(1) James Killock and Michael Veale v The Information Commissioner (2) EW v The Information Commissioner (3) Eveleen Coghlan (on behalf of C) v The Information Commissioner: [2021] UKUT 299 (AAC) [2021] UKUT 299 (AAC)

UPPER TRIBUNAL

ADMINISTRATIVE APPEALS CHAMBER

[2021] UKUT 299 (AAC)

Case No GI/113/2021, QJ/2020/0303, GI/1321/2020

Between

(1) James Killock and Michael VealeAppellant

The Information Commissioner (2) EW v The Information Commissioner (3) Eveleen Coghlan (on behalf of C) v The Information CommissionerRespondent

Before

Mrs Justice Farbey, Chamber President

Upper Tribunal Judge West

Mr Pieter De Waal (in Killock & Veale and EW only)

The Information Commissioner By transfer from: First-Tier Tribunal (General Regulatory Chamber) (Information Rights) GRC Case No: QJ/2020/0303 Transfer Date: 29 November 2020 IN THE UPPER TRIBUNAL Application No. GI/1321/2020 ADMINISTRATIVE APPEALS CHAMBER for Respondent

EW for Applicant

The Information Commissioner By transfer from: First-Tier Tribunal (General Regulatory Chamber) (Information Rights) GRC Case No: EA/2020/0196 Transfer Date: 19 August 2020 IN THE UPPER TRIBUNAL Appeal No. GIA/1619/2020 ADMINISTRATIVE APPEALS CHAMBER for Respondent

Eveleen Coghlan (on behalf of C) for Appellant

The Information Commissioner First-Tier Tribunal (General Regulatory Chamber) (Information Rights) GRC Case No: QJ/2020/0206 2 for Respondent

Date 24 November 2021

Category: Information rights

Subcategory: Information rights freedom of information exceptions, Information rights information rights practice and procedure

[1]No one shall publish or reveal the name or address of the Appellant EW who is the subject of the proceedings in Application No. GI/1321/2020 or publish or reveal any information which would be likely to lead to the identification of the Applicant EW or of any member of his family in connection with those proceedings.

[2]No one shall publish or reveal the name of the Appellant C who is the subject of proceedings in Appeal No. GIA/1619/2020. REASONS FOR DECISION Introduction

[1]These three cases raise the important question of the scope of a Tribunal’s power to make orders against the Information Commissioner (hereafter “the Commissioner) to progress complaints made to her by data subjects. They concern the proper interpretation of s. 165 of the Data Protection Act 2018 (“DPA”), which makes provision for complaints by data subjects, and of s. 166 which makes provision for the Tribunal to make orders to progress complaints. In the cases of Killock and Veale and of EW, the Commissioner contends that the applications to the Tribunal were made out of time.

[2]The cases have reached the Upper Tribunal by different routes. On 19 August 2020, Upper Tribunal Judge O’Connor as Acting President of the First-tier Tribunal (General James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

4 Regulatory Chamber) (“GRC”) directed that EW’s application to the GRC be transferred to the Upper Tribunal. Exercising her powers as Chamber President of the Administrative Appeals Chamber, Farbey J had concurred with that course in a decision dated 17 August 2020. In EW’s case, therefore, the Upper Tribunal is exercising a first-instance jurisdiction. On 29 November 2020, Judge O’Connor directed that Mr James Killock and Dr Michael Veale’s application be transferred to the Upper Tribunal following Farbey J’s earlier concurrence. In their case too, the Upper Tribunal exercises a first-instance jurisdiction. By notice of appeal dated 19 October 2020, Mrs Eveleen Coghlan on behalf of her son C appeals against a decision of the GRC so that, in C’s case, the Upper Tribunal is exercising an appellate jurisdiction.

[3]Given these different routes, the cases were heard one after the other over the course of three days (20 – 22 July 2021). Mr Pieter De Waal, as a non-legal member of the Tribunal, has taken part and contributed to the decisions in the two transferred cases but has played no part in C’s appeal. He observed the hearing in C’s case (by video link) but has taken no part in any deliberations. We have issued separate decision notices in each case which convey the outcome of the case and the names of the judicial office holders who have made the decision. We are grateful to the parties and their lawyers for their co-operation with each other and with the Tribunal which has enabled this rather complex procedural arrangement (made no easier by the challenges of the Covid-19 pandemic) to work smoothly. We express particular gratitude to Mr Jacob Rabinowitz who appeared on behalf of EW pro bono.

[4]For convenience, we have decided to give the reasons for our decisions in each case in this combined document while again emphasising that Mr De Waal stood aside in relation to all matters relating to C. We consider the facts of each case before turning to the legal framework and our legal conclusions. Killock and Veale

[5]Mr Killock is the Executive Director of Open Rights Group, a UK-based digital campaigning organisation working to protect the rights to privacy and free speech online. Dr Veale is a Lecturer in Digital Rights and Regulation at University College London. They seek an order under s.166 DPA in relation to the decision of the Commissioner to “cease handling” their complaint of unlawful conduct in the behavioural advertising industry (“AdTech”) and real-time bidding (“RTB”) which affects the data of millions of users of online services (“the Complaint”).

[6]On 12 September 2018, Mr Killock and Dr Veale filed the Complaint with the Commissioner pursuant to s.165 DPA. The Complaint raised issues regarding the lawfulness of the industry’s use of personal data. It was supported by detailed grounds and by a report by a subject matter expert, Dr Johnny Ryan, which explained the concerns about how personal data is used in behavioural advertising. It is Mr Killock and Dr Veale ’s case that those concerns related to their own personal data as users of online services.

[7]In outline, the Complaint concerned the industry’s (and in particular Google’s and the Interactive Advertising Bureau’s) use of personal data in the context of RTB systems, which facilitate personalised advertising on websites by auctioning an individual’s personal data among potential advertisers. This entails sharing such data with tens or even hundreds of companies every time an individual loads a page on a website which uses the system. The Complaint asserted that such processing involves a number of serious breaches of data protection law, including the DPA and data protection James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

5 regulations. Mr Killock and Dr Veale asked the Commissioner to take action to remedy these breaches.

[8]It is the Commissioner’s case generally that since early 2018 (at the latest) she has considered it a priority to keep under review the use of web tracking within AdTech, of which RTB forms one aspect. However, the exact nature of the Complaint (and the remedies sought under it) is one of the issues in the present case. By the time of the hearing before us, the Commissioner refused to accept that Mr Killock and Dr Veale had made a justiciable complaint. The generality of the Complaint meant that it was upon proper analysis an actio popularis, seeking an investigation or audit of a particular sector, and was not a complaint about infringement of individual rights. Mr Killock and Dr Veale had disavowed seeking any personal remedy (see for example paras 7.1 and 10 of their letter of 30 November 2018). Instead they had asked the Commissioner to “initiate a wider industry investigation into the data protection practices of the industry” and to “exercise her discretion under section 129 of the DPA and seek a consensual audit of the industry and issue appropriate codes of practice/guidance pursuant to section 128 of the DPA”. As such, the Commissioner’s position is that neither Mr Killock nor Dr Veale are able to invoke the jurisdiction of the Tribunal.

[9]Mr Killock and Dr Veale submitted that the Commissioner’s position before us was at odds with her previous approach. The Commissioner had treated their concern as a complaint. She had acknowledged receipt of the Complaint, allocated it a case reference number, and invited them to a meeting to elaborate on their concerns. In that meeting on 23 January 2019, as well as in written submissions provided on 30 November 2018, 19 February 2019, 15 May 2019 and 18 June 2019, Mr Killock and Dr Veale provided the Commissioner with additional information regarding their Complaint. In a conference call with Mr Killock and Dr Veale on 20 May 2019, the Commissioner indicated that she was planning to launch a position paper highlighting concerns regarding the industry and RTB and that she was engaging with the key controllers whom Mr Killock and Dr Veale had identified: Google and the Interactive Advertising Bureau.

[10]On 20 June 2019 the Commissioner published an Update Report into adtech and real time bidding (the “Update Report”). That report corroborated the concerns raised in the Complaint, essentially accepting that there appeared to be ongoing breaches of the General Data Protection Regulation (“GDPR”). It concluded that there are issues of non-compliance with data protection law on an industry-wide basis, which required regulatory intervention. The Update Report was clear that the industry “needed to make improvements to comply with the law.” It concluded that “the creation and sharing of personal data profiles about people, to the scale we’ve seen, feels disproportionate, intrusive and unfair, particularly when people are often unaware it is happening … one visit to a website, prompting one auction among advertisers, can result in a person’s personal data being seen by hundreds of organisations, in ways that suggest data protection rules have not been sufficiently considered.” The Update Report committed the Commissioner to undertaking a further review of the industry in six months’ time and to “further consult with IAB Europe and Google.”

[11]Following the publication of the Update Report, Mr Killock and Dr Veale (through their solicitors) wrote to the Commissioner on 1 July 2019 to raise a number of issues pertaining to the further investigation of the Complaint. The Commissioner responded to the concerns raised on 24 July 2019 and stated: “I can confirm that your clients’ complaint has been considered in accordance with the relevant provisions of the GDPR and DPA 2018. James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

6 We continue to handle this complaint and keep your clients informed of progress with our work. As recognised during our previous discussions with you and your clients, RTB is a complex area, with hundreds of individual actors involved in a single bid transaction. We therefore need to take a considered approach and must not rush towards actions that will not adequately address the systemic issues identified in our recent update report on adtech and RTB. … The legal analysis you provided may form part of the considerations around any future action. However, the fact that legal analysis has been undertaken on a particular issue does not compel, require or obligate the ICO to act on that advice. We are fully aware that powers such as those for information notices and assessment notices are available to the Commissioner. However, this does not prevent the ICO from taking alternative approaches to information gathering, while reserving the right to make use of formal powers if organisations are not forthcoming in providing the requested information. Please rest assured that your clients’ submission has received considerable attention and we concur, as our recent report on adtech highlights, that there are significant areas of concern that require attention. … … I would like to reassure you that the original complaint submitted by your clients and the additional supporting documentation received in recent months have been central to shaping the ICO’s plans to address the issues that exist within the RTB ecosystem. Our update report sets out our plans for the next six months and we will continue to keep your clients informed as our work progresses …”.

