Robert Brialey v Information Commissioner [2025] UKFTT 486 (GRC)

[2025] UKFTT 00486 (GRC)Case Reference: FT/EA/2025/0060/GDPR
First-tier Tribunal
(General Regulatory Chamber)
Date 01 May 2025
Information Rights
Decided without a hearing
Before
JUDGE SAWARD
Between
ROBERT BRIALEYApplicantINFORMATION COMMISSIONERRespondentDecision: The proceedings are struck out pursuant to Rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (“2009 Rules) because there is no reasonable prospect of the application, or part of it, succeeding.REASONS

Introduction

[1]On 6 January 2025, the Applicant made an application to the Tribunal pursuant to section 166(2) of the Data Protection Act 2018 (“2018 Act”) in relation to the Information Commissioner’s (“ICO”) decision reference number IC-346185-Y7S4. Another application followed on 3 March 2025 quoting the same ICO decision reference. The Tribunal initially allocated the second application with Case Reference FT/EA/2025/0105/GDPR, but it was subsequently closed as a duplicate of the first application.[2]The application concerns the Applicant’s complaint to the ICO of 14 November 2024, which included a subject access request (“SAR”) submitted to the Trustees of the Railway Pension Scheme on 3 November 2024. The application sought orders from the Tribunal that the ICO has(1) received the complaint(2) considered the complaint, and(3) that the conduct complained of was likely to be a breach of the UK GDPR.[3]On 24 February 2025, the ICO applied to the Tribunal to strike out the application on two grounds. Firstly, the ICO submits that he determined the Applicant’s complaint when an outcome was sent to the Applicant on 7 February 2025. As such, the ICO maintains that the Tribunal has no jurisdiction to determine the application under Rule 8(2)(a) of the 2009 Rules. Secondly, or in the alternative, the ICO says there is no reasonable prospect of persuading the Tribunal to make an order when an outcome was provided on 7 February 2025 and there are no longer any procedural issues that remain outstanding to resolve the complaint.[4]By Case Management Directions dated 3 April 2025, the Tribunal gave the Applicant opportunity to make representations in relation to the requested striking out.[5]In response, the Applicant submitted two more application forms. Both forms quote the same ICO decision reference number as before. The 9 April 2025 application form reiterates that an order is sought under section 166 of the 2018 Act but adds a “Third Addendum” with a response of the ICO on 12 March 2025. In the application form of 11 April 2025, the Applicant asks the Tribunal to dismiss the ICO’s application to strike out because the application, dated 24 February 2025, was made before the pension scheme email of 27 February 2025. The Applicant also requests a series of other orders, summarised as follows:(1) An order to resolve the apparent inconsistency between the ICO’s advice in its letter of 5 March 2025 and its website.(2) A response to the pension scheme contention that it cannot process the Applicant’s data access request because “there are likely to be several individuals with the same protected person pension rights and it would not be personally identifiable information”.(3) Whether the Applicant or ICO should reply to the pension scheme.(4) Whether any form of rebuke may be issued against the pension scheme.(5) The Applicant submitted an application under section 167 of the 2018 Act on 1 April 2015.(6) The Applicant would like all his data access requests dealt with properly and fully.[6]It is apparent that the Applicant has sought to add to and expand upon his original application to the Tribunal over the passage of time. This decision focuses, as it must, upon the application made under section 166 of the 2018 Act.

