Olubukunola Mabadeje v The Information Commissioner [2023] UKFTT 632 (GRC)

Case Reference: EA-2023-0176-GDPR[2023] UKFTT 00632 (GRC)
First-tier Tribunal
General Regulatory Chamber
Section 166 DPA 1998
Before
tribunal Judge BUckley
Between
OLUBUKUNOLA MABADEJEApplicantThe Information commissionerRespondentJUDGE BUCKLEYSitting in Chamberson 27 JULY 2023DECISIONDate 2023-07-28
[1]The application under section 166 of the Data Protection Act 1998 is struck out.[2]To the extent that these proceedings consist of any appeal or application to the tribunal made otherwise than under section 166 of the Data Protection Act (on the basis that the Commissioner did not exercise its duty judiciously in following Data Protection/GDPR rules but rather made decisions based on Civil Procedure Rules) that appeal or application is struck out.

REASONS

[3]In this decision, ‘the Application’ is a reference to the application made to the tribunal by Olubukunola Mabadeje under section 166 of the Data Protection Act 1998 (DPA) or any other appeal or application included in the same notice of appeal or application submitted on 10 March 2023. ‘The Applicant’ is a reference to Olubukunola Mabadeje.

Application and response

[4]The Commissioner applies for the Application to be struck out under rule 8(3)(c) (no reasonable prospects of success) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.[5]The Commissioner submits that the Applicant simply disagrees with the conclusions reached by the Commissioner on her complaint. An application under section 166 is not concerned with the merits of the underlying complaint or intended to provide a right of challenge to the substantive outcome of the Commissioner’s investigation into that complaint.[6]The Applicant was given the opportunity to respond. She states that her application was not based under section 166 DPA. She states:
“My appeal/application to the Tribunal is regarding how the Commissioner did not exercise its duty judiciously in following Data Protection/GDPR rules (further documented on its website) but rather made decisions based on Civil Procedure Rules for which its advisors had no knowledge, experience or jurisdiction. 3. My complaint to the Commissioner was based on how my personal data was being mishandled by the Data processor, that is the 3rd party – solicitor firm and not in accordance with GDPR / DPA rules. 4. The Tribunal has within their rights according to its procedural rules to accept applications or appeals against government regulators has accepted my application and so the Commissioner’s strike out application has no basis and should be denied.”