[12]The Commissioner stated on 13 September 2019 that she “look[ed] forward to further engagement”.

[13]There was no further contact from the Commissioner until 17 January 2020, when she published a blog post. This reiterated concerns relating to the industry and RTB and again supported the view of Mr Killock and Dr Veale that there were ongoing breaches of the GDPR. It stated that “engagement alone will not address all these issues” and that “we anticipate it may be necessary to take formal regulatory action and will continue to progress our work on that basis.”

[14]On 4 February 2020, Mr Killock and Dr Veale wrote to the Commissioner requesting clarification of the blog post and the engagement which the Commissioner had had with the industry, as well as “details of what the ICO considers to be an ‘appropriate’ response to [Mr Killock and Dr Veale ’s] complaints.” They expressed concern that “the Blog refers to a number of views and developments material to [our] complaints [but that] despite the ICO’s obligations under s.165 DPA, [we] were not informed about these prior to publication of the Blog and [have] not been provided with an opportunity to make any submissions and express their views in respect of them.” They stated that the failure to engage with them impinged on their rights as complainants and on the Commissioner’s ability to conduct appropriate investigation and properly progress their complaints. They requested that they be provided with an appropriate update on the Complaint. James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

[15]The Commissioner responded on 20 February 2020 and again updated Mr Killock and Dr Veale. She acknowledged her obligations under s.165 DPA “to take appropriate steps to respond to the complaint, which includes investigating the subject matter of the complaint to the extent appropriate and to inform the complainant of the progress of the complaint” as well the outcome of the complaint. However, she also stated that s.165 DPA does not allow complainants to “dictate how the ICO should conduct its regulatory activities” and that it was neither necessary nor appropriate “to provide a ‘running commentary’ as to [her] regulatory work”.

[16]In light of the Covid-19 pandemic, on 7 May 2020 the Commissioner informed Mr Killock and Dr Veale that she had “made the decision to pause [the] investigation into real time bidding and the Adtech industry”. She noted that “it is not our intention to put undue pressure on any industry at this time but our concerns about Adtech remain and we aim to restart our work in the coming months, when the time is right.” She issued a public statement to that effect on the same day.

[17]Mr Killock and Dr Veale wrote to the Commissioner on 19 May 2020, acknowledging the problems created by the pandemic, but registering their concerns at the open-ended nature of the “pause” in the investigation. The letter requested an update, in accordance with the requirements of s.165 DPA. The Commissioner’s response reiterated her understanding of the obligations imposed by s.165 and stated that “it is not accepted that s.165 requires us to explain how long our investigation may be paused.”

[18]In reply to a further request by Mr Killock and Dr Veale on 15 July 2020 for an update on the investigation of the Complaint, the Commissioner stated that “as and when we consider it appropriate to provide a further substantive update we shall do so”. Mr Killock and Dr Veale responded on 29 July 2020, questioning the Commissioner’s interpretation of the obligations imposed on her under s.165 DPA and emphasising the requirement to provide an update every three months.

[19]On 14 August 2020, the Commissioner wrote to Mr Killock and Dr Veale, stating that: i. The Complaint had “been given significant consideration by the Commissioner, going well beyond the level of time and resource ordinarily dedicated to complaints dealt with via our standard case handling process”; ii. It remained the Commissioner’s intention “to recommence our industry-wide investigation into RTB in due course”; iii. The Commissioner believed that “we have investigated the subject matter of your clients’ complaint to the extent appropriate and that we have already clearly communicated the steps we have taken and the extent to which it has informed our wider approach”; iv.

(b) DPA, was:

“We are therefore in accordance with our obligations under GDPR Article 77 and Section 165 DPA 18 informing you that we have progressed as far as possible in our formal handling of your clients’ complaint, with the outcome being that it has assisted and informed the ICO’s broader regulatory approach to RTB since September 2018. Please therefore consider this to be James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO [2021] UKUT 299 (AAC) 8 confirmation of the outcome of your clients’ complaint in line with s.165(4)(b) of the Data Protection Act 2018”; v. The Commissioner had thereby “concluded our handling of [the Complaint]” and no longer intended to provide any further specific updates; vi. The Commissioner nonetheless intended to continue her investigation into AdTech and “all options for future ICO regulatory intervention within the RTB industry remain on the table”

. She added: “but, whilst we have noted your client’s previous requests for the Commissioner to make use of specific regulatory powers, I must reiterate that we are not obligated or compelled to follow a particular course of regulatory action, within a desired timeframe, at the request of complainants. As we have now concluded our handling of your clients’ complaint, we no longer intend to provide any further specific updates as an obligation to do so has now concluded. Your clients are however welcome to follow the future progress of our work in the Adtech space which we would intend to publicise through the usual public channels, including on our website. Whilst we believe that you are already aware of the provisions of s.166 of the Data Protection Act 2018 we nonetheless confirm the position as required by s.165(4)(c). Should your clients consider that the Commissioner has failed to handle their complaint in accordance with her obligations under Article 77 and Section 165 to take appropriate steps to respond to them they may make application to the First tier Tribunal, General Regulatory Chamber, and request that the Tribunal make an order requiring the Commissioner to take appropriate steps to respond to the complaint. For the avoidance of doubt, as set out above, we consider that the ICO has in fact taken appropriate steps in response to your clients’ complaint and therefore such an application if made would be opposed”.

[20]On 17 September 2020 Mr Killock and Dr Veale challenged the Commissioner’s assertion that the Complaint had been resolved. They stated that their “rights under the GDPR continue to be infringed” and queried the Commissioner’s failure either to uphold or to dismiss the Complaint. The letter stated: “If the Commissioner's position is that the ‘outcome’ has been reached and nothing more will be done, despite the systemic problems you have found, our clients will challenge that decision as inconsistent with the Commissioner’s obligations under Article 77 GDPR and s.165 DPA 2018. If, on the other hand, the Commissioner's position is that the substance of the complaints is going to be addressed by way of further industry-wide investigation, then our clients have a subsisting right to be kept informed about the progress of that further investigation. Please therefore confirm if the position is that the “outcome” of the complaint is that no further action will be taken to protect the rights of our clients and other data subjects in response to the complaint and James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

9 to that extent the complaint is rejected/dismissed. Alternatively, if (as seems to be the true position), the Commissioner has decided that the case requires further investigation and action by way of recommencing the industry-wide investigation into RTB, please confirm that the complaint therefore properly remains open, with a corresponding right for our clients to be kept informed of progress”.

[21]In response, the Commissioner maintained her position and confirmed on 23 September 2020 that she considered her “obligations to [your clients] in respect of Article 77 and section 165 DPA have been discharged”. She added: “We do intend to recommence our industry wide investigation in RTB in due course. Whilst we do not accept that there is any legal requirement for us to continue to keep your clients updated we will, as a matter of courtesy given their longstanding interest in this area, advise when that takes place and provide a link to our relevant public facing statement at that time”.

[22]Mr Killock and Dr Veale lodged the present application on 21 October 2020. On 22 January 2021, the Commissioner announced that she had recommenced her industry-wide investigation of RTB. Thus, the investigation into the substantive matters raised by Mr Killock and Dr Veale in the Complaint remains ongoing, even though the Commissioner maintains that their complaint has been closed. EW The Commissioner’s Service Standards

[23]In EW’s case, it is important to note the Commissioner’s Service Standards which, so far as material, state:

“We want to know how organisations are doing when they are handling information rights issues. We also want to improve the way they deal with the personal information they are responsible for. Reporting your concerns to us will help us to do that. Before reporting a concern to us, we expect you to give the organisation the opportunity to consider it first. In order for us to look at their information rights practices we need you to provide us with their reply. Where appropriate, we will give you advice about how we think the law applies to your issue or concern. We aim to reach an outcome in 90% of concerns cases within six months. If you do want to raise concerns about an organisation then we suggest that you do so within three months of receiving their final response to the issues raised. Waiting longer than that can affect the decisions that we reach. In some cases an undue delay will mean that we will not consider the matter at all. Our role is not to investigate or adjudicate on every individual complaint. We are not an ombudsman. But we will consider whether James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO [2021] UKUT 299 (AAC) 10 there is an opportunity to improve the practice of the organisations we regulate and we will share our decisions with you. It is up to us to decide whether or not we should take further action. Even where we decide that further action is not required at the moment, perhaps because the organisation has made a mistake but is working to put things right, we will keep concerns on file. This will help us over time to build a picture of an organisation’s information rights practices. We may ask organisations to explain to us what they have done in response to issues or concerns raised. We will publish details of improvements and give you the opportunity to sign up to our newsletter, giving regular updates of the action we are taking. If you are seeking personal redress or compensation for the way an organisation has dealt with your personal information, you will need to pursue this independently through the courts or with an industry's own ombudsman or regulatory body”

. The facts

[24]On 18 June 2018 EW filed a subject access request (“SAR”) with the relevant local authority (“the Council”) seeking his “full health and social care file … as well as [his] school records”. On 10 July 2018, the Council refused the SAR. The Council’s decision letter cited a review of the SAR by “[a] social work professional” and declined to provide the information sought “under the exemptions provided under Schedule 3 Part 3 of the [DPA] because sharing of [EW’s] social care data is likely to cause serious harm to [his] physical or mental health”. On 30 November 2018, he filed a second SAR with the Council. He sought all data held by the Council about himself.

[25]On 8 January 2019, the Council refused the second SAR on essentially the same basis as in its refusal of 10 July 2018, attaching its letter of that date. On 25 May 2019, EW wrote to the Council requesting an internal review of the Council’s refusal of the two SARs which he had filed. On 10 June 2019, EW filed a complaint with the Commissioner in relation to the Council’s refusal of his SARs. By way of supporting evidence, he provided the Commissioner on 13 June 2019 with(i) the Council’s email and letter of 10 July 2018 and

(ii) relevant email correspondence from 15-16 August 2018. He also provided a further complaints form, but not his original SAR.

