Christopher Stevens v The Information Commissioner [2024] UKFTT 448 (GRC)

[2024] UKFTT 00448 (GRC)Case Reference: EA-2023-0526-GDPR
First-tier Tribunal
General Regulatory Chamber
Date 05 June 2024
Section 166 DPA 2018
Before
tribunal Judge BUckley
Between
CHRISTOPHER STEVENSApplicantThe Information commissionerRespondentJUDGE BUCKLEYSitting in Chamberson 17 May 2024DECISION
[1]The application under section 166 of the Data Protection Act 2018 is STRUCK OUT.

REASONS

[2]In this decision, ‘the Application’ is a reference to the application made to the tribunal by Mr. Christopher Stevens under section 166 of the Data Protection Act 2018 (DPA) and ‘the Applicant’ is a reference to Mr. Stevens[3]The Commissioner applies for the Application to be struck out under rule 8(3)(c) (no reasonable prospects of success) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.[4]The Commissioner submits that the remedies sought by the Applicant are not outcomes that the tribunal can grant in a section 166 application against the Commissioner. The Commissioner submits that he has taken steps to investigate and respond to this complaint and provided an outcome on 25 July 2023 together with a case review on 12 September 2023.[5]The Commissioner submits that it is apparent that the Applicant is of the view that their information rights continue to be infringed, however he submits that if the Applicant wishes to seek an order of compliance against the Controller for breach of their data rights, the correct route for them to do so is by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA 2018.[6]The Commissioner submits in addition that the tribunal has no jurisdiction to consider any application under the Equality Act 2010.[7]The Applicant responded to this application by way of a submissions made in email dated 22 February 2024 and by way of a document entitled ‘Further considerations in relation to the response from the ICO by paralegal Michelle Jones’. Those submissions are extensive and I not summarise them here, but I have read and taken into account all the matters raised in those documents, in so far as they are relevant to the prospects of success of the application under section 166. Discussion and conclusions Grounds of Application

Discussion and conclusions

[8]The grounds of the Application to the tribunal are set out in box 5a. The grounds are: 8.1. Ground 1: The Commissioner has allowed LV to rely on an exemption under DPA or FOIA in a ‘blanket fashion’. 8.2. Ground 2: The Commissioner did not undertake a ‘prejudice test’ in relation the section 43(2) of FOIA. 8.3. Ground 3: There is a tension between a private body acting as a public body under the Equality Act 2010, which includes financial bodies such as insurers, and the Freedom of Information Act 2010 (FOIA) not applying to the insurer. 8.4. Ground 4: Commercial sensitivity is a time sensitive qualified exemption and this needs to be shown. 8.5. Ground 5: Although not specifically listed as ground 5, the grounds of application also seem to allege that the Commissioner has failed to comply with the public sector equality duty, and that both the Commissioner and LV are guilty of indirect discrimination under section 19 of the Equality Act 2010. In his response to the strike out application, the Applicant explains that this is an allegation that the Commissioner failed to take appropriate steps because he did not comply with the requirements of the Equality Act 2010.

Summary of reasons

[9]In summary these are the reasons why these grounds have no reasonable prospects of success.[10]Ground 1, in so far as it relates to the DPA, is a substantive challenge to the outcome of the complaint made to the Commissioner under section 165 DPA. For the reasons set out below, the tribunal has no power to consider the merits of the substantive conclusions of the Commissioner, as set out in the outcome letter.[11]In so far as ground 1 relates to FOIA, the tribunal has no power to determine whether LV has complied with FOIA. The same applies to grounds 2 and 4.[12]Ground 3 has no reasonable prospects for a number of reasons which are dealt with in detail below. In essence the tribunal has no power to consider FOIA in this Application because this is not an appeal against a decision notice made under FOIA. This is so whether or not LV is a public authority under the Equality Act.[13]Ground 4 appears to be related to section 43 FOIA. If so it is outside the remit of the tribunal as set out above. If it is intended to be an argument under the DPA, it is a substantive challenge to the outcome of the complaint and has no reasonable prospects for the same reasons as ground 1.[14]Ground 5 has no reasonable prospects because once an outcome has been given by the Commissioner, challenges to the lawfulness of the process by which it can be reached or to its rationality are a matter for judicial review by the High Court, and not a matter for the tribunal. The question of whether LV or the Commissioner breached the Equality Act 2010 is not a matter for this tribunal.

