Dr Michael Guy Smith v The Information Commissioner [2024] UKFTT 266 (GRC)

[2024] UKFTT 00266 (GRC)Case Reference: EA-2023-0348-GDPR
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on: 20 March 2024Date 2 April 2024
Section 166 Data Protection Act 2018
Heard: By CVP
Before
tribunal Judge CARTERTRIBUNAL MEMBER STEPHEN SHAWTRIBUNAL MEMBER Aimee GASSTON
Between
DR MICHAEL GUY SMITHApplicantThe Information commissionerRespondent
[1]This decision is further to an application by Dr Michael Guy Smith (“the Applicant”) to the First-tier Tribunal (the “Tribunal”) under section 166(2) of the Data Protection Act 2018 (“DPA”). Under section 166 data subjects have a right to make a complaint to the Information Commissioner (“the Commissioner”) if they consider that the processing of personal data relating to them infringes the General Data Protection Regulation (“GDPR”), and/or Parts 3 or 4 of the DPA18: see Article 77 GDPR, and section 165(2) DPA. Under section 166 DPA, a data subject has a right to make an application to the Tribunal if the Commissioner has failed to take certain procedural actions in relation to their complaint.[2]Section 166 DPA provides:(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner— (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner— (a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.(3) An order under subsection (2)(a) may require the Commissioner— (a) to take steps specified in the order. (b) to conclude an investigation, or take a specified step, within a period specified in the order.[3]The Applicant complained to the Commissioner on 29 December 2022. He submitted two online complaint forms, the first of which concerned the Commissioner’s handling of the Applicant’s request made on 16 October 2020, for their previous cases to be retained beyond the Commissioner’s case retention period, under the right to restrict processing of their personal data. The Applicant’s second complaint concerned the Commissioner’s response to the Applicant’s request for their cases to be retained beyond the Commissioner’s case retention period, under the right to restrict processing of their personal data, made on 13 November 2022. In the second complaint form, the Applicant informed the Commissioner that the first complaint contained context relevant to their second complaint. Having reviewed the correspondence, the appointed case officer wrote to the Applicant, on 6 February 2023, advising that members of the Commissioner’s Information Access team had been contacted. The case officer confirmed that inquiries were being made about the Commissioner’s information rights practices and how the Applicant’s requests were handled. The Applicant was notified that they would receive an outcome to the Complaint once the inquiries were completed.[4]On 17 February 2023, the ICO case officer wrote to the Applicant with an outcome to the Complaint. The case officer confirmed that she had reached an outcome by reviewing correspondence between the Applicant and the Commissioner regarding the Applicant’s requests to restrict the processing of their personal data stored on the Commissioner’s case management system. The case officer also confirmed inquiries had been made with the Information Access team to understand the handling of the cases. The case officer explained that she was of the view that the Commissioner had complied with its obligations in data protection law, because the Applicant’s requests to restrict the processing of their personal data did not meet the threshold to engage Article 18 of the GDPR. In addition, the case officer explained how the Commissioner was complying with its data protection obligations regarding the Applicant’s requests to restrict the processing of their personal data.[5]The Applicant requested a case review of the outcome and on 25 July 2023, an ICO Reviewing Officer wrote to the Applicant to provide a review of the handling of the Applicant’s data protection complaint. The Reviewing Officer explained that the case officer investigated to the extent appropriate by considering the Applicant’s cases and providing the Applicant with a response to explain the decisions made in each case. The Reviewing Officer explained that she was of the opinion that the case officer had provided an appropriate explanation as to the reason Article 18(1)(c) did not apply. However, the Reviewing Officer provided further clarification in response to the Applicant’s query regarding the meaning of ‘threshold’ for Article 18(1)(c) to apply. The Reviewing Officer confirmed that she was satisfied that the case officer handled the Applicant’s complaint appropriately and in line with the ICO’s case handling procedures.[6]The Applicants grounds of appeal are set out below (and for case 1 see first complaint, and for case 2 see his second):
“Ground 1: In respect of case 1 the Commissioner has failed to take appropriate steps to respond to my complaint in virtue of failing to investigate the subject matter of my complaint, to the extent appropriate. Ground 2: In respect of case 2 the Commissioner has failed to take appropriate steps to respond to my complaint in virtue of failing to investigate the subject matter of my complaint, to the extent appropriate. Ground 3: The outcome which the Commissioner has sent me in response to my complaints is incompatible with the outcome of the Commissioner’s investigation into the subject matter of my complaints.”