[26]On 25 June 2019, the Commissioner declined to investigate EW’s complaint. The Commissioner’s email stated (so far as material) as follows:

“The ICO Service Standards advise that if you wish to raise complaints about an organisation then this must be done within three months of receiving their final response to the issues raised. Waiting longer than that can affect the decisions that we reach. In some cases an undue delay will mean that we will not consider the matter at all. In this case the copy of the latest correspondence you provided is dated 16 August 2018. Taking into account this delay we do not intend to take any further action in relation to this matter. However, James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO [2021] UKUT 299 (AAC) 11 your concerns will be logged and kept on file as this will help us over time to build a picture of [the] Council’s information rights practices.”

[27]On the same day, EW spoke to the Commissioner’s representative on the telephone. The Commissioner’s note of that telephone call states that:

“NOTE: call received from [data subject] to discuss my letter. Advised [as] last correspondence from [the Council] is Aug 2018 we cannot look into this complaint further (over 3 months). Advised [data subject] to raise complaint with [the Council] again and if he still has concerns when he receives response he can bring this to the ICO’s attention.”

[28]On a date between 10 June 2019 and 7 August 2019, EW filed a third SAR with the Council. He again sought all data held by the Council about himself. On 29 August 2019, the Council refused his third SAR on essentially the same basis as in its two earlier refusals. On 2 April 2020, EW filed a second complaint with the Commissioner. The complaint stated materially as follows:

“What is your complaint? The public body has not responded to my request for an internal review, or has refused to conduct an internal review. I disagree with the public body’s refusal to provide the information I requested… Please give details I have applied to [the Council] twice now; once in 2018 and the other in 2019 for access to my records. This has been refused and the [Council] cannot refuse to supply me with my records as ultimately they are mine. The [Council] have provided me with the same letter dated 10th July 2018 on both occasions and have asserted that it was a social work Team Manager who had taken this decision. Please also see Case [ENQ0849804]. I do not have my Subject Access Request form but I do have the letter as aforementioned. I requested internal review but this was ignored.”

[29]By way of supporting evidence, EW provided the Commissioner with(i) his letter to the Council of 25 May 2019 (which the Commissioner had not seen before) and

(ii) a further copy of the Council’s letter of 10 July 2018. On 9 April 2020 the Commissioner declined to investigate EW’s second complaint. The Commissioner’s email stated (so far as material):

“We understand that you have concerns that [the] Council have not properly responded to your subject access request. We note that you also raised this complaint with the ICO on 10 June 2019. We wrote to you on 25 June 2019 to advise that the ICO Service Standards advise that if you wish to raise complaints about an organisation then this must be done within three months of receiving their final response to the issues raised. In your original complaint the latest correspondence you provided was dated 16 August 2018. We therefore wrote to you to advise that based on the delay in bringing your complaint to the ICO, we were unable to consider your complaint further. James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO [2021] UKUT 299 (AAC) 12 We note that you sent a new complaints form to the ICO on 3 April 2020 and the latest correspondence you have provided is dated 25 May 2019. Taking into account this delay we do not intend to take any further action in relation to this matter. However, your concerns will be logged and kept on file as this will help us over time to build a picture of [the] Council’s information rights practices.”

[30]Following those events, on 17 April 2020 EW (at this stage a litigant in person) issued an application against the Commissioner in the GRC in connection with the Commissioner’s decision of 9 April 2020. The application originally requested that the GRC “order [the Council] to give [him] his records, or order the [Commissioner] to make the recommendation to [the Council to give [him] his records”. However, the nature of the application has been refined. In particular, EW has clarified that the remedy sought from the Tribunal against the Commissioner is an order under s.166 DPA 2018 “ordering the [Commissioner] to take appropriate steps to respond to the Complaint raised by me to them against [the Council]” (submissions of 13 May 2020, para 8) and, more specifically, an order “to require [the ICO] to investigate the … complaint against [the Council] …” (submissions of 2 July 2020, para 11).

[31]Against that background, Judge O’Connor directed that the proceedings be transferred as proposed. The reasons for this transfer were subsequently identified by Upper Tribunal Judge Wikeley as being:

“so that the [Upper Tribunal] might provide authoritative guidance as to (i) the extent of the Commissioner’s obligation to investigate a complaint made by a data subject under [DPA] sections 165 and 166; and (ii) the rights of children and young persons under the DPA 2018 and GDPR.”

[32]In the event, it has not been necessary or even desirable for the Upper Tribunal to deal in detail with the rights of EW as a child in the proceedings before us. The Commissioner accepts that, for the purposes of the present case, EW’s age is not relevant to his rights under the DPA and GDPR. Before us, he has had the excellent assistance of Mr Rabinowitz. The flexibility of tribunal proceedings and tribunal procedure rules has meant that we have not needed to direct any particular steps (other than anonymisation) to protect EW’s right to respect for private life or any particular steps to secure his effective participation in the proceedings. (He has recently attained his majority.) The key legal issue in dispute in EW’s case concerns the extent of the Commissioner’s obligation to investigate his complaint. Coghlan

[33]Mrs Coghlan appeals on behalf of C against the decision of the GRC (Judge Moira Macmillan) dated 31 July 2020 upholding the earlier decision of a Registrar to refuse to extend time to make a s.166 application. In that application, Mrs Coghlan had sought an order requiring the Commissioner to take appropriate steps to investigate her complaint about the London Borough of Hillingdon (“LBH”).

[34]C is a vulnerable young adult with Down’s Syndrome. On 10 October 2019, LBH sent a Court of Protection application concerning C to Mrs Coghlan at her request, including a large quantity of special category personal data. This was not sent by Egress – LBH’s encrypted email service – nor was C’s identity anonymised. It is C’s case that the data – which went to the core of his personhood – was thereby vulnerable to interception. On his behalf, Mrs Coghlan says that this violated articles 5(1)(f) and 32 GDPR as read in James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

13 light of relevant Commissioner and other guidance, as well as LBH’s own data security policy. Mrs Coghlan complained to LBH. In response, LBH argued that their email systems were secure and that there was no legal obligation to password-protect or encrypt emailed documents.

[35]On 30 October 2019 Mrs Coghlan complained to the Commissioner on behalf of her son. On 11 December 2019 the Commissioner reviewed the correspondence and declined to investigate, adopting LBH’s position, namely that there was no legal requirement on data controllers to encrypt data, there was no evidence to suggest that LBH’s email system was insecure, and there was no evidence that C’s personal data had been compromised as a result of the email. The next day Mrs Coghlan replied, contending that that analysis was flawed.

[36]On 6 February 2020 the Commissioner repeated the claim that the GDPR did not require encryption. It was stated that the Commissioner could only investigate if there were evidence that a third party had actually accessed the information. Mrs Coghlan disputed that on 10 February 2020, contending the decision not to investigate was legally wrong and that it was inconsistent with relevant guidance and the Commissioner’s previous decisions. She noted that the Commissioner had failed to identify the judicial remedy against its investigation and decision (as required by article 77(2) GDPR) and asked that there be compliance with it.

[37]On 18 February 2020 the Commissioner repeated her position, but added that the next step was a case review which would “not necessarily” review the decision itself. On the same day Mrs Coghlan informed the Commissioner that she would proceed to a judicial remedy and requested that she be informed what this was in order to enable her to do so. On 19 February 2020 the Commissioner stated the judicial remedy was judicial review, but also that the ICO’s case review mechanism must be exhausted first.

[38]On 19 April 2020 Mrs Coghlan sent a detailed application for a review. In particular this drew the Commissioner’s attention to LBH’s own security policy which required encryption when sending “very personal or large amounts of sensitive data”. On 29 May 2020 the Commissioner approved her own earlier decision not to investigate. The email appears to contain one change from February: the Commissioner now asserted (or appears to have asserted, in a somewhat confusing piece of prose) that no judicial remedy existed against the decision because the outcomes of complaints were “not legally binding, they are the Commissioner’s opinion” and therefore fell outside article 78(1) GDPR.

[39]The time limit for bringing s.166 proceedings had expired by the time that C’s mother had brought them on his behalf on 26 June 2020, seeking an order that the Commissioner should take appropriate steps to investigate and, as appropriate, remedy LBH’s alleged breaches of the GDPR.

[40]On 1 July 2020 the application for an extension of time was refused by a Registrar of the GRC. On 5 July 2020 Mrs Coghlan applied for a reconsideration of that decision under Rule 4(3) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (“the GRC Procedure Rules”). On 31 July 2020 Judge Macmillan upheld the Registrar’s decision. She applied the principles set out in Data Select Limited v HMRC

[2012] UKUT 187 (TCC)

and held that: i. Although the period of delay was significant, there was no requirement for an application to the Tribunal at an earlier stage because the Commissioner was progressing his complaint; James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

14 ii. C had provided an explanation for the delay: he did not make an earlier application because the Commissioner was progressing his complaint and his application was made within 28 days of the Commissioner’s final review; but iii. C had “already received that which the Tribunal could Order under s.166(2). This is because the [Commissioner] has already considered and responded to his complaint.” There was no room for procedural review and “no Order the Tribunal can make” where an applicant had received a response to his complaint. The matter was accordingly closed. In light of the ruling in Scranage v Information Commissioner

[2020] UKUT 196 (AAC)

, s.166 could not be read more widely to include substantive review.

[41]Judge Macmillan granted permission to appeal in respect of ground two of the grounds of appeal before her, namely the compatibility of the Tribunal’s interpretation of s.166 with other GDPR principles. Permission for ground one (equating the Commissioner’s response to the complaint with a procedurally adequate response) was granted on 15 December 2020 by Upper Tribunal Judge Wikeley. UK General Data Protection Regulations (“UK GDPR”)

[42]It was not in dispute before us that, for present purposes, there is no material difference between the EU General Data Protection Regulation (Regulation (EU) 2016/679 of 27 April 2016) and the UK GDPR which has had effect since 31 December 2020. We shall therefore focus on the latter while recognising that retained EU law applies.