Detailed reasons

[15]In his grounds of appeal and his responses to the strike out application, the Appellant makes a number of references to provisions in the Freedom of Information Act 2000 (FOIA).[16]The Commissioner has a number of different functions. He has functions in relation to how data controllers handle personal data in accordance with the Data Protection Act 2018 and the UKGDPR and he has functions in relation to how public authorities respond to requests for information under the Freedom of Information Act 2000.[17]For example, under section 50 FOIA a person may apply to the Commissioner for a decision whether a public authority has dealt with a request for information in accordance with the requirements of Part 1. Part 1 FOIA sets out what a public authority must do in response to a request for information.[18]If the Commissioner makes such a decision, he must serve a ‘decision notice’ on the complainant and the public authority. Under section 57 there is a right to appeal to the First-tier Tribunal (information rights) against that decision notice.[19]If an appeal is made to the tribunal against a decision notice served under section 50 the tribunal will, in effect, stand in the shoes of the public authority and the Commissioner and decide whether the information should have been released or if it is exempt.[20]Under section 57 the tribunal can also deal with appeals by a public authority against a decision notice or an enforcement notice under FOIA.[21]Bodies that are not public authorities have no obligations under FOIA. It does not apply to them. If an individual makes a complaint about how a body other than a public authority has handled a request for information, the Commissioner has no power to consider whether that body has complied with FOIA.[22]In his Grounds of Application, the Applicant accepts that the organisation in question, Liverpool Victoria Insurance Company Limited (LV), is not a public authority under FOIA. That concession is appropriately made because it is simply not arguable that a private insurer is a public authority under FOIA. It does not exercise functions of a public nature.[23]Although the Applicant acknowledges this in his notice of appeal, he submits that there is a ‘tension’ because he says that under the Equality Act 2010, LV acts as a public authority and it is recognised as such.[24]This argument does not assist him. Even if LV were a public authority for the purposes of the Equality Act, that would not make it a public authority for the purposes of FOIA. They are different pieces of legislation with different lists and different definitions of public authority.[25]In any event, the Applicant has not produced any argument or authority in support of his assertion that LV are a public authority under the Equality Act. Although it is not a matter for this tribunal and therefore not material to my decision, I note that LV is a private insurance company. LV is not listed as a public authority in schedule 10 of the Equality Act 2010. It does not carry out a public function. It is therefore highly unlikely to be a public authority under the Equality Act and subject to the public sector equality duty.[26]As LV is not a public authority under FOIA, the Commissioner had no power to consider whether LV had complied with FOIA. The Commissioner did not make any decision under FOIA. He has not served a decision notice under section 50 FOIA. There is therefore no right of appeal under section 57 FOIA.[27]In those circumstances the provisions of the Freedom of Information Act 2000, have no relevance to this Application. In so far as the Notice of Application or the response to the strike out application rely on or refer to the provisions of FOIA, such as the exemption in section 43 FOIA or the right to appeal under section 57 FOIA, those provisions cannot assist the Applicant.[28]In addition to its role under FOIA, the Commissioner also has certain duties in relation to complaints about the handling of personal data by any data controller, not just by a public authority. These are not governed by FOIA. Under section 165 DPA 2018 a data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of part 3 or 4 of the DPA.[29]In response to that complaint the Commissioner is, in essence, required to: 29.1. Take appropriate steps to respond to the complaint. 29.2. Inform the complainant of the outcome of the complaint. 29.3. Information the complainant of their rights under section 166 (see below). 29.4. If asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.[30]Under section 166 DPA a data subject has the right to make an application to the tribunal for an order by the tribunal that the Commissioner take certain procedural steps to progress a complaint under section 165, or that the Commissioner inform the applicant of progress on the complaint or of the outcome of the complaint.[31]At the time that the Application was made, the appropriate application form was form ‘T-98’ which is entitled ‘Notice of appeal or application’. Section 3 is entitled ‘About the decision or notice you are appealing against’ and includes a box for the ‘decision notice reference number’.[32]The title of section 3 does not fit well with an application made under section 166 DPA. A section 166 application is, importantly, not an appeal against a decision of the Commissioner. Further, there is no ‘decision notice’ in complaints to the Commissioner under section 156.[33]It is a common misconception that the tribunal is able to hear an appeal against a ‘decision’ by the Commissioner (more accurately an outcome) arising out of a complaint to the Commissioner about a breach of data protection law. It cannot. Parliament has not given the First-tier Tribunal the power to deal with appeals against the ‘decision’ or the substantive outcome of those complaints. Nor has it given the First-tier Tribunal the power to deal with claims that the body in question has breached data protection law. Parliament decided that those claims should be dealt with by other courts.