Christopher Hart v The Information Commissioner [2025] UKFTT 38 (GRC)

[2025] UKFTT 00038 (GRC)Case numbers: EA.2018.0239.GDPREA.2018.0240.GDPREA.2019.0022.GDPREA.2019.0023.GDPREA.2019.0033.GDPREA.2021.0130.GDPREA.2021.0144EA.2022.0206.GDPREA.2022.0420.GDPREA.2023.0083EA.2023.0251EA.2023.0057Before: District Judge MoanAppellant: Christopher HartRespondent: Information CommissionerORDER
Between
Christopher HartClaimantThe Information CommissionerDefendantDate 2025-01-15
[1]The Tribunal issued a stay of proceedings at the request of the Appellant due to ill-health on 10th January 2024. This followed on from previous stays for the same reason. The stay expired on 29th February 2024.[2]No application was made to lift to stay and the stay lapsed. The Appellant confirmed on 6th March 2024 that he was not making an application to lift the stay.[3]The Order dated 23rd December 2024 did not make any decisions on the Appellant’s appeals/applications but confirmed that the stay had lapsed and no application had been made to lift the stay. The Order was issued to confirm administratively that the appeals had lapsed due to inactivity/being abandoned.[4]The Appellant has made an application dated 26th December 2024 to reinstate his appeals/applications indicating that he believed the stay ended in February 2024 and that he wished for his cases to be active again.[5]The Tribunal has applied the overriding objective to the application and has reviewed each application/appeal individually.[6]Where separate directions are made that require the action from parties, they will be replicated in a separate Order to assist the Appellant. A summary will be provided in this Order. The Tribunal apologises about the length of this document but the Appellant has many appeals and applications to be considered.

It is ORDERED that:

[7]The following appeals EA.2018.0239.GDPR, EA.2018.0240.GDPR, EA.2019.0022.GDPR, EA.2019.0023.GDPR, EA.2019.0033.GDPR, EA.2021.0130.GDPR, EA.2022.0206.GDPR and EA.2022.0420.GDPR are not reinstated and will be struck out under Rule 8(2)(a). The reasons are included in this document.[8]Appeal EA.2021.0144 is not reinstated and will be struck out. A separate decision notice is provided.[9]The following appeals EA.2023.0083 and EA.2023.0251 are reinstated. Case management directions are provided in a separate document.[10]The Appellant has an appeal FT/EA/2024/0424 which is listed for hearing on 9th April 2025 by CVP but also has a pending strike out application to be considered. A summary Order has been issued to confirm directions already given. That application will be reviewed on 20th January 2025.[11]The application for a review of the Order dated 8th June 2023 in case number EA.2023.0057 is refused. The application to certify a contempt in EA.2023.0057 is dismissed. A separate decision notice is provided.

Reasons:

[1]The Appellant’s appeals and applications were stayed between 7th September 2023 until 29th February 2024 due to his ill-health. The Appellant emailed the Tribunal on 28th February to update the Tribunal regarding his health. He did not clarify his position regarding the stay or the progress of his cases. On the 6th March 2023 the Appellant emailed the ICO’s office and said that “I have not sought to make a further application to extend the stay at this time.” That email was sent to the Tribunal.[2]The Appellant was not in contact with the Tribunal between April 2024 and December 2024 in regard to his stayed appeals, the perception of which was that the Appellant had abandoned his appeals. It appears that the Tribunal had issued a further appeal/application issued on 19th November 2024 under case number FT/EA/2024/0424. A strike out application has been made in this case and is awaiting a response from the Appellant.[3]The Appellant has confirmed in his application that he sought for his applications and appeals to be reinstated; and a review of the outstanding cases has taken place. Whilst there are matters that can proceed, there are applications which are considered suitable to be struck out, either because an application has been made for strike out or because the Tribunal itself considers that they cannot proceed. Those matters are the appeals marked as GDPR.[4]Details of the outstanding GDPR cases that the Appellant sought to reinstate - EA.2018.0239.GDPR The Appellant made an application to the Tribunal after receiving an outcome from the ICO on 31st August 2017 following a data complaint. The Appellant complains about the investigation and the outcome. EA.2018.0240.GDPR The Appellant made an application to the Tribunal after receiving an outcome from the ICO on 17th October 2018 following a data complaint. The Appellant complains about the investigation and the outcome. EA.2019.0022.GDPR The Appellant made an application to the Tribunal after receiving an outcome from the ICO on 18th December 2018 following a data complaint. The Appellant complains about the investigation and the outcome. EA.2019.0023.GDPR The Appellant made an application to the Tribunal after receiving an outcome from the ICO on 14th January 2019 following a data complaint. The Appellant complains about the investigation and the outcome. EA.2019.0033.GDPR The Appellant made an application to the Tribunal on 8th January 2019 before receiving an outcome from the ICO on 30th January 2019 following a data complaint made on 24th September 2018 which was being investigated by the ICO. His application was unclear as he had not received an outcome and did not seek progression, but referred to adding this case to the other cases he had to show a chronology of complaints against the ICO. EA.2021.0130.GDPR The Appellant made an application for an order to progress a data complaint after receiving an outcome on 5th May 2021 to the effect that the ICO did not consider his concerns to be within his remit and that the organisation concerned did not infringe data protection law. This was after an investigation and significant liaison between the Appellant and the ICO. EA.2022.0206.GDPR The Appellant made an application to the Tribunal after receiving an outcome from the ICO on 28th June 2022 following a data complaint. The Appellant complains about the ICO, corruption in the Tribunals and his human rights. The Respondent has applied to strike out the appeal under Rule 8(3)(c) and the Appellant has responded to that application. EA.2022.0420.GDPR The Appellant made an application to the Tribunal after receiving an outcome from the ICO on 28th June 2022 following a data complaint. Whilst there were ongoing conversation between the Appellant and ICO about implementation, the complaint had been concluded. The Respondent has applied to strike out the appeal under Rule 8(3)(c) and the Appellant has responded to that application.[5]There is a widespread misunderstanding about the role of the Commissioner when handling data protection complaints. The Commissioner retains wide discretion as to whether to investigate and what steps should be taken. The Court of Appeal at paragraph 80 of R (Delo) v The Information Commissioner [2023] EWCA Civ 1141 described the remit of the Commissioner as follows:
“the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold,…. that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint.”
And at paragraph 94 – “It must be legitimate for the Commissioner, when deciding how to deploy the available resources, to take account not only of his own view of the likely outcome of further investigation and the likely merits, but also of any alternative methods of enforcement that are available to the data subject.”