[43]Recital 141 of the UK GDPR (so far as material) states:

“Every data subject should have the right to lodge a complaint with a single supervisory authority, in particular in the Member State of his or her habitual residence, and the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights under this Regulation are infringed or where the supervisory authority does not act on a complaint, partially or wholly rejects or dismisses a complaint or does not act where such action is necessary to protect the rights of the data subject. The investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case. The supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period…”

[44]By Recital 143 (so far as material) it is provided that “…each natural or legal person should have an effective judicial remedy before the competent national court against a decision of a supervisory authority which produces legal effects concerning that person. Such a decision concerns in particular the exercise of investigative, corrective and authorisation powers by the supervisory authority or the dismissal or rejection of complaints … Proceedings against a supervisory authority should be brought before the courts of the Member State where the supervisory authority is established and should be conducted in accordance with the Member State’s procedural law. Those courts should exercise full jurisdiction, which James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

15 should include jurisdiction to examine all questions of fact and law relevant to the dispute before them…”

[45]Article 57 states (so far as material) that the Commissioner must “(f) handle complaints lodged by a data subject … and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with a foreign designated authority is necessary.”

[46]The effect of article 57 is that the Commissioner must handle complaints from data subjects “with all due diligence” (Data Protection Commissioner v Facebook Ireland Ltd

[2021] 1 WLR 751

, para 109, Court of Justice of the European Union).

[47]Article 77 provides the right to lodge a complaint with the Commissioner: “1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.

[2]The Commissioner shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.”

[48]Article 78 provides the right to an effective judicial remedy against the Commissioner: “1. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of the Commissioner concerning them.

[2]Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to an effective judicial remedy where the Commissioner does not handle a complaint or does not inform the data subject within 3 months on the progress or outcome of the complaint lodged pursuant to Article 77.”

[49]Article 79 provides the right to an effective judicial remedy against a data controller or processor “1. Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with the Commissioner pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.” James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

16 Charter of Fundamental Rights

[50]Mrs Coghlan relied on article 8 of the Charter of Fundamental Rights (“CFR”) which provides (so far as material): “Protection of personal data

[1]Everyone has the right to the protection of personal data concerning him or her.

[2]Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.

[3]Compliance with these rules shall be subject to control by an independent Authority.”

[51]The Commissioner has pointed out that the CFR is no longer part of English law under s.5 of the European Union Withdrawal Act 2018. We shall return to its effect below but observe here that it raises no real or discrete dispute. Data Protection Act 2018

[52]S. 165 DPA provides, so far as material:

“165 Complaints by data subjects (1) Articles 57(1)(f) and (2) and 77 of the GDPR (data subject's right to lodge a complaint) confer rights on data subjects to complain to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the GDPR. (2) A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act. … (4) If the Commissioner receives a complaint under subsection (2), the Commissioner must— (a) take appropriate steps to respond to the complaint, (b) inform the complainant of the outcome of the complaint, (c) inform the complainant of the rights under section 166, and (d) if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint. James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO [2021] UKUT 299 (AAC) 17 (5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes— (a) investigating the subject matter of the complaint, to the extent appropriate, and (b) informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with another supervisory authority or foreign designated authority is necessary.”

[53]S. 166 provides:

“166 Orders to progress complaints (1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner— (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months. (2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner— (a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order. (3) An order under subsection (2)(a) may require the Commissioner— (a) to take steps specified in the order; (b) to conclude an investigation, or take a specified step, within a period specified in the order.

(a) ”

[54]S. 167 of the DPA provides a remedy for infringement of a data subject’s substantive rights in the form of a compliance

[55]Ss.168 and 169 DPA provide rights to compensation for contravention of the GDPR and other data protection legislation. The schemes for compliance orders and for compensation are separate from the scheme for orders to progress complaints. By express statutory wording, compliance orders and compensation are a matter for courts and not tribunals.

[56]As regards the case law, the First-tier Tribunal considered the meaning of s.166 for the first time in Platts v Information Commissioner EA/2018/0211/GDPR. The applicant had complained to the GRC that the Commissioner had not fully completed her assessment and had failed to provide him with information about the availability of an order to progress his complaint. The GRC dismissed the application for an order under s.166 because it concluded that the Commissioner had taken appropriate steps to respond to the complaint in a timely manner, and had addressed the matters set out in s.166(1)(a), (b) and (c) (para 12). The GRC stated at para 13:

“… we agree with the Commissioner that s.166 DPA 2018 does not provide a right of appeal against the substantive outcome of an investigation into a complaint under s.165 DPA 2018.”

[57]The Upper Tribunal first considered s.166 in Leighton v Information Commissioner (No.2) GIA/1399/2019. Mr Leighton was dissatisfied with the Commissioner’s decision that North Yorkshire Police had complied with its obligations to him under the DPA. He applied to the First-tier Tribunal for an order under s.166. The Commissioner sought a strike out, which the Registrar and then the Judge, on reconsideration, granted. The Upper Tribunal refused permission to appeal with detailed reasons.

Judge Wikeley held:

“[22] Thus, if the Commissioner fails in any of the ways identified in section 166(1), the data subject has the statutory right to apply to the James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO [2021] UKUT 299 (AAC) 19 FTT under section 166(2) for an order requiring the Commissioner to act as set out there. However, sections 165 and 166 (which fall under the general cross-heading of ‘Complaints’) cannot be read in isolation from the rest of Part 6 (Enforcement) of the DPA 2018. In particular, the immediately following three sections (ss.167-169) appear beneath the cross-heading ‘Remedies in the court’. Those are compliance orders (s.167), compensation for breach of the GDPR (s.168) and compensation for breach of other data protection legislation (s.169). Thus, if ‘a court is satisfied that there has been an infringement of the data subject's rights under the data protection legislation in contravention of that legislation’ (s.167(1)) then the court may make a compliance order. Notably, this is a power vested in ‘a court’ and not ‘the Tribunal’ – the jurisdiction to make such compliance orders is exercisable not by the FTT but by either the High Court or the county court (in England & Wales, at least): see DPA 2018 section 180(1) and (2)(d).The same is true as regard orders under sections 168 and 169 (see DPA 2018 section 180(2)(e)). … [27] … GDPR Article 77 gives data subjects the right to lodge a complaint with the national supervisory authority (here the ICO), a right given effect in domestic law by DPA 2018 section 165. GDPR Article 78.2 then gives data subjects the right to an ‘effective judicial remedy’ where that supervisory authority either does not handle a complaint or inform the data subject of the progress or outcome of the complaint within 3 months, a right given effect in domestic law by DPA 2018 section 166. It is true that Article 78.1 also gives personal a right to an effective judicial remedy ‘against a legally binding decision of a supervisory authority concerning them’, but that does not give Mr Leighton a freestanding right to challenge the underlying substantive merits of the Information Commissioner’s decision on his complaint (given the courts’ jurisdiction to provide remedies under section 167-169 and the fall-back availability of judicial review against the Commissioner in the absence of any other avenue of challenge).”

[59]Judge Wikeley considered that the First-tier Tribunal had been “right as a matter of legal analysis” in Platts:

“[31] I note that in Platts…the FTT accepted a submission made on behalf of the Commissioner that ‘s.166 DPA 2018 does not provide a right of appeal against the substantive outcome of an investigation into a complaint under s.165 DPA 2018’ (at paragraph [13]).Whilst that is a not a precedent setting decision, I consider that it is right as a matter of legal analysis. Section 166 is directed towards providing a tribunal-based remedy where the Commissioner fails to address a section 165 complaint in a procedurally proper fashion. Thus, the mischiefs identified by section 166(1) are all procedural failings. ‘Appropriate steps’ must mean that, and not an ‘appropriate outcome’. Likewise, the FTT’s powers include making an order that the Commissioner ‘take appropriate steps to respond to the complaint’, and not to ‘take appropriate steps to resolve the James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO [2021] UKUT 299 (AAC) 20 complaint’, least of all to resolve the matter to the satisfaction of the complainant. Furthermore, if the FTT had the jurisdiction to determine the substantive merits of the outcome of the Commissioner’s investigation, the consequence would be jurisdictional confusion, given the data subject’s rights to bring a civil claim in the courts under sections 167-169 (see further DPA 2018 s. 180).”

[60]Judge Wikeley considered s.166 again in Scranage v Information Commissioner [2020] UT 196 (AAC). He observed at para 6:

“In my experience – both in the present appeal and in many other cases – there is a widespread misunderstanding about the reach of section 166. Contrary to many data subjects’ expectations, it does not provide a right of appeal against the substantive outcome of the Information Commissioner’s investigation on its merits. Thus, section 166(1), which sets out the circumstances in which an application can be made to the Tribunal is procedural rather than substantive in its focus. This is consistent with the term of Article 78(2) of the GDPR (see above). The prescribed circumstances are where the Commissioner fails to take appropriate steps to respond to a complaint, or fails to update the data subject on progress with the complaint or the outcome of the complaint within three months after the submission of the complaint, or any subsequent three month period in which the Commissioner is still considering the complaint.”

GRC Procedure Rules

[61]By virtue of Rule 22(1) of the GRC Procedure Rules, an appellant must start proceedings before the Tribunal by sending or delivering to the Tribunal a notice of appeal. Rule 22(6)(f) provides the time limit for applications to the First-tier Tribunal under s.166:

“(6) The time for providing the notice of appeal…is as follows … (f) in the case of an application under section 166(2) of the Data Protection Act 2018 (orders to progress complaints), within 28 days of the expiry of six months from the date on which the Commissioner received the complaint.”