Discussion and conclusions

[7]The first-tier tribunal’s jurisdiction is defined by statute. It does not have a general jurisdiction to deal with applications or appeals against the actions of government regulators. The tribunal does not have a general power to deal with a complaint that the Commissioner ‘did not exercise its duty judiciously in following Data Protection/GDPR rules’. It does not have a general power to deal with complaints that the Commissioner has made decisions based on Civil Procedure Rules rather than Data Protection/GDPR rules.[8]In relation to the DPA and GDPR, the tribunal’s jurisdiction is limited. The only potentially applicable challenge that can be made to the tribunal about the Commissioner’s action in relation to a complaint by an individual of a breach of the GDPR/DPA is an application under section 166.[9]For those reasons, to the extent that the appeal/application made by the Applicant is something other than a complaint under section 166, it has no reasonable prospects of success.[10]Although the Applicant does not consider that she has made a section 166 application, I have considered whether or not to strike the Application out on the alternative basis that it is indeed a section 166 application.[11]The matters raised by the Applicant in the grounds of application are: 11.1. Despite the Applicant providing evidence of her request for the Data Processor’s officer contact details and the controller’s lack of a response, the Commissioner did not follow this up to ascertain that the data processor was in compliance with the GDPR. 11.2. The Commissioner did not check that in processing the Applicant’s details, the controller used her details in a way which was fair. The Commissioner did not take account of the impact of the use of the data on the Applicant’s right to a fair trial. The Commissioner did not ‘take the correct action against the Data Processor in investigating them’ 11.3. The Commissioner did not validate the appropriateness of the controller’s processes in relation to the accuracy of the data they held neither did they read the Applicant’s evidence which highlighted the inaccuracy of the data held and processed about her. 11.4. The Commissioner did not follow the checklist procedure in ascertaining the accuracy of the data the controller held about the Applicant but rather took their word which is a breach of GDPR and CPR rules. 11.5. The Commissioner did not follow their own checklist procedure by checking that the Applicant’s right to rectification – stopping the processing of my old address - was adhered to and was adhered to within the one-month time limit.[12]It is clear from the grounds of appeal that the Applicant is not simply disagreeing with the outcome. She also asserts that the Commissioner has not investigated appropriately.[13]The extent to which the tribunal can consider the appropriateness of the steps taken by the Commissioner to investigate the complaint is set out in paragraphs 83-88 and 116 of the Upper Tribunal’s decision in Killock & Veale & ors v Information Commissioner[2021]UKUT 299 (AAC): “83. We agree however with Ms Lester’s submission that a s.166 order should not be reduced to a formalistic remedy and that the various elements of s.166(2) have real content in the sense of ensuring the progress of complaints. Parliament has empowered the Tribunal to make an order requiring the Commissioner to take appropriate steps to respond to a complaint (s.166(2)(a)). Any such steps will be specified in the order (s.166(3)(a)). Appropriate steps include “investigating the subject matter of the complaint, to the extent appropriate” (s.165(5)(a)).84. There is nothing in the statutory language to suggest that the question of what amounts to an appropriate step is determined by the opinion of Commissioner. As Mr Black submitted, the language of s.165 and s.166 is objective in that it does not suggest that an investigative step in response to a complaint is appropriate because the Commissioner thinks that it is appropriate: her view will not be decisive. Nor has Parliament stated that the Tribunal should apply the principles of judicial review which would have limited the Tribunal to considering whether the Commissioner’s approach to appropriateness was reasonable and correct in law. In determining whether a step is appropriate, the Tribunal will decide the question of appropriateness for itself.85. However, in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. The GRC is a specialist tribunal and may deploy (as in Platts) its non-legal members appointed to the Tribunal for their expertise. It is nevertheless our view that, in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations. As Mr Milford emphasised, her decisions about these matters will be informed not only by the nature of the complaint itself but also by a range of other factors such as her own regulatory priorities, other investigations in the same subject area and her judgment on how to deploy her limited resources most effectively. Any decision of a Tribunal which fails to recognise the wider regulatory context of a complaint and to demonstrate respect for the special position of the Commissioner may be susceptible to appeal in this Chamber.86. We do not mean to suggest that the Tribunal must regard all matters before it as matters of regulatory judgment: the Tribunal may be in as good a position as the Commissioner to decide (to take Mr Milford’s example) whether a complainant should receive a response to a complaint in Braille. Nor need the Tribunal in all cases tamely accept the Commissioner’s judgment which would derogate from the judicial duty to scrutinise a party’s case. However, where it is established that the Commissioner has exercised a regulatory judgment, the Tribunal will need good reason to interfere (which may in turn depend on the degree of regulatory judgment involved) and cannot simply substitute its own view.87. Moreover, s.166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question. We do not rule out circumstances in which a complainant, having received an outcome to his or her complaint under s.165(b), may ask the Tribunal to wind back the clock and to make an order for an appropriate step to be taken in response to the complaint under s.166(2)(a). However, should that happen, the Tribunal will cast a critical eye to assure itself that the complainant is not using the s.166 process to achieve a different complaint outcome.88. The same reasoning applies to orders under s.166(2)(b) requiring the Commissioner to inform the complainant of progress on the complaint or of the outcome of the complaint within a specified period. These are procedural matters (giving information) and should not be used to achieve a substantive regulatory outcome. … 116. As we have explained above, s.166 is a procedural, not a substantive, remedy which provides for a right of appeal to the Tribunal on process, where the Commissioner fails to address a complaint under s.165 DPA 2018 in a procedurally proper fashion. However, as we have concluded above, the appropriateness of the investigative steps taken by the Commissioner is an objective matter which is within the jurisdiction of the Tribunal and is not something solely within the remit of the Commissioner to determine for herself…[14]Thus it is within the tribunal’s jurisdiction to consider the appropriateness of the investigative steps taken by the Commissioner and, although section 166 is a forward looking provision the Upper Tribunal did not rule out circumstances in which a complainant, having received an outcome to his or her complaint under s.165(b), may ask the Tribunal to wind back the clock and to make an order for an appropriate step to be taken in response to the complaint under s.166(2)(a).[15]Having considered the grounds of Application, the response and the reply, along with the attached documents, it is evident to me that that the Commissioner complied with his statutory duties in this case in that he:(i) handled the Appellant’s complaint promptly,(ii) took appropriate steps to investigate the complaint to the extent appropriate in the circumstances, and(iii) informed the Appellant of the outcome of the complaint.[16]Having looked at the steps taken by the Commissioner as set out in the documents before me, I have considered whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance), prospect of the Application succeeding at a full hearing. Taking into account the Commissioner’s role as expert regulator in this field, I find that there are no reasonable prospects of the tribunal concluding that the Commissioner had not taken appropriate steps to investigate the complaint.[17]To the extent the Applicant wishes to object to the Commissioner’s reliance on the CPR in its outcome letter, this is a challenge to the outcome and the tribunal has no power to deal with this. This aspect accordingly has no reasonable prospect of success.[18]I have considered whether I should exercise my discretion to strike the Application out. Taking into account the overriding objective, it is a waste of the time and resources of the Applicant, the tribunal and the Commissioner for this Application to be considered at a final hearing. In my view it is appropriate to strike the Application out.[19]As the Commissioner correctly states at paragraph 30 of his response, if the Applicant wishes to seek an order of compliance against the Controller for breach of their data rights, the correct route for them to do so is by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA18.[20]For the above reasons the Application is struck out under rule 8(3)(c). Signed Sophie Buckley Judge of the First-tier Tribunal Date: 27 July 2023 Promulgated: 28 July 2023