And at paragraph 94 –

[6]Scores of applicants apply for orders under section 166 which are in fact appeals against the outcome of the Commissioner’s outcome. They are often accompanied by long submissions, and even after strike out are followed by applications to review or even permissions to appeal. These applications utilise considerable resources of this Tribunal and the Commissioner. It is also the often the case, as it is here, that the same applicant makes repeated applications to the Tribunal despite having been provided with a comprehensive reasons previously why such an application cannot progress.[7]Even in cases where an outcome is yet to be provided at the time of the application, the application for an order to progress is often responded to by an outcome from the Commissioner, which is precisely what the process is designed to achieve – an outcome for the complainant.[8]The leading Upper Tribunal case on section 166 applications is Killock & others v Information Commissioner [2022] 1 WLR 2241. The High Court also considered similar issues in R (Delo) v Information Commissioner [2023] 1 WLR 1327 and the Court of Appeal considered that High Court decision in R (Delo) v The Information Commissioner [2023] EWCA Civ 1141.[9]More senior judges than the First Tier have consistently given guidance about applications under section 166 of the Data Protection Act 2018 which need not be set out in full here but the following core principles are that – (i). The Order sought is an order to progress a complaint; once a complaint has an outcome, the First Tier Tribunal cannot issue an order to progress a complaint which has concluded. Para 74 of Killock – “The remedy in s.166 is limited to the mischiefs identified in s.166(1)… those are all procedural failings. They are (in broad summary) the failure to respond appropriately to a complaint, the failure to provide timely information in relation to a complaint and the failure to provide a timely complaint outcome”. And the Court of Appeal inDelo at paragraph 64 – “An “outcome” must be the end point of the Commissioner’s “handling” of a complaint”. (ii). The First Tier Tribunal has no appellate jurisdiction to overturn or review the outcome of the Commissioner. Para 74 of Killock - “on an application under s.166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome”. (iii). The Tribunal has no supervisory function over the investigation of the Commissioner. Judicial review is the correct application when appealing against the discretion of a public body. Paragraph 66 of the Court of Appeal’s decision in Delo - … the Commissioner has a broad discretion to decide the intensity of any investigation, according to the facts of the matter: “the investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case…[this] plainly contemplates a case in which the supervisory authority does “act on” or handle a complaint but having done so ends up taking no action upon it. (iv). The Tribunal has no separate power to investigate or order a remedy regarding data processing complaints. Complainants have a remedy under section 167 of the DPA 2018 to bring proceedings against the data controller. (v). There are judicial remedies in accordance with the GDPR which allows law makers to provide for the nature of those remedies. The remedies provided are in the High Court for judicial review of the Commissioner, civil action is available against the data processor in the County Court under section 167 of the DPA 2018 and there is a complaints procedure against the Commissioner in the Parliamentary and Health Service Ombudsman, (vi). The Commissioner has six months to investigate the complaint. At the end of that six months, the applicant has 28 days to make an application for an order to progress.[10]Attempts to read into paragraph 83 and 84 of the Killock judgment a freestanding power for the First Tier Tribunal to oversee a concluded complaint by directing that further “appropriate steps” are taken is misconceived. Those paragraphs must be seen in the context of the discussion about when the First Tier Tribunal is empowered to make such an order which is when a complaint is pending.[11]Much reliance is asserted on paragraph 87 and the references to winding the clock back - “Moreover, s.166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question. We do not rule out circumstances in which a complainant, having received an outcome to his or her complaint under s.165(b), may ask the Tribunal to wind back the clock and to make an order for an appropriate step to be taken in response to the complaint under s.166(2)(a). However, should that happen, the Tribunal will cast a critical eye to assure itself that the complainant is not using the s.166 process to achieve a different complaint outcome”.[12]The judgement is clear that it is not for the First Tier Tribunal to regulate the Commissioner but it could not be said that there would not be cases where the First Tier Tribunal could intervene. Such a case was identified in the judgment where the Commissioner refused to investigate at all by incorrect reliance on Service Standard. As paragraph 116 explains – “In our judgment, by misconstruing and misapplying her own Service Standards, and thereby simply declining to investigate the complaints at all, the Commissioner did not take such steps as were appropriate to respond to the complaints.” In Delo, it was suggested that judicial review was the appropriate remedy for a failure to accept a complaint is judicial review (paragraph 66). There is then a conflict between the UT in Killock who were acting as a first instance Tribunal and Delo as to whether it was the First Tier Tribunal or the Upper Tribunal in judicial review proceedings who could make an order for an investigation to take place when one had been refused. Respectfully, it is suggested that in the light of the broad discretion of the Commissioner to decide whether an investigation should in act be undertaken, that any direction over the exercise of that discretion is a matter for judicial review and not the First Tier Tribunal. The role of the First Tier Tribunal is limited to bringing a timely conclusion to an investigation where one has not been concluded.