The parties’ submissions

[62]On behalf of Mr Killock and Dr Veale, Ms Maya Lester QC with Ms Julianne Kerr Morrison and Mr Nikolaus Grubeck (and with Mr Gerry Facenna QC in writing) submitted that the object and purpose of articles 77 and 78 GDPR – and therefore of ss.165 and 166 DPA – was to provide data subjects with specific and concrete rights which permit them to hold supervisory authorities (such as the Commissioner) to account for any failure to act appropriately in response to their complaints. Recital 141 expressly provides that complainants are entitled to an effective remedy where the Commissioner “does not act on a complaint” and envisages updates extending to substantive matters such as “further investigation”. Article 78 provides specifically a judicial remedy obliging the supervisory authority to act on a complaint both by dealing with the complaint and by keeping the data subject informed of its progress. In making these submissions, Ms Lester relied on the legislative history of Article 78 which built on rights to an effective James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

21 remedy under Article 28 of the Directive which it replaced. We do not need to set out that history because, so far, we do not discern any material dispute between the parties.

[63]Ms Lester submitted that the duty of the Tribunal to provide an effective remedy in relation to the handling of complaints (as opposed to their substantive outcome) should not be reduced to a formalistic remedy but should provide an effective remedy – compelling the Commissioner to act appropriately in response to a complaint - where the Commissioner has failed to comply with her obligations. The wording of s.165 of the 2018 Act imposes what Ms Lester called “substantive obligations on the ICO”. S.165(4) requires the Commissioner to “take appropriate steps to respond to the complaint”. S.165(5) confirms that the obligation to take appropriate steps includes “(a) investigating the subject matter of the complaint to the extent appropriate”. The Tribunal in turn is empowered to provide a substantive remedy by ordering the Commissioner to take appropriate steps to respond to the complaint as well as to inform the complainant of progress or of the outcome of the complaint.

[64]On behalf of Mrs Coghlan, Mr Daniel Black emphasised the wording of the statutory provisions. On their literal meaning, ss.165 and 166 provide a remedy where the Commissioner fails to “take appropriate steps” or investigate “to the extent appropriate”. That is objective language. The Tribunal is required to assess the Commissioner’s investigation to an objective legal standard. The objective standard is reflected in Judge Wikeley’s interpretation of s.166 as encompassing a failure by the Commissioner to address a complaint “in a procedurally proper fashion” (Leighton (No 2), para 31).

[65]Mr Black submitted that that literal interpretation aligns with three features of the broader statutory regime. First, the remedy corresponds verbatim to the Commissioner’s statutory obligation to investigate complaints (“shall”) by reference to an objective standard (“appropriate”): article 57(1)(f) GDPR. Second, the effective remedy required by article 78 GDPR is not limited to cases of (on the one hand) complete inaction within three months or (on the other hand) the substantive outcome. The conduct of the investigation itself must be the subject of an effective remedy. This is clear from Recital 141, which states that an investigation following a complaint should be carried out, subject to judicial review, “to the extent that is appropriate in the specific case”. Third, the Commissioner may refuse to act on a request or to charge a reasonable fee where it is “manifestly unfounded or excessive”: article 57(4) GDPR and s.135 DPA. This would be otiose if the Commissioner enjoyed an unfettered discretion to consider that no or very limited steps were appropriate. In reality, the statutory scheme prescribes and limits the Commissioner’s – already residual – discretion to refuse to act on a request.

[66]Mr Black relied also on an argument based on the fundamental rights of data subjects to control by the supervisory authority (article 8(3) CFR) and to an effective judicial remedy (article 47 CFR). Those rights would become theoretical and illusory if the main question – the objective appropriateness of the steps the Commissioner has taken to respond to a complaint – were carved out from this judicial remedy. Clear words would be needed to erode this rights-based edifice and s.166 does not have them.

[67]On behalf of EW, Mr Rabinowitz emphasised that the provisions of s.165 do not impose a duty on the Commissioner to investigate to the extent that she considers appropriate but rather impose a duty to investigate “to the extent appropriate”. Naturally interpreted, a requirement to do what is “appropriate” is a requirement to do what is objectively reasonable in all the circumstances. The statutory scheme in ss.165 and 166 envisages that the Tribunal is entitled to and capable of determining the objective question of what is appropriate in a given case. James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

[68]More particularly, Mr Rabinowitz submitted that the jurisdiction of the Tribunal to make an order under s.166 will frequently depend on its assessment of whether the Commissioner has investigated a complaint to the extent appropriate. The Tribunal is empowered to make an order under s.166 where the Commissioner “fails to take appropriate steps to respond to the complaint” (s.166(1)(a)), which includes a failure to “investigat[e] the subject matter of the complaint, to the extent appropriate” (ss. 166(4) and 165(5)). The Tribunal must be entitled to determine for itself whether the Commissioner’s conduct is such as to trigger that jurisdiction. The particular remedies which the Tribunal is entitled to grant under s.166 assume that it is capable of determining what would be “appropriate” in a given case. The Tribunal is empowered to require the Commissioner to take “appropriate steps to respond to the complaint” (s.166(2)(a)), which steps the Tribunal is entitled to specify in the order” (s.166(3)(a)).

[69]On behalf of the Commissioner, Mr Julian Milford QC and Ms Harini Iyengar submitted that article 78 UK GDPR lays down substantive (article 78(1)) and procedural rights (article 78(2)). As the Explanatory Notes to the DPA state at para 40, s.166 “is a new provision and had no equivalent in the 1998 Act. It reflects the rights set out in Article 78(2) of the GDPR.” S.166 is intended to implement in domestic law the rights conferred by article 78(2) to an effective judicial remedy, where the competent supervisory authority “does not handle a complaint or does not inform the data subject promptly on the progress or outcome of the complaint lodged pursuant to Article 77”.

[70]Mr Milford submitted that article 78(2) is a remedy for inaction. In terms, it provides redress where a complaint has not been “handled”, or the complainant has not been informed of the outcome. It is not intended to impose a requirement that domestic courts should second-guess the regulatory choices of supervisory authorities as to how they choose to investigate complaints. Still less does it provide a right of appeal against the complaint outcome. Rather, any challenge to the outcome of the complaint falls within article 78(1). Where a supervisory authority has acted promptly, has concluded it has sufficient information to determine a complaint, and has done so, article 78(2) has no purchase.

[71]On well-established principles, s.166 DPA should be interpreted in light of the wording and purpose of the EU law provision which it implements. There is no difficulty in reading s.166 conformably with article 78(2). The language of s.166 is clearly directed at providing a remedy for failure to progress complaints, or to keep complainants informed, rather than a remedy against the complaint outcome, or indeed an allegedly inadequate investigative process.

[72]Mr Milford submitted that Platts, Leighton and Scranage are correct, for the reasons they give. The language of s.166 is clear. Any right of appeal against the outcome of a complaint would lead to the “jurisdictional confusion” to which Leighton (at para 31) refers, in circumstances where ss.167-169 DPA provide a complainant who considers that his or her data protection rights have been contravened with a right to bring a civil claim before the courts.

[73]If the Tribunal itself were to decide what an “appropriate” investigation should comprise, that would seriously undermine the Commissioner’s regulatory discretion. As the expert regulator, the Commissioner is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations. Such decisions will be informed not only by the nature of a complaint itself, but also by a range of other factors of which the Tribunal will have no or only second-hand knowledge, including, for example,(i) the Commissioner’s regulatory priorities;

(ii) other investigations that the Commissioner may have undertaken in the James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

23 same subject area;

(iii) the Commissioner’s judgment on how to deploy her limited resources most efficiently and effectively. The effect of the other parties’ submissions would be that the Tribunal would trespass upon the Commissioner’s complex judgements about how best to balance the respective rights and interests of data subjects, controllers and processors in a wide variety of different circumstances. Analysis and discussion

[74]The remedy in s.166 is limited to the mischiefs identified in s.166(1). We agree with Judge Wikeley’s conclusion in Leighton (No 2) that those are all procedural failings. They are (in broad summary) the failure to respond appropriately to a complaint, the failure to provide timely information in relation to a complaint and the failure to provide a timely complaint outcome. We do not need to go further by characterising s.166 as a “remedy for inaction” which we regard as an unnecessary gloss on the statutory provision. It is plain from the statutory words that, on an application under s.166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the s.166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a Tribunal from the procedural failings listed in s.166 towards a decision on the merits of the complaint must be firmly resisted by Tribunals.

[75]We do not accept that the limits of s.166 mean that the rights of data subjects are not protected to the extent required by the GDPR or by the CFR. Infringement of rights under data protection legislation is remediable in the courts (ss.167-169 DPA). In addition, if a data subject decides to complain to the Commissioner, s.166 provides procedural protections in order to ensure that the complaint receives appropriate, timely and transparent consideration. The Tribunal as a judicial body has expertise in procedural matters. It is therefore apt for a Tribunal to provide a remedy against procedural failings in complaints handling.

[76]The Tribunal does not have the same expertise in determining the appropriate outcome of complaints. The Commissioner is the expert regulator. She is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome. In so far as the Commissioner’s regulatory judgments would not and cannot be matched by expertise in the Tribunal, it is readily comprehensible that Parliament has not provided a remedy in the Tribunal in relation to the merits of complaints.

[77]This does not leave data subjects unprotected. If the Commissioner goes outside her statutory powers or makes any other error of law, the High Court will correct her on ordinary public law principles in judicial review proceedings. The combination of a statutory remedy in the Tribunal in relation to procedures and to the supervision of the High Court in relation to substance provides appropriate and effective protection to individuals. It does not require us to strain the language of s.166 to rectify any lack of protection or to correct any defect in Parliament’s enactment of the UK’s obligations to protect an individual’s data.

[78]Mr Black submitted that the interpretation of s.166 as a purely procedural provision would breach the principles of equivalence and effectiveness in EU law from which the rights in s.166 are derived. As to equivalence, almost all remedies against the Commissioner’s decisions in respect of information law were before the specialist Tribunal system. All parties’ remedies against a Commissioner’s decision notice (s.57 of James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

24 the Freedom of Information Act 2000), which were equivalent within the meaning of EU law, were among those remedies. By contrast, judicial review proceedings were clearly less favourable than Tribunal proceedings given their cost, costs risk and representation rules. A narrow interpretation would thus violate equivalence. Higher fees, the costs burden and the procedural complexity of judicial review proceedings constitute a restriction on the right to an effective remedy under article 47 CFR. Excluding a Tribunal remedy for substantive wrongs would constitute a disproportionate interference with the right to an effective remedy and (in Mr Black’s words) “render it excessively difficult and so breach effectiveness.”