Legal Framework[7]Section 166 of the DPA has been considered by the Upper Tier Tribunal, the High Court and the Court of Appeal. The following points were not in dispute between the parties:a. The Commissioner has a broad discretion to decide whether to investigate a complaint at all, and, if so, to what extent: R (Delo) v IC [2023] 1WLR 1327 (per Mostyn J at 57 and 62/63); R (Delo) v IC [2024] 1 WLR 263 (per Warby LJ at 80).b. It is principally for the Commissioner to determine what is an “appropriate” response to a complaint: Killock & Veale v IC [2002] 1 WLR 2241 at 85/86c. Section 166 is a procedural remedy. It is not a right of appeal and does not afford the data subject the right to challenge the substance of a complaint outcome.d. The appropriate remedy for such a challenge is an application for judicial review in the High Court, rather than an application under section 166.e. The remedy provided for by section 166 is essentially forward-looking. It is concerned with remedying ongoing procedural defences that stand in the way of the timely resolution of a complaint. That said, and whilst a data subject may not “wind back the clock and try by sleight of hand to achieve a different outcome” (see Delo per Mostyn J at 131), it is not ruled out that there are “circumstances in which a complaint, having received an outcome to his or her complaint under section 165(b), may ask the Tribunal to wind back the clock and to make an order for an appropriate step to be taken in response to the complaint under section 166(2)(a)” - Killock and Veale, para 87. Two caveats follow in this Upper Tier Tribunal, the first in paragraphs 85/86 of the decision that the Tribunal has to respect the special position of the Commissioner and have a good reason to interfere with the Commissioner’ regulatory judgement and cannot simply substitute its own view. The second caveat, further to paragraph 87 of Killock & Veale, is that the Tribunal must cast a critical eye to assure itself that the complainant is not using the section 166 process to achieve a different complaint outcome. Decision[8]Further to the above, and in the Tribunal’s view, the case turned principally on whether the narrow window of circumstance anticipated in Killock & Veale in which ‘winding back the clock’ was lawful, applied here. In the Tribunal’s view it did not.[9]First, the Tribunal relied upon the broad discretion given to the Commissioner to decide whether to investigate a complaint at all, and, if so, to what extent and that it is principally for the Commissioner to determine what is an “appropriate” response to a complaint. The Upper Tribunal in Killock & Veale recognised the Commissioner’s position as an “expert regulator” and stated at [76] that “[s]he is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome”.[10]It asked itself whether there was a good reason to interfere with the Commissioner’s regulatory judgement. It noted that the Tribunal was to respect the special position of the Commissioner in this regard. The Applicant urged the Tribunal not to tamely accept this on the basis that the Commissioner is “plainly a biased regulator”: the Commissioner has a motive in effect not to follow a procedurally proper investigation on account of the prior dealings with the Applicant and the various strands of litigation being pursued by the Applicant against the Commissioner and that it had pre-determined the outcome of the investigation undertaken. The Tribunal concluded that the assertions above were, on the basis of the evidence before the Tribunal, speculative and unproven.[11]On this basis, and paying appropriate respect to the Commissioner as the expert regulator, the Tribunal did not consider that it had a good reason to interfere with the Commissioner’s regulatory judgement.[12]In this regard, the Tribunal took into account the email adduced in evidence by the Applicant between two Commissioner employees with regard to the outcome of the investigation. The Tribunal took the view however this did no more than indicate that a lessons learned process should follow the outcome. It did not lead to a conclusion of fact (on the basis of being more likely than not) that there was a view internally that there had been a breach of data protection obligations on the part of the Commissioner. Nor did it lead to a conclusion that the outcome communicated to the Applicant on 17 February 2022 was only “an” outcome and not “the” outcome (which the Applicant sought to argue from this email was that there had been a breach of data protection obligations). This finding disposed of the Applicant’s third ground of appeal, that the outcome which the Commissioner sent him in response to his complaints is incompatible with the outcome of the Commissioner’s investigation in the subject matter of his complaints. The Tribunal dismissed this ground of appeal on the basis that he had received communication of “the” outcome of his complaints on the 17 February 2022 and this was not incompatible with what the Applicant alleged was indicated in the email cited above. In light of the Tribunal’s interpretation of this email, it did not consider this showed any failure of disclosure on the part of the Commissioner.[13]In any event, the Tribunal took the view that on the basis of the investigative steps said by the Commissioner to have been taken, there was nothing before it that gave rise to any indication that the Commissioner had not carried out an adequate investigation. There was no reason, in the Tribunal’s view, not to accept the Commissioner’s word in relation to the steps actually taken. Thus the Commissioner, in the Tribunal’s view, had considered the Applicant’s complaint, reviewed the correspondence stored on the Commissioner’s case management system, engaged with the IA team and inquired about the handling of the Applicant’s requests. By providing the Applicant with an outcome on 17 February 2023, further clarification on 27 February 2023 and a case review of that outcome on 25 July 2023, the Commissioner had taken, what the Tribunal concluded, were appropriate steps to investigate and respond to the Applicant’s complaint within the requirements of the legislation.[14]The Applicant argued that the Commissioner was subject to a ‘duty of candour’ and referred the Tribunal to the statement to this effect in the case management decision of Judge Neville on 16 February 2024. He argued that this required disclosure of the evidence underpinning the steps in the investigation said to be taken. The Tribunal noted that Judge Neville had already refused an application for specific disclosure to this effect.[15]The Tribunal did not consider it was bound to make any findings upon whether or not the Commissioner was subject to a ‘duty of candour’ as such, as in any event, the evidence and arguments before it did not substantiate any failure of disclosure. The Tribunal took the view that, whilst it had decided, in the alternative and to assist with finality on this matter, to form a view on the adequacy of the investigation followed, this in and of itself did not require the Commissioner to provide witness statements or make disclosure of all of the underlying evidence.[16]With regard to the second caveat in Killock & Veale, the Tribunal did not accept the Commissioner’s argument that the Applicant was plainly using the section 166 process to achieve a different complaint outcome to his complaints. It accepted that whilst he admitted he did wish for a different outcome, this was not conclusive of the issue. His motivation for making the application was, in part, to shed light on what he believed to be procedural irregularity and involved arguments (for instance, with regard to the duty of candour and the circumstances in which the Tribunal could legitimately ‘wind back the clock’) which, if accepted, would have a wider impact on the operation of the legislative process and the duties of the Commissioner in responding to such section 166 applications.[17]Whilst acknowledging this wider purpose, for the reasons set out above, the Tribunal dismisses this application and does not require the Commissioner to take any further steps.[18]Finally, the Applicant invited the Tribunal to find that there had been a breach of the overriding objective further to the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended). The Tribunal noted that Mr Justice Neville had been invited so to find in a case management hearing and had declined to do so. Nothing that the Applicant had put before the Tribunal on this occasion led to a different view. Judge Carter Judge of the First-tier Tribunal Date: 1 April 2024