Gilbert Robertson v The Information Commissioner [2024] UKFTT 630 (GRC)

Case Reference: FT/EA/2024/0096/GDPR[2024] UKFTT 00630 (GRC)
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on: 3 July 2024Date 19 July 2024
Information Rights
Heard: Determined on the papers
Before
RECORDER CRAGG KC sitting as a Judge of the FTT
Between
GILBERT ROBERTSONAppellantTHE INFORMATION COMMISSIONERRespondentDECISION ON STRIKE OUT APPLICATION1.Decision: The Respondent’s Strike Out Application dated 25 April 2024 made pursuant to rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal)(General Regulatory Chamber) Rules 2009 (“the Rules”) on the grounds that there is no reasonable prospect of the appeal succeeding, is granted.REASONS

LEGAL BACKGROUND

[1]A data subject has a right to make a complaint to the Commissioner if they consider that the processing of personal data relating to them infringes the General Data Protection Regulation (“GDPR”), and/or Parts 3 or 4 of the Data Protection Act 2018 (DPA) see section 165(2) DPA.[2]Under section 166 DPA, a data subject has a right to make an application to the Tribunal if the Commissioner has failed to take certain procedural actions in relation to their complaint. Section 166 DPA states as follows:-(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner— (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner— (a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.(3) An order under subsection (2)(a) may require the Commissioner— (a) to take steps specified in the order. (b) to conclude an investigation, or take a specified step, within a period specified in the order.(4) …[3]Case law establishes that an application under s166 DPA is not concerned with the merits of the underlying complaint or intended to provide a right of challenge to the substantive outcome of the Commissioner’s investigation into that complaint. This was most recently confirmed in the case of R (Delo) v Information Commissioner [2022] EWHC 3046 (Admin). In that case Mostyn J said:-129. In Killock and Veale v ICO (Information rights - Freedom of Information - exceptions: practice and procedure) [2021] UKUT 299 (AAC) Farbey J and UTJ De Waal held at [74]: “The remedy in s.166 is limited to the mischiefs identified in s.166(1). We agree with Judge Wikeley’s conclusion in Leighton (No 2) that those are all procedural failings. They are (in broad summary) the failure to respond appropriately to a complaint, the failure to provide timely information in relation to a complaint and the failure to provide a timely complaint outcome. We do not need to go further by characterising s.166 as a “remedy for inaction” which we regard as an unnecessary gloss on the statutory provision. It is plain from the statutory words that, on an application under s.166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the s.166 remedy as reflecting the provisions of Article 78(2) which are procedural. Any attempt by a party to divert a Tribunal from the procedural failings listed in s.166 towards a decision on the merits of the complaint must be firmly resisted by Tribunals”130. I fully agree with this… 131…..if an outcome has been pronounced, I would rule out any attempt by the data subject to wind back the clock and to try by sleight of hand to achieve a different outcome by asking for an order specifying an appropriate responsive step which in fact has that effect.[4]Thus, it is now well established that an application under section 166 is not concerned with the merits of the underlying complaint or intended to provide a right of challenge to the substantive outcome of the Commissioner’s investigation into that complaint. The Tribunal does not have the power to alter the conclusion reached by the Commissioner on a complaint. Neither does the Tribunal have an oversight role over the Commissioner’s exercise of his functions or internal processes.[5]The Tribunal has the power to strike out the present application under rule 8(3)(c) of the Tribunal Rules on the ground that it has no reasonable prospect of success. The phrase ‘reasonable prospect of success’ has been explained by the Court of Appeal in Swain v Hillman & Another [1999] EWCA Civ 3053 in the context of considering the phrase for the purposes of summary judgment under Part 24 of the CPR at [7]:
“…the court now has a very salutary power, both to be exercised in a claimant's favour or, where appropriate, in a defendant's favour. It enables the court to dispose summarily of both claims or defences which have no real prospect of being successful. The words "no real prospect of being successful or succeeding" do not need any amplification, they speak for themselves. The word "real" distinguishes fanciful prospects of success or, as Mr Bidder submits, they direct the court to the need to see whether there is a "realistic" as opposed to a "fanciful" prospect of success.”
[6]In this case, by way of a Notice of Application dated 14 March 2024, the Applicant made an application to the First-tier Tribunal (the Tribunal) under section 166(2) DPA. The Commissioner opposes the application and invites the Tribunal to strike it out under rule 8(2)(a) and/or 8(3)(c) of the Tribunal Rules on the grounds either(i) that the Tribunal is without jurisdiction to consider the application or(ii) that it has no reasonable prospect of succeeding:- Rule 8(2)(a) (2)The Tribunal must strike out the whole or a part of the proceedings if the Tribunal— (a) does not have jurisdiction in relation to the proceedings or that part of them. Rule 8(3)(c) (3) The Tribunal may strike out the whole or a part of the proceedings if— (c) the Tribunal considers there is no reasonable prospect of the appellant's case, or part of it, succeeding.

