Olufunke Osifeso v The Information Commissioner [2022] UKUT 146 (AAC)

Osifeso v Information Commissioner[2022] UKUT 146 (AAC)IN THE UPPER TRIBUNAL Appeal No.UA-2020-001601-GIAADMINISTRATIVE APPEALS CHAMBER (formerly GIA/830/2020)On appeal from the First-tier Tribunal (General Regulatory Chamber) (Information Rights)Between: Olufunke OsifesoAppellant- v –The Information CommissionerRespondentBefore: Upper Tribunal Judge WikeleyDecided on the papers: 1 June 2022
Between
Olufunke OsifesoAppellantThe Information CommissionerRespondentAppellant: In person for in personRespondent: Ms Harini Iyengar, instructed by the Information CommissionerDECISIONDate 2022-06-01

Introduction

[1]This appeal concerns the role and powers of the First-tier Tribunal on an application made under section 166 of the Data Protection Act 2018.

The procedural background

[2]The procedural history of this appeal is not in dispute and so can be dealt with in short order. On 1 July 2019, and then again on 9 December 2019, Ms Osifeso made complaints to the Information Commissioner about how the Royal Bank of Scotland (RBS) had handled her personal data. Dissatisfied with the Information Commissioner’s response, she then applied to the General Regulatory Chamber (GRC) of the First-tier Tribunal under section 166 of the Data Protection Act (DPA) 2018. On 31 January 2020 a GRC registrar struck out Ms Osifeso’s application on the basis that it had no reasonable prospect of success. Ms Osifeso applied for the matter to be considered afresh by a Judge. On 20 February 2020 Judge Macmillan carried out that reconsideration but reaffirmed the strike out ruling imposed by the GRC registrar. She also refused permission to appeal to the Upper Tribunal on 30 March 2020.[3]Ms Osifeso then applied to the Upper Tribunal for permission to appeal, which was granted by Upper Tribunal Judge Gray in a ruling dated 24 August 2020. Ms Osifeso’s further appeal was subsequently stayed pending the outcome of the proceedings before the three-judge panel Strictly speaking, an Upper Tribunal panel of two judges and one specialist member. of the Upper Tribunal in Killock and Veale v Information Commissioner; EW v Information Commissioner; Coghlan (on behalf of C) v Information Commissioner [2021] UKUT 299 (AAC), [2022] 1 WLR 2241 (referred to in this decision simply as ‘Killock and Veale v IC’). Both parties have since had the opportunity to make further written submissions in the light of the decision in Killock and Veale v IC. Neither party has requested an oral hearing. I am also satisfied it is fair and just to deal with this appeal on the papers, not least given the quality of those written submissions.

The legislative framework

[4]It is instructive to trace the legislative framework from the Recitals of the General Data Protection Regulation (GDPR), through the relevant Article in the GDPR, and finally to the corresponding section of the DPA 2018. The key legislative provisions are as follows (for more detail see paragraphs 42-60 of the decision in Killock and Veale v IC).[5]Recital 141 of the GDPR (so far as material) states: Every data subject should have the right to lodge a complaint with a single supervisory authority, in particular in the Member State of his or her habitual residence, and the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights under this Regulation are infringed or where the supervisory authority does not act on a complaint, partially or wholly rejects or dismisses a complaint or does not act where such action is necessary to protect the rights of the data subject. The investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case. The supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period…[6]Article 77(1) of the GDPR gives every data subject the right to complain to a supervisory authority (in the domestic context, the Information Commissioner) if they consider that the processing of their personal data infringes their GDPR rights. The relevant provisions of section 165 of the DPA 2018 accordingly provide as follows (or at least they did before the amendments made with effect from December 31, 2020, by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (SI 2019/419), but which matter not for present purposes and so are omitted): 165 Complaints by data subjects(1) Articles 57(1)(f) and (2) and 77 of the GDPR (data subject's right to lodge a complaint) confer rights on data subjects to complain to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the GDPR.(2) A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act.(3) The Commissioner must facilitate the making of complaints under subsection (2) by taking steps such as providing a complaint form which can be completed electronically and by other means.(4) If the Commissioner receives a complaint under subsection (2), the Commissioner must— (a) take appropriate steps to respond to the complaint, (b) inform the complainant of the outcome of the complaint, (c) inform the complainant of the rights under section 166, and (d) if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.(5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes— (a) investigating the subject matter of the complaint, to the extent appropriate, and (b) informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with another supervisory authority or foreign designated authority is necessary.[7]What then if the Information Commissioner fails to act in some way? By Recital 143 (so far as material) it is provided that: …each natural or legal person should have an effective judicial remedy before the competent national court against a decision of a supervisory authority which produces legal effects concerning that person. Such a decision concerns in particular the exercise of investigative, corrective and authorisation powers by the supervisory authority or the dismissal or rejection of complaints … Proceedings against a supervisory authority should be brought before the courts of the Member State where the supervisory authority is established and should be conducted in accordance with the Member State’s procedural law. Those courts should exercise full jurisdiction, which should include jurisdiction to examine all questions of fact and law relevant to the dispute before them…[8]Accordingly, Article 78(2) of the GDPR further provides data subjects with the right to an “effective judicial remedy” if the supervisory authority (here the Information Commissioner) does not take appropriate steps to respond to the complaint: Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to an effective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77.[9]The rights contained in Article 78(2) are given effect to by section 166 of the DPA 2018 (again, in its original terms): 166 Orders to progress complaints(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner— (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner— (a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.(3) An order under subsection (2)(a) may require the Commissioner— (a) to take steps specified in the order; (b) to conclude an investigation, or take a specified step, within a period specified in the order.

