remedy in the Tribunal in relation to the merits of complaints. 77. This does not leave data subjects unprotected. If the Commissioner goes outside her statutory powers or makes any other error of law, the High Court will correct her on ordinary public law principles in judicial review proceedings. The combination of a statutory remedy in the Tribunal in relation to procedures and to the supervision of the High Court in relation to substance provides appropriate and effective protection to individuals. It does not require us to strain the language of s.166 to rectify any lack of protection or to correct any defect in Parliament’s enactment of the UK’s obligations to protect an individual’s data.”
“87. Moreover, s.166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question. We do not rule out circumstances in which a complainant, having received an outcome to his or her complaint under s.165(b), may ask the Tribunal to wind back the clock and to make an order for an appropriate step to be taken in response to the complaint under s.166(2)(a). However, should that happen, the Tribunal will cast a critical eye to assure itself that the complainant is not using the s.166 process to achieve a different complaint outcome.”
“131. For my part, if an outcome has been pronounced, I would rule out any attempt by the data subject to wind back the clock and to try by sleight of hand to achieve a different outcome by asking for an order specifying an appropriate responsive step which in fact has that effect. The Upper Tribunal rightly identified in [77] that if an outcome was pronounced which the complainant considered was unlawful or irrational then they can seek judicial review in the High Court. ”
“60. For present purposes the most striking point about the language of that provision is that it does not contain any words that are redolent of decisions on the merits of a complaint. Article 57 does not adopt any of the familiar ways of designating a decision-making function. We are not told that the Commissioner must (for instance) adjudicate, decide, determine, rule upon, or resolve a complaint, or that complaints must be "upheld" or not upheld by the Commissioner. Rather, we are told that the Commissioner must "handle" a complaint. He must "investigate the subject-matter of the complaint" but even then only "to the extent appropriate". He must "inform" the complainant of the "progress" of the complaint and its investigation and its "outcome". 61. The same points can be made about Articles 77 and 78. Article 77(2) does not state that the data subject who exercises the Article 77(1) right to lodge a complaint is entitled to have the Commissioner adjudicate, or decide, or determine or resolve that complaint. It states that the Commissioner "shall inform" the complainant "on the progress and the outcome" of the complaint. No remedy is identified other than an "outcome". Article 78 does confer a right to an "effective judicial remedy" but it does not say there must be such a remedy where the Commissioner fails to determine the merits of a complaint. The conduct for which Article 78 requires an effective judicial remedy is failure to "handle" the complaint or to "inform" the data subject of its "progress" or "outcome". 62. These are all distinctive and unusual words to use in a context of this kind. As Mr Delo submits, a regulatory scheme usually provides for decisions to be made by the regulator. A dispute resolution mechanism calls for a definitive conclusion of the dispute. But in my view these are points against the interpretation advocated by Mr Delo rather than in favour of it. If this were domestic UK legislation intended to impose on the Commissioner a duty to reach and pronounce a decision on the merits of all complaints lodged by data subjects, in the same way that a court or tribunal would be bound to do if seised of a disputed allegation of infringement, then one would expect to see language of the kind I have mentioned at [60] above. From the perspective of an English lawyer, the absence of any such language and the use of the quite different terminology which I have highlighted are both remarkable features of Articles 57, 77 and 78. Making all due allowance for differences between the legislative methods of the UK and the EU, these are indications – and in my opinion strong ones – that the legislative intent was not to require the Commissioner to determine every complaint on its merits. 63. In my view, contrary to Mr Delo's submissions, the ordinary and natural interpretation of the language used in these provisions is that the Commissioner's principal obligations are to address and deal with every complaint by arriving at and informing the complainant of some form of "outcome", having first investigated the subject matter "to the extent appropriate" in the circumstances of the case. There are also second tier obligations, to inform the complainant of the progress of the investigation and of the complaint. 64. An "outcome" must be the end point of the Commissioner's "handling" of a complaint. A conclusive determination or ruling on the merits that brings an end to the complaint is certainly an "outcome" but that word is intended to have broader connotations. In Killock, the Upper Tribunal decided, in my view correctly, that it embraced a decision to cease handling a specific complaint whilst using it to inform and assist a wider industry investigation. In the present case, Mostyn J held that the word "outcome" is an apt description of the Commissioner's decision to conclude his consideration of Mr Delo's complaint by informing him of the Commissioner's view that the conduct complained of was "likely" to be compliant with the UK GDPR (or, put another way, that the complaint of infringement was "likely" to be ill-founded). Again, I would agree with that.”