Legal framework

[7]Section 165 of the 2018 Act sets out the right of data subjects to complain to the ICO if they consider there is an infringement of the Act in connection with their personal data. A data subject can apply to this Tribunal under section 166 for an order as follows: 166 Orders to progress complaints(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner— (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner— (a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.(3) An order under subsection (2)(a) may require the Commissioner— (a) to take steps specified in the order; (b) to conclude an investigation, or take a specified step, within a period specified in the order.(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).[8]There are some key decisions addressing the scope of section 166. In Killock and Veale v Information Commissioner [2021] UKUT 299 (ACC) the ICO had considered a complaint and undertaken some investigation, but then decided to take the complaint itself no further. The Upper Tribunal treated the discontinuance as the outcome of the complaint and beyond further challenge under section 166. It ruled (at paragraph 87) that section 166 “is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given…”.[9]The ICO’s discretion to deal with complaints under section 166 was also considered by the High Court in R (on the application of Delo) v Information Commissioner and Wise Payments Ltd [2022] EWHC 3046 (Admin), where the Court found at paragraph 128:- ".....Sections 166(2) and (3) allow the Tribunal to order the Commissioner to take steps specified in the order to respond to the complaint. In my judgment, this would not extend to telling the Commissioner that he had to reach a conclusive determination on a complaint where the Commissioner had rendered an outcome of no further action without reaching a conclusive determination. This is because s.166 by its terms applies only where the claim is pending and has not reached the outcome stage. It applies only to alleged deficiencies in procedural steps along the way and clearly does not apply to a merits-based outcome decision."[10]Both decisions in Delo and Killock were cited by the Upper Tribunal in Cortes v Information Commissioner UA-2023-001298-GDPA, where it was reinforced (at paragraph 33) that once a complaint has been progressed to an outcome, there is no longer any scope for a section 166 order to bite.

Consideration and Conclusions

[11]The application to the Tribunal was brought under section 166 of the 2018 Act within the timescale set out in Rule 22(6)(f) of the 2009 Rules (i.e. within 28 days of the expiry of 6 months from the date the ICO received the complaint).[12]The Applicant seeks various outcomes, which appear to have evolved over time and stray beyond the possible remit of this Tribunal. It is important to emphasise that the Tribunal can only make an order under section 166(2) if one of the conditions at section 166(1)(a),(b), or (c) is met. Thus, the Tribunal can only require the ICO to take appropriate steps for procedural failings. In considering whether to do so it must consider the actions of the ICO by reference to its section 165 obligations and the relevant legal authorities including Killock, Cortes and Delo.[13]In this instance, the ICO wrote to the Applicant on 7 February 2025 regarding his complaint of 14 November 2024. The ICO noted that the Trustees of the Railway Pension Scheme had acknowledged the Applicant’s SAR, but “it appears you have still not received a full response and your data has not been provided”. The conclusion reached is:
“Based on the information provided, it appears the organisation has not complied with their data protection obligations. This is because they have not provided you with an appropriate response to your SAR as outlined in the UK GDPR. We have now referred this complaint back to the Trustees of the Railway Pension Scheme with guidance and advice and ask [sic] them to look at your SAR and the issues raised again. We have ask [sic] them to contact you in the next 14 days to resolve your complaint.”
[14]The ICO’s letter proceeded to also set out generic information rights practices that the organisation was being told they must ensure are in place.[15]Therefore, in terms of the application before this Tribunal the ICO has:(i) acknowledged the complaint(ii) considered the complaint and concluded that there appears to be non-compliance with the Trustees’ data protection obligations, by their failure to respond, and(iii) asked the Trustees to contact the Applicant within 14 days to resolve the complaint. A copy of the ICO’s letter sent by email to the organisation’s Data Protection Team on 10 February 2025 is supplied. Accordingly, the ICO has clearly progressed the Applicant’s complaint and provided an outcome to the Applicant within 3 months.[16]The Applicant is dissatisfied with the response that was thereafter provided to him by the Trustees in refusing his SAR. However, the Tribunal can only deal with a procedural failure of the ICO in relation to complaints under section 165. Section 166 does not concern the merits of the underlying complaint. It is limited to procedural issues by the ICO. I note that the Applicant has been in further dialogue with the ICO. Whether the ICO ought to be taking further action in relation to the response to the complaint falls within the ICO’s regulatory competence. It is outside the scope of the instant application.[17]After careful consideration, I conclude that the proceedings should be struck out as having no reasonable prospect of success.

Cited in 1 later judgment