[34]The ‘decision notice reference’ that the Applicant has specified in the box in section 3 of the Notice of Application is ‘IC-239682-B1L9’. That is the reference number of the outcome that the Commissioner gave to the Applicant’s complaint to the Commissioner on 16 June 2023. That complaint was about how LV had handled a request for information relating to an increase in the cost of his mother’s insurance policy.[35]Presumably because LV is not a public authority, the Commissioner treated that complaint as a complaint under section 165 that LV had breached data protection laws. It is not clear to me from the Applicant’s complaint to the Commissioner what breach of the data protection laws was being alleged.[36]One of the rights under DPA is an individual’s right to obtain a copy of their personal data by making what is often referred to as a ‘subject access request’. The Commissioner may have understood the complaint to be that LV had not responded adequately to a subject access request made to LV.[37]I have considered the request made by the appellant to LV and it is not entirely clear to me whether it was a request for a copy of personal data. If it was not, there would not, on these facts, be any right to complain to the Commissioner at all, so for the purposes of the strike out application I will assume that it was a request for personal data.[38]The Commissioner took a number of steps to attempt to obtain further information about the complaint from the Applicant, reviewed the correspondence and documentation provided by the Applicant and formed the view that LV’s response to the Applicant’s request was not in breach of data protection legislation.[39]It sent the Applicant an outcome letter dated 25 July 2023, which included the following:
“The ICO have considered the information you have provided, and it is our view that LV’s refusal of your request would not be in breach of the data protection legislation. In their email dated 16 June 2023 LV provided information about factors they take into account when calculating renewal premiums. They also provided you with a link to information about how they calculate premiums. However LV explained: “We base our renewal premiums on various underwriting criteria. Underwriting refers to the rules and processes with which we would look to offer and provide insurance based on the total risk of all of the information given. As an insurance provider, we cannot disclose specific underwriting criteria, as it underpins how we operate as a business”
It is important to understand that the right of access does not provide a right to receive information relating to an organisations internal business processes. Consequently, it is the ICO’s view that LV would be able to rely on legitimate interests as a lawful basis for refusing your request. We have not identified any evidence that LV’s refusal to provide the information you requested would be in reach of the requirements of the data protection legislation. Therefore we do not propose to consider this matter further and we will close our file accordingly.”[40]This tribunal has no power to consider whether the reasoning or the conclusions in that outcome letter are sound. That is simply not a matter for this tribunal.[41]On an application to the tribunal under section 166, the tribunal has no power to deal with the merits of the complaint to the Commissioner or its outcome (confirmed in Killock & Veale & ors v Information Commissioner[2021]UKUT 299 (AAC) (Killock & Veale).[42]Further, once an outcome to a complaint has been provided, the tribunal has no power retrospectively to order the Commissioner to take appropriate steps to respond to the complaint, where that might lead to a different outcome. That is because once a decision has been reached, challenges to the lawfulness of the process by which it can be reached or to its rationality are a matter for judicial review by the High Court, and not a matter for the tribunal. (Killock & Vealeand R (on the application of Delo) v Information Commissioner and Wise Payments Limited [2022] EWHC 3046 (Admin), upheld by the Court of Appeal at [2023] EWCA Civ 1141.[43]A complaint that the Commissioner was ‘procedurally correct’ in not following what is stipulated in the Equality Act 2010 is not a matter in relation to which the tribunal has jurisdiction under section 166. Once a decision has been reached, challenges to the lawfulness of the process by which it can be reached or to its rationality are a matter for judicial review by the High Court, and not a matter for the tribunal.[44]I do not accept that there is in this Application any challenge to the ‘appropriate steps’ taken by the Commissioner which would not involve reopening that outcome. I conclude therefore that this case does not fall within the narrow circumstances in which the tribunal might be able to make an order under section 166(2)(a) (appropriate steps to respond to the complaint) after the complainant has been informed of the outcome of their complaint.[45]For those reasons, I do not consider that there is any reasonable prospect of the tribunal making any order under section 166(2).[46]I have considered whether there is a realistic, as opposed to a fanciful (in the sense of it being entirely without substance), prospect of the Application succeeding at a full hearing. In my view, there are no reasonable prospects of the Application under section 166 succeeding.[47]I have considered whether I should exercise my discretion to strike the Application out. Taking into account the overriding objective, it is a waste of the time and resources of the Applicant, the tribunal and the Commissioner for this Application to be considered at a final hearing. In my view it is appropriate to strike the Application out.[48]As the Commissioner correctly states in his response, if the Applicant wishes to seek an order of compliance against the Controller for breach of their data rights, the correct route for them to do so is by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA.[49]For the above reasons the Application is struck out. Signed Sophie Buckley Judge of the First-tier Tribunal Date: 17 May 2024