FACTUAL BACKGROUND

[7]The Applicant’s case involves his attempts to obtain data about himself from the Defence Business Services Civilian Personnel (DBSCP), through a Subject Access Request (SAR). In particular, the Applicant wanted to access information related to his dismissal from the Royal Fleet Auxiliary (RFA), a naval auxiliary in the Ministry of Defence (MOD).[8]The Applicant submitted a complaint to the Commissioner, together with some supporting evidence and, on 19 March 2024, an Information Commission Office (ICO) case officer contacted the Applicant and the data protection officer at the MOD to explain, that based on the evidence provided, they are unable to determine whether the MOD had fully complied with the requirements of the data protection legislation. As a part of the decision outcome, the MOD was instructed to review the handling of the Applicant’s SAR, ensuring that all information he is entitled to receive has been provided. The MOD had 14 days to provide the Applicant with the outcome of that review and to respond to the questions listed in the complaint, including a full explanation of the exemptions that may have been used if any information in response to his SAR had been withheld.[9]There was further correspondence and the Applicant received a response from the MOD. The ICO told him that if he had further complaints about the outcome then he would need to take these up with the MOD.[10]The Applicant issued a Notice of Application dated 14 March 2024. The Applicant says as follows:- I was dismissed from the Royal Fleet Auxiliary. A short time later, I received a letter from Defence DBS Civilian Personnel saying I was dismissed from the organisation for "inefficiency reasons". As I was quite offended by this terminology, I quizzed DBS Civilian Personnel on their choice of wording in their letter to me. When they contacted the Royal Fleet Auxiliary on my behalf, they stated that one of the reasons for my dismissal was because I had failed to renew an ENG-1 medical on time. I request a copy of the document (or documents) from the Royal Fleet Auxiliary that confirm I had failed to renew an ENG-1 medical on time. A copy of this file should be easily obtained from my personnel records, but as the Royal Fleet Auxiliary claim there is no mention of me having failed to renew a medical on time, I escalated this matter to the ICO (on 12-Dec-23).[11]The Commissioner’s response was that the Applicant’s grounds are beyond the narrow matters that the Tribunal has to consider when making an order under section 166(2) DPA.

DISCUSSION

[12]I have considered both parties’ representations and concluded that this is an appeal which cannot be permitted to go any further and should be struck out.[13]This is because of the very limited right to apply to the Tribunal set out in s166(2) DPA. As the case law set out above this right to apply does not engage the content of the response made by the Commissioner, but just enables the Tribunal to make an order that that appropriate steps to respond to the complaint have been made and/or to inform the complainant of progress on the complaint, or of the outcome of the complaint[14]What s166 DPA does not provide is any kind of avenue of challenge to an outcome with which the Applicant is dissatisfied, or any kind of substantive remedy. Given that the application of s166 DPA is limited to communicating the status of the Commissioner’s consideration of a complaint of which he is seized to the data subject, it also necessarily ceases to have application once the Commissioner has concluded his consideration of the complaint and communicated the outcome to Applicant. Section 166 DPA by its terms applies only where the claim is pending and has not reached the outcome stage.[15]It is clear in this case that the Commissioner has taken appropriate steps to respond to the Applicant and has reached and communicated an outcome in the case. I recognise, of course, that the Applicant is dissatisfied with the outcome communicated by the Commissioner, but the DPA (as confirmed by the case law cited above) does not provide a right to apply to the Tribunal to challenge that outcome. As the Commissioner points out if the Applicant wishes to seek an order of compliance against the MOD for breach of data rights, the correct route to do so is by way of separate civil proceedings in the County Court or High Court pursuant to s167 DPA.[16]In my view, given the limited nature of the application rights and the Tribunal powers under s166(2) and (3) DPA, the application has no prospect of success, and the application is struck out under rule 8(3)(c) of the Tribunal Rules.