The First-tier Tribunal’s decision

(a) The First-tier Tribunal’s decision

[10]Having set out the terms of section 166, the First-tier Tribunal concluded as follows:12. The “appropriate steps” which must be taken by the Information Commissioner is further defined by s.165(5) DPA as investigating the subject matter of the complaint “to the extent appropriate” and keeping the complainant updated as to the progress of inquiries.13. If the Commissioner has failed to respond to a complaint, or has failed to provide an update or decision within 3 months of a complaint being made, the Tribunal may Order her to do so.14. The Commissioner has already considered the subject matter of both of Ms Osifeso’s complaints, leading to the Commissioner’s letters of response dated 30 July and 13 December 2019. The outcome of the Commissioner’s consideration is that she considers RBS to have acted lawfully.15. Although Ms Osifeso is unhappy with the Commissioner’s conclusions, it is for the Commissioner as regulator to determine to what extent it is appropriate to investigate any complaint. The Tribunal can only make an Order requiring the Commissioner to consider a complaint and/or to provide the person who has made the complaint with a response or an update. These are the only Orders that are available to the Tribunal under s.166(2). These Orders do not relate to the outcome of a complaint, but rather to the Commissioner taking some action in order to reach an outcome.16. A person who has made a complaint to the Commissioner has a right to challenge the Commissioner’s decision, by way of an application for judicial review or by complaining to the Parliamentary and Heath Service Ombudsman. They can also bring proceedings under the DPA against the data controller about whom they have complained. These types of challenges are different to s.166(2) Orders and are not dealt with by this Tribunal. The Registrar’s Decision notice refers Ms Osifeso to the options that are available to her.

Judge Macmillan accordingly reaffirmed the strike out decision made by the GRC registrar.

The Upper Tribunal’s grant of permission to appeal

[12]In the grant of permission to appeal, Upper Tribunal Judge Gray neatly summarised both the Appellant’s case and the issue raised by her appeal as follows:12. The applicant, in a well thought through submission, puts her argument forward as not in itself a disagreement with the decision arrived at by the ICO, but as a procedural issue relating to what the appropriate steps might have been for the ICO to take in investigating her complaint. In effect, she asks for the decision to be analysed and for directions to be made by the tribunal that the ICO take specific steps in relation to the complaint itself.13. The main issue seems to me to be whether the terms of section 166(2) are wide enough to allow the FTT to consider, not the merits of the ICO decision (that is, the outcome), but the appropriateness of the investigative steps that led to it.

Judge Gray further analysed the central issue in the following terms:

[13]18. The appellant’s argument, in essence, is that the decision to determine to what extent it is appropriate to investigate any complaint lies with the Tribunal. She argues that section 166(4), in providing that section 165(5) applies for the purposes of subsection 166(2)(a), confers power on the tribunal to make an order determining to what extent it is appropriate to investigate any complaint under section 165(5).