[79]We disagree. As Mr Milford expressed the point in his skeleton argument, the principle of equivalence requires that procedure and remedies for claims derived from EU law should be no less favourable than those which apply to similar actions of a domestic nature. If there is no true comparator, the principle of equivalence has no operation (Totel Ltd v Revenue and Customs Commissioners

[2018] UKSC 44

[2018] 1 WLR 4053

, para 7). The question whether a proposed domestic claim is a true comparator with an EU claim is context-specific and the domestic court must consider the purpose and essential characteristics of allegedly similar domestic actions (Totel, paras 8-10). The purpose and essential characteristics of an appeal under s.57 FOIA are obviously different from those of a challenge to a complaint outcome under article 77. An appeal is brought under s.57 against a decision notice under s.50 FOIA. A decision notice is a statutory notice which declares the legal rights of the parties and might order the public authority receiving it to take steps to communicate specified information. By contrast, a complaint outcome itself has no compulsive force and does not order anyone to do anything. To the extent that the Commissioner decides to use her enforcement powers as a result of a complaint, that would be through the use of orders against which statutory rights of appeal lie.

[80]We do not accept that higher fees render access to justice in the High Court ineffective and no evidence to that effect was provided to us. Nor do we accept that effectiveness requires the Tribunal to be treated as the resort of those who seek to avoid adverse costs awards in the courts. In the contemporary era, judicial review proceedings are not necessarily more complex than Tribunal proceedings with their detailed procedure rules.

[81]The EU-derived context does not mean that judicial review is not an effective remedy. It is well-established that national authorities exercising EU law functions enjoy a wide margin of discretion in the exercise of complex assessments (Upjohn Ltd v Licensing Authority Established Under Medicines Act 1968

[1999] 1 WLR 927

, paras 33-37 and para 39). In our view, that wide margin is applicable in the present context.

[82]Mr Black invoked the context of fundamental rights, relying on the inclusion of data rights as fundamental rights within the EU’s legal order (see article 8 CFR above) and on article 47 CFR which ensures the right to an effective remedy for violations of the rights and freedoms guaranteed by EU law. In R (XH) v Secretary of State for the Home Department

[2017] EWCA Civ 41

[2018] QB 355

, para 136, the Court confirmed that article 47 CFR corresponds to

article 6 of the European Convention on Human Rights

(“the Convention”). In determining whether the principles of judicial review meet the requirements of article 47 CFR in any particular case, it was appropriate to have regard to the relevant jurisprudence in relation to article 6. The Court reiterated at para 147 the settled principle (both in the case law of the European Court of Human Rights and in domestic law) that, in determining what standard of review is required by article 6, it is necessary to assess the nature of the administrative decision and the nature of the exercise which the reviewing Court or Tribunal is called upon to perform in each particular case. Judicial review proceedings have been held to bestow full jurisdiction (in the sense of sufficient jurisdiction) and to satisfy article 47 CFR and article 6 of the James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

25 Convention where the decision under scrutiny relates to a specialised area of law and entails the exercise of judgment and expertise (XH, paras 145 and 147). In our view, the Commissioner’s multifactorial decisions as to the outcome of complaints in the context of the specialist regulatory area of data protection fall within this category. In relation to the substance of complaints, judicial review is an effective remedy.

[83]We agree however with Ms Lester’s submission that a s.166 order should not be reduced to a formalistic remedy and that the various elements of s.166(2) have real content in the sense of ensuring the progress of complaints. Parliament has empowered the Tribunal to make an order requiring the Commissioner to take appropriate steps to respond to a complaint (s.166(2)(a)). Any such steps will be specified in the order (s.166(3)(a)). Appropriate steps include “investigating the subject matter of the complaint, to the extent appropriate” (s.165(5)(a)).

[84]There is nothing in the statutory language to suggest that the question of what amounts to an appropriate step is determined by the opinion of Commissioner. As Mr Black submitted, the language of s.165 and s.166 is objective in that it does not suggest that an investigative step in response to a complaint is appropriate because the Commissioner thinks that it is appropriate: her view will not be decisive. Nor has Parliament stated that the Tribunal should apply the principles of judicial review which would have limited the Tribunal to considering whether the Commissioner’s approach to appropriateness was reasonable and correct in law. In determining whether a step is appropriate, the Tribunal will decide the question of appropriateness for itself.

[85]However, in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. The GRC is a specialist tribunal and may deploy (as in Platts) its non-legal members appointed to the Tribunal for their expertise. It is nevertheless our view that, in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations. As Mr Milford emphasised, her decisions about these matters will be informed not only by the nature of the complaint itself but also by a range of other factors such as her own regulatory priorities, other investigations in the same subject area and her judgment on how to deploy her limited resources most effectively. Any decision of a Tribunal which fails to recognise the wider regulatory context of a complaint and to demonstrate respect for the special position of the Commissioner may be susceptible to appeal in this Chamber.

[86]We do not mean to suggest that the Tribunal must regard all matters before it as matters of regulatory judgment: the Tribunal may be in as good a position as the Commissioner to decide (to take Mr Milford’s example) whether a complainant should receive a response to a complaint in Braille. Nor need the Tribunal in all cases tamely accept the Commissioner’s judgment which would derogate from the judicial duty to scrutinise a party’s case. However, where it is established that the Commissioner has exercised a regulatory judgment, the Tribunal will need good reason to interfere (which may in turn depend on the degree of regulatory judgment involved) and cannot simply substitute its own view.

[87]Moreover, s.166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question. We do not James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

26 rule out circumstances in which a complainant, having received an outcome to his or her complaint under s.165(b), may ask the Tribunal to wind back the clock and to make an order for an appropriate step to be taken in response to the complaint under s.166(2)(a). However, should that happen, the Tribunal will cast a critical eye to assure itself that the complainant is not using the s.166 process to achieve a different complaint outcome.

[88]The same reasoning applies to orders under s.166(2)(b) requiring the Commissioner to inform the complainant of progress on the complaint or of the outcome of the complaint within a specified period. These are procedural matters (giving information) and should not be used to achieve a substantive regulatory outcome.

[89]We are fortified in our conclusions by the fact that the GRC appears to date to have had no difficulty in applying s.166 so as to achieve an effective complaints procedure while recognising the expertise of the Commissioner. In Milne v Information Commissioner QJ/2020/0296/GDPR/V (2 December 2020), the GRC decided that it was not clear whether a particular letter sent by the Commissioner to the applicant was an outcome letter. Judge O’Connor ordered that the Commissioner should inform the applicant as to whether the letter constituted the outcome of the complaint. He ordered that, if the letter did not represent the outcome of the complaint, the Commissioner should inform the applicant of the progress of the complaint no less frequently than every 28 days until an outcome was reached.

[90]In Blaylock v Information Commissioner QJ/2020/0314/GDPR (20 December 2020), Judge O’Connor noted that, as at the date of the hearing before the GRC, more than 5 months had passed since the applicant’s first complaint and nearly 4 months had passed since a subsequent complaint. Despite this delay, the applicant had not been informed as to whether any action (by way of investigation or otherwise) was to be taken by the Commissioner in relation to the complaints. Judge O’Connor concluded that the Commissioner had not taken appropriate steps to respond to the complaints. He ordered that the Commissioner should within 21 days inform the applicant as to whether she was going to investigate the complaints and that she must inform the applicant of the progress of any investigation no less frequently than every 21 days.

[91]In these two short and focused decisions, we do not discern any overreaching by the GRC; nor did Mr Milford raise or direct us to any difficulties with Judge O’Connor’s approach. We regard these cases as good examples of the GRC ensuring the effective progress of complaints without stepping into the arena as to whether or not the complaints had merit. Our consideration of Mr Killock and Dr Veale’s application

[92]We agree with Ms Lester that Mr Killock and Dr Veale made individual and therefore justiciable complaints. The Complaint Form was submitted on behalf of two named individuals (the applicants) and made clear that the Complaint was about “the way an organisation is handling/processing my personal information”, including by “making automated decisions or profiling me” and using “my personal information in a way I didn’t expect”. The applicants’ core concerns related to the way in which personal data was used in the context of RTB systems but included concerns about the lack of protection of their own personal data. We agree that their professional expertise in raising wider industry practices does not mean that they could not raise concerns in a personal context.

[93]Mr Milford submitted that Mr Killock and Dr Veale’s application to the Tribunal is out of time. He acknowledged that they could not reasonably have complied with the time limits James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

27 in Rule 22(6)(f) of the GRC Procedure Rules in circumstances where their application concerns the outcome of an investigation which lasted for well over six months. Nevertheless, he submitted that the length of any appropriate extension of time would at the very most be 28 days from the date of the outcome letter - by parity with the 28 day period in Rule 22(6)(f). The applicants had not explained why they had waited until 21 October 2020 to apply to the Tribunal save to assert that it was only clear to them that they would need to apply when they received the Commissioner’s letter of 23 September.

[94]Ms Lester submitted that it would make no sense for complainants to be required to submit an appeal before the investigation is said to be completed. Rule 22(6)(f) does not govern applications made under s.166 where the investigation has not been completed within the six month period. There is no applicable time limit to extend. Instead there is a lacuna in the GRC Procedure Rules.

[95]In our view, the language of Rule 22(6)(f) is apt to cover any application under s.166(2) of the Data Protection Act 2018 irrespective of whether an outcome is reached within six months. There is no lacuna. The Rule means what it says: time starts to run from the date on which the Commissioner received the complaint and ends six months and 28 days thereafter. If the drafter of the Rules had intended a moving target – depending on some other stage of the procedure or the date of the outcome – he or she could and would have said so. The underlying legal policy is clear: the Commissioner may be expected to deal with a complaint within six months of receiving it. This six-month period reflects the two three-month staging posts in s.166(1)(b) and (c). If the Commissioner does not initiate and complete an appropriate procedure by that time, she is at risk of a judicial order. A person has 28 days from that six-month date to seek such an order. The proposition that the Tribunal may select for itself some other date and then add 28 days would be an illegitimate gloss on the statutory language.