[13]The reference to “winding the clock back” must be seen in context as the judgment as a whole and the subsequent judicial dicta on the scope of section 166 applications that has clarified the remit of the Tribunal. For example Mostyn J in the High Court in R (Delo) v Information Commissioner [2023] 1 WLR 1327, paragraph 57 – "The treatment of such complaints by the commissioner, as before, remains within his exclusive discretion. He decides the scale of an investigation of a complaint to the extent that he thinks appropriate. He decides therefore whether an investigation is to be short, narrow and light or whether it is to be long, wide and heavy. He decides what weight, if any, to give to the ability of a data subject to apply to a court against a data controller or processor under article 79. And then he decides whether he shall, or shall not, reach a conclusive determination...”. This was upheld in the Court of Appeal [2023] EWCA Civ 1141.[14]More recently in the Upper Tribunal in Cortes v Information Commissioner(UA-2023-001298-GDPA) which applied both Killock and Delo in confirming that the nature of section 166 is that of a limited procedural provision only. “The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court)….As such, the fallacy in the Applicant’s central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation, and thereby launch a collateral attack on the outcome itself with the aim of the complaint decision being re-made with a different outcome. Such a scenario would be inconsistent with the purport of Article 78.2, the heading and text of section 166 and the thrust of the decisions and reasoning in both Killock and Veale and R (on the application of Delo). It would also make a nonsense of the jurisdictional demarcation line between the FTT under section 166 and the High Court on an application for judicial review.” (paragraph 33).[15]All of the Appellant’s applications fall foul of the above principles either because they are applications made alter an outcome, were made pending an outcome which has been provided or seek for the Tribunal to regulate the investigation and conclusion of the Commissioner. This Tribunal has a very limited power in data protection complaints to hurry them along, the Tribunal cannot entertain applications that it has no power to consider or make orders that it has no jurisdiction to do so. Consideration of such matter wastes the previous resources of the First Tier Tribunal and detracts from appeals and applications that require the attention of the Tribunal.[16]The Appellant has been given an opportunity to respond to the strike out application on a few occasions and has not persuaded the Tribunal that it has power to consider his applications. The Tribunal is able to consider striking out an application even though the Commissioner has not requested strike out as part of its case management functions. It is noted that some of these applications were made shortly after the 2018 came into effect; the Commissioner is much more adept now, and with the benefit of the case-law, to make timely applications for strike out in such cases.[17]The GDPR cases listed above are struck out on the basis that the Tribunal has no power to consider those applications. That is an Order that the First Tier Tribunal must make in these circumstances. As the applications cannot be properly made, there are not going to be successful. I additionally strike out the applications as having no reasonable prospect of success.[18]Other cases that the Appellant seeks to reinstate – EA.2021.0144 This appeal was submitted on 14th June 2021. The Appellant was given an opportunity to respond to the Tribunals’ concerns that it did not have jurisdiction to consider his appeal, noting that the information requested was provided and the only issue the ICO considered was the Public Authority’s provision of information outside of the 20 working day time limit. The Appellant responded to those concerns. A separate decision notice has been issued for this case. EA.2023.0083 This appeal was received on 14th February 2023 against the decision of the ICO in relation to a refusal of the Appellant’s FOIA request. On 23rd July 2023 the Tribunal issued case management directions and set the appeal up for final hearing post-April 2024. The Tribunal directed that this appeal and EA.2023.0051 be heard together. The stay took effect before the Appellant was due to file his evidence. Further directions can be issued with a timetable for the evidence. EA.2023.0251 This FOIA appeal was lodged on 10th May 2023 against the same PA as in 0083. The directions issued as per 0083. Cases EA.2023.0083 and EA.2023.0251 are appeals that have been joined already in an earlier Order and can properly be progressed. Noting the confusion about whether the proceedings would automatically restart after the ending of the stay, those appeals will be reinstated and directions issued separately.[19]Other applications outstanding which are not part of the application to reinstate - EA.2023.0057 The application to reinstate does not apply to this case. On 8th June 2023 the appeal was struck out under Rule 8(3)(c). The Appellant lodged an application dated 12th June 2023 for a Judge to reconsider the Order of the Registrar dated 8th June 2023 and on 27th June 2023 he submitted an application to certify a contempt against the Registrar/GRC. These have been addressed in a separate document.[20]The Appellant is reminded that he remains subject to the case management orders issued for EA.2023.0083 (which includes EA.2023.0251) and FT/EA/2024/0424. FT/EA/2024/0424 requires urgent action by 16th January 2025 and EA.2023.0083 requires action by the end of January 2025. A failure to comply with directions may lead to the appeals being struck out.[21]Any application to review or appeal these orders must be made within 28 days of receipt.