The decision of the Upper Tribunal in Killock and Veale v IC

[14]The Upper Tribunal’s decision in Killock and Veale v IC was handed down on 24 November 2021. The panel’s analysis of the scope of section 166 began as follows:74. The remedy in s.166 is limited to the mischiefs identified in s.166(1). We agree with Judge Wikeley’s conclusion in Leighton (No 2) that those are all procedural failings. They are (in broad summary) the failure to respond appropriately to a complaint, the failure to provide timely information in relation to a complaint and the failure to provide a timely complaint outcome. We do not need to go further by characterising s.166 as a “remedy for inaction” which we regard as an unnecessary gloss on the statutory provision. It is plain from the statutory words that, on an application under s.166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the s.166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a Tribunal from the procedural failings listed in s.166 towards a decision on the merits of the complaint must be firmly resisted by Tribunals.75. We do not accept that the limits of s.166 mean that the rights of data subjects are not protected to the extent required by the GDPR or by the CFR. Infringement of rights under data protection legislation is remediable in the courts (ss.167-169 DPA). In addition, if a data subject decides to complain to the Commissioner, s.166 provides procedural protections in order to ensure that the complaint receives appropriate, timely and transparent consideration. The Tribunal as a judicial body has expertise in procedural matters. It is therefore apt for a Tribunal to provide a remedy against procedural failings in complaints handling.76. The Tribunal does not have the same expertise in determining the appropriate outcome of complaints. The Commissioner is the expert regulator. She is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome. In so far as the Commissioner’s regulatory judgments would not and cannot be matched by expertise in the Tribunal, it is readily comprehensible that Parliament has not provided a remedy in the Tribunal in relation to the merits of complaints.77. This does not leave data subjects unprotected. If the Commissioner goes outside her statutory powers or makes any other error of law, the High Court will correct her on ordinary public law principles in judicial review proceedings. The combination of a statutory remedy in the Tribunal in relation to procedures and to the supervision of the High Court in relation to substance provides appropriate and effective protection to individuals. It does not require us to strain the language of s.166 to rectify any lack of protection or to correct any defect in Parliament’s enactment of the UK’s obligations to protect an individual’s data.[15]In the passage that then followed this extract (paragraphs 78-82), the Upper Tribunal reviewed various arguments based on EU law, which are not material for present purposes. The panel then returned to analyse the respective roles of the Information Commissioner and the First-tier Tribunal in section 166 cases (at paragraphs 83-88; Ms Lester QC appeared for Messrs Killock and Veale, Mr Black for Mrs Coghlan and Mr Milford QC for the Information Commissioner):83. We agree however with Ms Lester’s submission that a s.166 order should not be reduced to a formalistic remedy and that the various elements of s.166(2) have real content in the sense of ensuring the progress of complaints. Parliament has empowered the Tribunal to make an order requiring the Commissioner to take appropriate steps to respond to a complaint (s.166(2)(a)). Any such steps will be specified in the order (s.166(3)(a)). Appropriate steps include “investigating the subject matter of the complaint, to the extent appropriate” (s.165(5)(a)).84. There is nothing in the statutory language to suggest that the question of what amounts to an appropriate step is determined by the opinion of Commissioner. As Mr Black submitted, the language of s.165 and s.166 is objective in that it does not suggest that an investigative step in response to a complaint is appropriate because the Commissioner thinks that it is appropriate: her view will not be decisive. Nor has Parliament stated that the Tribunal should apply the principles of judicial review which would have limited the Tribunal to considering whether the Commissioner’s approach to appropriateness was reasonable and correct in law. In determining whether a step is appropriate, the Tribunal will decide the question of appropriateness for itself.85. However, in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. The GRC is a specialist tribunal and may deploy (as in Platts) its non-legal members appointed to the Tribunal for their expertise. It is nevertheless our view that, in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations. As Mr Milford emphasised, her decisions about these matters will be informed not only by the nature of the complaint itself but also by a range of other factors such as her own regulatory priorities, other investigations in the same subject area and her judgment on how to deploy her limited resources most effectively. Any decision of a Tribunal which fails to recognise the wider regulatory context of a complaint and to demonstrate respect for the special position of the Commissioner may be susceptible to appeal in this Chamber.86. We do not mean to suggest that the Tribunal must regard all matters before it as matters of regulatory judgment: the Tribunal may be in as good a position as the Commissioner to decide (to take Mr Milford’s example) whether a complainant should receive a response to a complaint in Braille. Nor need the Tribunal in all cases tamely accept the Commissioner’s judgment which would derogate from the judicial duty to scrutinise a party’s case. However, where it is established that the Commissioner has exercised a regulatory judgment, the Tribunal will need good reason to interfere (which may in turn depend on the degree of regulatory judgment involved) and cannot simply substitute its own view.87. Moreover, s.166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question. We do not rule out circumstances in which a complainant, having received an outcome to his or her complaint under s.165(b), may ask the Tribunal to wind back the clock and to make an order for an appropriate step to be taken in response to the complaint under s.166(2)(a). However, should that happen, the Tribunal will cast a critical eye to assure itself that the complainant is not using the s.166 process to achieve a different complaint outcome.88. The same reasoning applies to orders under s.166(2)(b) requiring the Commissioner to inform the complainant of progress on the complaint or of the outcome of the complaint within a specified period. These are procedural matters (giving information) and should not be used to achieve a substantive regulatory outcome.[16]Ms Osifeso also drew my attention to paragraph 116 of the Upper Tribunal’s decision, where the panel summarised its approach as follows: 116. As we have explained above, s.166 is a procedural, not a substantive, remedy which provides for a right of appeal to the Tribunal on process, where the Commissioner fails to address a complaint under s.165 DPA 2018 in a procedurally proper fashion. However, as we have concluded above, the appropriateness of the investigative steps taken by the Commissioner is an objective matter which is within the jurisdiction of the Tribunal and is not something solely within the remit of the Commissioner to determine for herself…