[96]There is no injustice in this approach which ensures clarity, certainty and finality for litigants rather than a roving appeal right. As we have said, it reflects the overall timescale envisaged by the primary legislation (s.166). It provides a complainant with a concern about delay with a proper opportunity to seek a judicial decision. There is a discretion to extend time if justice requires it. By the time of her submissions in reply to Mr Milford, Ms Lester was inclined to agree that there is one time limit under the Rules which may then be extended at the discretion of the Tribunal. We think that that is the correct analysis.

[97]The application to the Tribunal was therefore out of time and we agree with Mr Milford that Mr Killock and Dr Veale would need an extension. In their Reply to the Commissioner’s Response to the proceedings, it is asserted that the timing of the August letter caused delay because it was received during the summer holidays. It was at that stage still not known what if any steps the Commissioner had taken to investigate and respond to the Complaint. There had been a need to seek clarification from the Commissioner. We are not sympathetic to the point about holidays and do not consider that the legally represented applicants needed the Commissioner’s assistance before lodging proceedings.

[98]We have some sympathy with the submission that there was undue and unexplained delay by Mr Killock and Dr Veale in commencing proceedings in the Tribunal after the August 2020 outcome letter. However, we do not think it is necessary to decide the question of whether to grant an extension of time because in our view the application itself lacks merit. We would prefer to reach a final conclusion as to the test to be applied for extending time in a case in which it would make a difference to the outcome. Not James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

28 least, as we set out below in relation to C’s appeal, there is some divergence of approach in the case law of the Upper Tribunal as to the test for an extension of time generally. We do not regard the present proceedings as an appropriate vehicle to resolve those divergences. For present purposes only, therefore, we are prepared to proceed on the basis that timeliness does not present a bar to our consideration of the application.

[99]In her skeleton argument, Ms Lester characterised the application to the Tribunal as an appeal against the decision of the Commissioner to “cease handling” the Complaint. She submitted that the Commissioner’s investigation into the Complaint had not yet reached an outcome in any meaningful sense or in the sense intended by article 77 UK GDPR or s.165. The Commissioner’s assertion that the Complaint had “assisted and informed the ICO’s broader regulatory approach” may be accurate but could not amount to an outcome. It did not tell the applicants whether the Commissioner had concluded that there had been an infringement of their data protection rights, nor what action was to be taken in response to any unlawful processing the Commissioner had identified. Having failed to reach an outcome, the Commissioner was in breach of her duty to inform the applicants about progress on the Complaint under s.165(5)(d).

[100]We agree with Mr Milford that the outcome of the Complaint was contained in the Commissioner’s letter of 20 August 2020. The outcome was to cease handling the Complaint but to continue with the wider industry investigation which had been informed and assisted by the Complaint. In accordance with her duty under s.165, the Commissioner informed the applicants of the outcome. The quality, adequacy or merits of the Complaints outcome fall outside the scope of s.166 and outside the jurisdiction of the Tribunal.

[101]The applicants – both in correspondence with the Commissioner and before us – have at times suggested that the Commissioner’s investigation of the AdTech industry and her investigation of the Complaint should progress together: the continuing investigation into AdTech amounts to a continuing investigation into the Complaint which has therefore not reached an outcome. The most egregious example of this approach relates to the blog post which we have mentioned above. In their letter dated 4 February 2020, the applicants’ solicitors criticised the Commissioner for publishing the blog post without notice to or engagement with the applicants. But the blog post had nothing to do with the handling of the Complaint. In her letter dated 20 February 2020, the Commissioner stated: “You complain that your clients were not informed about the issue of a blog prior to it being published and that they were not provided with an opportunity to make submissions and express their views. With respect neither s.165 nor any other applicable legal provision requires our clients to consult with and take account of your clients’ views before taking any such step. As an independent regulator it would be entirely inappropriate for us to act in such a manner and to prefer and prioritise the views of a small number of individuals over and above those of anyone else. To do so would be to act unfairly and to improperly fetter our discretion”.

[102]In our view, the Commissioner’s approach was impeccable. The Commissioner was under no duty to inform the applicants of the blog post or to consult them about it. It cannot possibly be maintained that engagement with the applicants about the blog post would have been an appropriate step in response to the Complaint. On the contrary, it would have been inappropriate (and against the public interest) for the applicants to James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

29 interfere with the work of the Commissioner and to require her to account to them in this way.

[103]A further example is the applicants’ contention that the Commissioner could not rationally provide an outcome letter in circumstances where investigation into AdTech continues and where the Commissioner has reached no final decision as to any regulatory action needed. An overlap between what the applicants were saying in their Complaint and the Commissioner’s wider regulatory work does not mean that the one is absorbed into the other. To treat the Complaint as co-extensive with the Commissioner’s work on overlapping subject matter would be to fetter the Commissioner’s regulatory discretion.

[104]After receiving the Complaint, the Commissioner was in regular contact with Mr Killock and Dr Veale to seek information and provided regular updates on her progress. As we have already mentioned: i. She held a meeting with them on 23 January 2019; ii. She invited them to a stakeholder meeting on 6 March 2019 at which she provided updates on the progress of her investigation; iii. She held a conference call with them on 20 May 2019 at which she again provided updates on progress; iv. She wrote again to explain the progress of her investigation on 24 July 2019 and then again on 13 September 2019; v. She invited them to an AdTech fact-finding forum on 19 November 2019, at which she again provided updates on the progress of her investigation; vi. By letters dated 20 February, 27 May and 21 July 2020, she summarised her position; vii. By letter date 20 August 2020, she informed them of the outcome of the Complaint, confirming her position by letter dated 23 September 2020.

[105]In our view, the Commissioner’s response to the Complaint met all statutory conditions. She took appropriate steps to respond to the Complaint; she investigated the subject matter of the complaint to the extent appropriate; she informed Mr Killock and Dr Veale about progress; she reached an outcome and informed them of it. She was not obliged to treat her investigation of the Complaint and her industry-wide investigation as co-extensive: to the extent that Mr Killock and Dr Veale are dissatisfied with the outcome of the Complaint, they raise matters that are(i) an actio popularis and

(ii) outside the scope of s.166. Should the applicants have considered that the outcome was inadequate or unlawful, they ought to have invoked the supervisory jurisdiction of the High Court. The Tribunal does not have jurisdiction to deal with such matters and we therefore decline to do so. Although Ms Lester focused her submissions on the complaint outcome, we should add that the criticism made in the grounds of appeal that the Commissioner did not respond to the Complaint appropriately or keep Mr Killock and Dr Veale informed about progress is in our view an attempt to wind back the clock so as to seek a preferred outcome which would be beyond the Tribunal’s jurisdiction.

[106]For these reasons, we refuse to make any order against the Commissioner. James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

30 Our consideration of EW’s application

[107]EW’s case, as Mr Rabinowitz submitted to us, was materially different from the others before us in that his complaints to the Commissioner were not investigated at all and he was not even offered the review of correspondence which was offered in Coghlan. A wide-ranging investigation akin to that in Killock and Veale would not have been required given the relatively narrow ambit of his individual SARs seeking his “full health and social care file … as well as [his] school records” and later all data held by the Council about himself.

[108]Instead what happened was that the ICO declined to investigate his complaints at all, stating that:(1) “The ICO Service Standards advise that if you wish to raise complaints about an organisation then this must be done within three months of receiving their final response to the issues raised. Waiting longer than that can affect the decisions that we reach. In some cases an undue delay will mean that we will not consider the matter at all. In this case the copy of the latest correspondence you provided is dated 16 August 2018. Taking into account this delay we do not intend to take any further action in relation to this matter. However, your concerns will be logged and kept on file as this will help us over time to build a picture of [the] Council’s information rights practices” (25 June 2019) and

(2) “We wrote to you on 25 June 2019 to advise that the ICO Service Standards advise that if you wish to raise complaints about an organisation then this must be done within three months of receiving their final response to the issues raised. In your original complaint the latest correspondence you provided was dated 16 August 2018. We therefore wrote to you to advise that based on the delay in bringing your complaint to the ICO, we were unable to consider your complaint further. We note that you sent a new complaints form to the ICO on 3 April 2020 and the latest correspondence you have provided is dated 25 May 2019. Taking into account this delay we do not intend to take any further action in relation to this matter. However, your concerns will be logged and kept on file as this will help us over time to build a picture of [the] Council’s information rights practices” (9 April 2020).

[109]We have set out the material parts of the Commissioner’s Service Standards above. In her well-articulated submissions, Ms Iyengar submitted that the Commissioner’s decision was in accordance with her Service Standards. EW had upon analysis simply been pushing for disclosure of his local authority records which was a substantive matter outside the scope of s.166 and had shown no good reason for the delay in bringing proceedings in relation to old matters. James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

[110]We can see no objection to the Commissioner having and publishing such Service Standards as guidelines and we see no conflict between those Service Standards and the Commissioner’s statutory duty to investigate complaints to the extent appropriate. To that extent we do not accept Mr Rabinowitz’s submission (in paragraph 33.1 of his skeleton argument) that we should not take notice of the Service Standards.

[111]However, if the Commissioner does have such Service Standards she must act in accordance with them, not inconsistently with them. What the Service Standards say is that (with emphasis added) “If you do want to raise concerns about an organisation then we suggest that you do so within three months of receiving their final response to the issues raised. Waiting longer than that can affect the decisions that we reach. In some cases an undue delay will mean that we will not consider the matter at all”.

[112]The Service Standards do not say, contrary to what the ICO said on 25 June 2019 and 9 April 2020 (again with emphasis added), “if you wish to raise complaints about an organisation then this must be done within three months of receiving their final response to the issues raised”.

