“1) In my grounds of appeal, among other points, I noted that I wished my appeal to be considered on two articles of human rights. The Tribunal Registrar did not consider human rights in the given decision more broadly or the two articles identified in their reasons to not grant extension. Only the DPA was considered as a legal basis for denying extension. I would like the tribunal to consider my human rights. 2) The UN technically does have an office in the UK, and given it's not known where exactly my data is as noted in my appeal grounds, I think the tribunal and ICO has not fully considered the bigger picture in relation to what can be enforced. The International Maritime Organization (IMO) is based at 4 Albert Embankment, London SE1 7SR, United Kingdom. This is part of the United Nations. 3) I would like the tribunal to be aware that I have made a submission of Information to Special Procedures through the United Nations Human Rights Office of the High Commissioner. However, this process will take arguably longer than everything so far given they appear to be receiving high volume submissions in relation to the Middle East and Eastern Europe. It also does not appear to be a legal mechanism and I'm unsure if the United Nations will consider my submission, because it does create a crisis of identity for the UN to examine itself. Therefore at present, the General Regulatory Chamber feels like my only recourse. I have considered the UN HQ in New York but New York does not have specific data privacy law or a mechanism I can use to enforce my rights. I wish the tribunal to understand that even in countries where the UN 'has an office' (noting the point above that there is one in the UK anyway...) it is difficult to just start, let alone bring, any regulatory action. 4) Given there is new evidence from the United Nations as fresh as 09/10/23 included in the appeal bundle, it does feel at odds with natural justice for the tribunal to not consider my appeal on the basis of time. Especially given my reasons given surrounding my family member. I could not reasonably and efficiently pursue all of their welfare and health rights at the same time as trying to pursue enforcement of my own information rights. There is also the issue which I noted in my grounds of appeal, the ICO could have got in touch with the UN, but they didn't, instead they give me options to pursue myself. This led to what they commonly call a 'wild goose chase' which ultimately has extended the time waiting for these advised upon entities to reply. Which, they didn't. 5) Although admittedly this is very very cheeky, there were some administrative errors within this given appeal process where I was not notified of what was going on and an apology was offered by the GRC via email. This apology emerged after I sent the GRC an email to ask what was happening because I had not been contacted by the GRC at all since I made my appeal submission. The GRC is also not perfect in delivering upon its duties and it does echo oddly that I am flogged while this occurs at the same time.”
“the United Nations do not appear to have a UK office address. The location of their headquarters can be found in New York. The UK and Ireland Desk is based in Belgium you can raise your concerns directly with them here: UNRIC 155 Rue de la Loi / Wetstraat 1040, Brussels Belgium As explained previously, when an organisation has its main headquarters outside the UK we cannot enforce our powers as they do fall within the scope of DPA 2018. For these reasons, we will not be taking further action in this case”
“It is my view that Ms Holland’s decision not to consider your complaint further, on the basis the organisation was outside of the ICO’s jurisdiction, was reasonable and appropriate. It was also in line with the ICO’s general approach to data controllers based outside of the UK. Consequently I do not uphold your complaint in this matter.”
“60. For present purposes the most striking point about the language of that provision is that it does not contain any words that are redolent of decisions on the merits of a complaint. Article 57 does not adopt any of the familiar ways of designating a decision-making function. We are not told that the Commissioner must (for instance) adjudicate, decide, determine, rule upon, or resolve a complaint, or that complaints must be "upheld" or not upheld by the Commissioner. Rather, we are told that the Commissioner must "handle" a complaint. He must "investigate the subject-matter of the complaint" but even then only "to the extent appropriate". He must "inform" the complainant of the "progress" of the complaint and its investigation and its "outcome". 61. The same points can be made about Articles 77 and 78. Article 77(2) does not state that the data subject who exercises the Article 77(1) right to lodge a complaint is entitled to have the Commissioner adjudicate, or decide, or determine or resolve that complaint. It states that the Commissioner "shall inform" the complainant "on the progress and the outcome" of the complaint. No remedy is identified other than an "outcome". Article 78 does confer a right to an "effective judicial remedy" but it does not say there must be such a remedy where the Commissioner fails to determine the merits of a complaint. The conduct for which Article 78 requires an effective judicial remedy is failure to "handle" the complaint or to "inform" the data subject of its "progress" or "outcome". 62. These are all distinctive and unusual words to use in a context of this kind. As Mr Delo submits, a regulatory scheme usually provides for decisions to be made by the regulator. A dispute resolution mechanism calls for a definitive conclusion of the dispute. But in my view these are points against the interpretation advocated by Mr Delo rather than in favour of it. If this were domestic UK legislation intended to impose on the Commissioner a duty to reach and pronounce a decision on the merits of all complaints lodged by data subjects, in the same way that a court or tribunal would be bound to do if seised of a disputed allegation of infringement, then one would expect to see language of the kind I have mentioned at [60] above. From the perspective of an English lawyer, the absence of any such language and the use of the quite different terminology which I have highlighted are both remarkable features of Articles 57, 77 and 78. Making all due allowance for differences between the legislative methods of the UK and the EU, these are indications – and in my opinion strong ones – that the legislative intent was not to require the Commissioner to determine every complaint on its merits. 63. In my view, contrary to Mr Delo's submissions, the ordinary and natural interpretation of the language used in these provisions is that the Commissioner's principal obligations are to address and deal with every complaint by arriving at and informing the complainant of some form of "outcome", having first investigated the subject matter "to the extent appropriate" in the circumstances of the case. There are also second tier obligations, to inform the complainant of the progress of the investigation and of the complaint. 64. An "outcome" must be the end point of the Commissioner's "handling" of a complaint. A conclusive determination or ruling on the merits that brings an end to the complaint is certainly an "outcome" but that word is intended to have broader connotations. In Killock, the Upper Tribunal decided, in my view correctly, that it embraced a decision to cease handling a specific complaint whilst using it to inform and assist a wider industry investigation. In the present case, Mostyn J held that the word "outcome" is an apt description of the Commissioner's decision to conclude his consideration of Mr Delo's complaint by informing him of the Commissioner's view that the conduct complained of was "likely" to be compliant with the UK GDPR (or, put another way, that the complaint of infringement was "likely" to be ill-founded). Again, I would agree with that.”