The parties’ submissions on the appeal in outline

[17]In her notice of appeal, the Appellant set out her position as follows (in summary). She argued that the Information Commissioner had failed to take appropriate steps to respond to her complaint (DPA 2018, section 166(1)(a)) by failing to investigate the subject matter of her complaint to the extent appropriate (DPA 2018, section 165(5)). She denied that she was challenging the Information Commissioner’s substantive response to her complaint. The effect of paragraph 14 of the First-tier Tribunal’s decision (see paragraph 10 above) was wrong in law in that it meant that once the Information Commissioner had provided a letter of response, then his investigatory duty had been automatically satisfied under section 165(5). Furthermore, paragraph 15 of the decision was wrong in law as the decision to determine to what extent it is appropriate to investigate any complaint lies with the First-tier Tribunal (DPA 2018, section 166(2)(a) and (4)), and not with the Information Commissioner.[18]The Information Commissioner resists the appeal, setting out his submissions in a written response drafted by Ms Harini Iyengar of Counsel, supplemented by a shorter supplementary response, prepared by the Information Commissioner’s in-house Legal Services team and dealing with the effect of the decision in Killock and Veale v IC. Ms Iyengar’s core submission was that there was no error of law in the decision by Judge Macmillan, as the Appellant’s section 166 claim had no reasonable prospect of success. This was because the Information Commissioner had handled her complaint(s) promptly, had taken appropriate steps, and had informed Ms Osifeso of the progress and outcome of her complaint(s), as well as notifying her of her rights to make an application under section 166. The true position, Ms Iyengar submitted, was that the Appellant’s real complaint was about what she believed was a substantive breach of her data protection rights. Any further remedies lay by way of proceedings in the county court or High Court (under section 167 of the DPA 2018) and not via section 166 in the First-tier Tribunal.[19]In his supplementary written submission, the Information Commissioner submitted that Killock and Veale v IC reaffirmed the strictly procedural focus of section 166 (see paragraph 74 of the Upper Tribunal’s decision). Furthermore, the Upper Tribunal stated that when considering the appropriateness of steps carried out by the Information Commissioner in relation to a complaint, a tribunal will be bound to give weight to the views of the Commissioner as an expert regulator (paragraphs 76 and 85). Thus, section 166(1) of the DPA 2018 is concerned with procedural failings (i.e. the failure of the Commissioner to give appropriate, timely and transparent consideration to the complaint), and not the merits of a complaint or its outcome (paragraphs 74 - 75 and 87 – 88). The Information Commissioner also referred to my ruling refusing permission to appeal in Kanter-Webber v Information Commissioner (GIA/928/2021, unreported), where I stated that “The question is not simply what is meant by the ordinary English word ‘investigate’. Rather, it is what is meant by the whole phrase ‘investigating the subject matter of the complaint, to the extent appropriate’. The expression ‘to the extent appropriate’ necessarily qualifies the verb ‘investigating’….Depending on the circumstances, it may well be that reading the complaint may be sufficient in and of itself to establish that no further investigatory action is needed.”[20]In reply, Ms Osifeso argues that the decision in Killock and Veale v IC supports her own appeal for the following reasons. First, the appeal is concerned with a ‘procedural’ failing under section 166(1)(a) in that the Information Commissioner failed to take appropriate steps to respond to the complaint by failing to investigate the subject matter of the complaint to the extent appropriate (section 165(5)) (see paragraphs 74 and 75). Second, the Information Commissioner cannot determine for himself the “appropriateness of the investigative steps taken” by exercising a “regulatory judgement”: (see paragraphs 84, 85 and 116). Third, the Upper Tribunal stated that the First-tier Tribunal will “cast a critical eye to assure itself that” the appeal for “…an order for an appropriate step to be taken in response to the complaint under s.166(2)(a)” is not being used “…to achieve a different complaint outcome”, notwithstanding(a) the “forward looking nature” of section 166 and(b) the provision of an outcome by the Commissioner (paragraph 87).