[113]It is apparent that this erroneous interpretation of what is only a suggestion in the Service Standards being transformed into an absolute and imperative time limit of 3 months did influence the Commissioner in reaching her earlier decision since the Commissioner’s note of the telephone call with EW on the day of that decision states (with emphasis added) that: “ … Advised [as] last correspondence from [the Council] is Aug 2018 we cannot look into this complaint further (over 3 months) ...”.

[114]There is nothing to suggest that the Commissioner had corrected her erroneous interpretation of her own Service Standards by 9 April 2020. Indeed the response of that date demonstrates that she had not.

[115]We therefore accept Mr Rabinowitz’s submission that the Commissioner has not properly applied the Service Standards in this case. It is not therefore correct to assert, as the Commissioner did in paragraph 88 of her skeleton argument, that she had applied the Service Standards or that she applied the Service Standards fairly and consistently.

[116]As we have explained above, s.166 is a procedural, not a substantive, remedy which provides for a right of appeal to the Tribunal on process, where the Commissioner fails to address a complaint under s.165 DPA 2018 in a procedurally proper fashion. However, as we have concluded above, the appropriateness of the investigative steps taken by the Commissioner is an objective matter which is within the jurisdiction of the Tribunal and is not something solely within the remit of the Commissioner to determine for herself. In our judgment, by misconstruing and misapplying her own Service Standards, and thereby simply declining to investigate the complaints at all, the Commissioner did not take such steps as were appropriate to respond to the complaints.

[117]In those circumstances, where the Commissioner has failed to take appropriate steps to investigate the subject matter of EW’s complaints, the Tribunal may make an order James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

32 under s.166(2)(a) DPA 2018. We propose in the exercise of our discretion to make such an order in EW’s case because of(i) the seriousness of the subject matter underlying the complaint (namely, EW’s local authority records which touch on his right to respect for private life); and

(ii) EW’s young age which makes him (at least to some degree) vulnerable and thus less able to undertake the sort of administrative processes which correspondence with the Commissioner requires. For the avoidance of doubt, we make it plain that we are not expressing any view on whether EW should see his records: that is not our task.

[118]The order which this Tribunal proposes to make is that the Commissioner: i. Must take appropriate steps to respond to EW’s complaints by(i) within 14 days of the date of the promulgation of this decision, initiating correspondence with the relevant officials at the Council with a view to determining the basis on which EW’s SARs were refused and

(ii) having considered any responses provided by the Council, assessing whether or not those refusals (or any of them) were lawful ii. Must conclude the investigation of EW’s complaints within 2 months of the date of the promulgation of this decision and, having concluded such investigation, inform him by the end of that time of the outcome of his complaints.

[119]We shall direct that the parties in EW’s appeal shall file and serve any objections to these proposed directions within 14 days of the issue of our decision failing which we shall make an order in the terms above. Our consideration of C’s appeal

[120]Mrs Coghlan’s application to the Tribunal was out of time because it was not made within 28 days of the expiry of six months from the date on which the Commissioner received the complaint (see Rule 22(6)(f) above). We have considered whether to extend the time for bringing the application under Rule 5(3). Both parties asked us to consider the s.165 complaint and agreed that Mrs Coghlan’s appeal to us would stand or fall on the basis of our conclusions about the scope of the s.166 remedy. If the GRC was correct to say that Mrs Coghlan could not obtain a s.166 order, the matter would end there.

[121]Unlike in the case of Mr Killock and Dr Veale, the Commissioner provided a complaint outcome to Mrs Coghlan well within 6 months. Mrs Coghlan’s Notice of Appeal emphasises that the Commissioner directed her towards the ICO’s review process which led to the 29 May decision. Mrs Coghlan submitted that it would be unjust to exclude an appeal where the Commissioner had effectively insisted on a review process that would render the GRC application out of time. Nor would it be lawful: it would render excessively difficult or impossible the exercise of these EU-law derived rights. The application to the GRC was lodged within 28 days of the Commissioner’s review which was sufficient.

[122]We reject the submission that our interpretation of the GRC Procedures Rules violates the principle of effectiveness in EU law. That submission was made briefly in the Notice of Appeal but was not developed in Mr Black’s skeleton argument or indeed in his oral submissions. We were directed to no principle of EU law to suggest that domestic Courts and Tribunals may not impose time limits. We agree with Judge Wikeley’s view in Scranage (para 8) that the time limit is “more generous” than in the generality of GRC James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

33 appeals which have a 28-day time limit from the date of notice of the act or decision under challenge (see Rule 22(1)(b) of the GRC Procedure Rules).

[123]In any event, the GRC had power to extend the time limit in order to enable the effective exercise of C’s rights. Rule 5(3)(a) of the GRC Procedure Rules provides a power for the First-tier Tribunal to extend the time for complying with any rule, practice direction or direction. In our view, the question of whether to extend time depends on all the circumstances and not on the mechanistic addition of 28 days to the final step of the complaints process.

[124]The grounds of appeal contend that Judge Macmillan erred in law by applying the approach of Morgan J sitting as a Judge of the Upper Tribunal (Tax and Chancery Chamber) in Data Select, which imported the criteria for relief from sanctions from the Civil Procedure Rules (CPR 3.9) as opposed to the (perhaps) broader and less structured approach of this Chamber in PS v Information Commissioner

[2011] UKUT 94 (AAC)

and AW v Information Commissioner

[2013] UKUT 48 (AAC)

, which treated the issue of whether to allow a late appeal as a question of unfettered discretion, subject only to the overriding objective. We note that Judge Wikeley regarded Data Select as the applicable test in Scranage at para 15. We ourselves would be inclined to agree with Judge Wikeley’s approach which reflects BPP Holdings Ltd v HMRC

[2017] 1 WLR 2945

, paras 26-34 per Lord Neuberger.

[125]There is however no need for us to decide the point as we would refuse to extend time under either approach. In Mrs Coghlan’s case, there was no barrier to an appeal within the stipulated time limit. The Commissioner’s view was that judicial review proceedings should not be commenced prior to the exhaustion of other remedies, namely the review process. Mrs Coghlan did not lodge judicial review proceedings (which raise discrete consideration of the exhaustion of alternative remedies) but chose to seek an order from the GRC. She should have complied with the time limit and there is in our view no reason or cause to extend time on any of the tests suggested to us.

[126]In any event, Mrs Coghlan’s application for a s.166 order lacked merit. There is no merit in the submission that the Commissioner failed to deal with the complaint other than in accordance with her statutory duties. On 11 December 2019, the Commissioner informed Mrs Coghlan that the relevant correspondence had been reviewed. The Commissioner had sought and received confirmation from LBH that its email network was sufficiently secure to send unencrypted information. The Commissioner confirmed to Mrs Coghlan her view that there was no obligation on an organisation to encrypt emails and that there was no evidence to suggest that LBH’s email network was not secure. In our view, the Commissioner plainly responded to the complaint and plainly took appropriate steps to respond to it. She informed the complainant of the outcome of the complaint process within the statutory three-month period.

[127]The Commissioner in her letters dated 6 February and 18 February 2020 refused to change her mind. She was entitled and in our view correct to adhere to her previous position. In these circumstances, the Commissioner responded appropriately to the complaint and informed Mrs Coghlan of the outcome within the statutory time period. We agree with Judge Macmillan that, by the time of her appeal to the GRC, she had received that which the Tribunal could order under s.166(2). We have no hesitation in concluding that Mrs Coghlan is seeking to use C’s application to the Tribunal as a mechanism for ventilating her dissatisfaction with the outcome of the complaint and her underlying dissatisfaction with LBH’s email system. Such a course is not open to her. James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

[2021] UKUT 299 (AAC)

[128]For these reasons, we do not accept that the GRC failed properly to apply the law (ground 1) or that s.166 enables the Tribunal to determine if a decision was correct in substance (ground 2). C’s appeal is dismissed. Conclusion

[129]Accordingly: i. The application of Mr Killock and Dr Veale is refused. ii. The application of EW is allowed. iii. The appeal of C is dismissed. Postscript

[130]With regard to future potential law reform,

Judge Wikeley in Scranage observed at para 34:

“There is a wider jurisdictional issue in play here. Plainly the GDPR requires that data subjects have an ‘effective judicial remedy’ against both a ‘supervisory authority’ (here, the Commissioner) and a data controller or processor (see GDPR Articles 78 and 79 respectively). Domestic legislation provides that procedural redress against the Commissioner under Article 78(2) is sought from the Tribunal whereas substantive redress under Article 79 must be pursued in the courts (being the county court or the High Court). The policy reason for this jurisdictional disconnect, which is hardly helpful for litigants in person, or for developing a coherent system of precedent, is not immediately apparent. A comprehensive strategic review of the various appellate mechanisms for rights exercisable under the DPA is arguably long overdue. This might include consideration of whether the section 166(2) procedure is working as anticipated. Anecdotally at least, the experience of both the First-tier Tribunal and the Upper Tribunal is that a significant proportion of these applications have little merit yet consume a considerable and disproportionate amount of judicial and administrative resources.”

[131]We would endorse those observations. The Hon Mrs Justice Farbey Chamber President Mark West Judge of the Upper Tribunal In Killock & Veale and in EW: Pieter De Waal Member of the Upper Tribunal 24 November 2021

order

“167 Compliance orders James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO [2021] UKUT 299 (AAC) 18 (1) This section applies if, on an application by a data subject, a court is satisfied that there has been an infringement of the data subject's rights under the data protection legislation in contravention of that legislation. (2) A court may make an order for the purposes of securing compliance with the data protection legislation which requires the controller in respect of the processing, or a processor acting on behalf of that controller— (a) to take steps specified in the order, or (b) to refrain from taking steps specified in the order. (3) The order may, in relation to each step, specify the time at which, or the period within which, it must be taken. (4) In subsection (1)— (a) the reference to an application by a data subject includes an application made in exercise of the right under Article 79(1) of the GDPR (right to an effective remedy against a controller or processor) …”

Cited in 151 later judgments

and 41 more of the most senior

Showing the 50 most senior of 151.