The Upper Tribunal’s analysis

[21]The proper scope and import of section 166 of the DPA 2018 is now much clearer as a result of the Upper Tribunal’s authoritative decision in Killock and Veale v IC. First and foremost, the section is concerned with providing a remedy for procedural failings on the part of the Information Commissioner. Thus, “on an application under s.166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome” (paragraph 74). This is, of course, entirely consistent with the language used in Article 78(2) of the GDPR – the right to an effective judicial remedy arises where the relevant supervisory authority “does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77”. In effect, the test for whether the Information Commissioner “does not handle a complaint” is if he “fails to take appropriate steps to respond to the complaint” (section 166(1)(a)). If he has so failed, then the First-tier Tribunal may make an order requiring the Commissioner “to take appropriate steps to respond to the complaint” (section 166(2)(a)). Taking appropriate steps in response to a complaint includes “investigating the subject matter of the complaint, to the extent appropriate” (section 165(5)(a)).[22]In considering an application under section 166, the First-tier Tribunal must bear in mind that the Information Commissioner is “the expert regulator” and “is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome” (paragraph 76). However, this does not mean that the Tribunal surrenders its judicial task to the Commissioner – thus, the Commissioner’s view carries weight but is not decisive (see paragraphs 84 and 85). As such, “where it is established that the Commissioner has exercised a regulatory judgment, the Tribunal will need good reason to interfere (which may in turn depend on the degree of regulatory judgment involved) and cannot simply substitute its own view” (paragraph 86). An example where the Commissioner’s view did not prevail was in EW v Information Commissioner, heard alongside Killock and Veale v IC, where the Commissioner misconstrued and misapplied the ICO’s own Service Standards, leading to a refusal to investigate the data subject’s complaints at all (see paragraph 116). In those circumstances, the Commissioner had not taken such steps as were appropriate to respond to EW’s complaints. Such an approach is consistent with Recital 143, which declares that courts (and so tribunals) “exercise full jurisdiction, which should include jurisdiction to examine all questions of fact and law relevant to the dispute before them”. To the same effect, Killock and Veale v IC shows that tribunals are not confined to a narrow judicial review approach (paragraph 84). To sum up, the degree of judicial oversight appropriate for section 166 applications could be described as relatively light touch but not hands-off.[23]The question then is whether the First-tier Tribunal’s decision is in accord with those principles. The core passage in its reasoning is set out in paragraphs 12-15 of its decision (see paragraph 10 above). Judge Macmillan, of course, did not have the benefit of having before her the principles and guidance as laid down by the Upper Tribunal in Killock and Veale v IC. The First-tier Tribunal’s reasoning is also undoubtedly compressed, but that reflects in part the absence of previous authority (the permission ruling in Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC), the first occasion on which the Upper Tribunal had given any consideration to section 166, was not published until 19 February 2020, literally the day before Judge Macmillan’s decision, and so was unlikely to have been before her). There is, in any event, no challenge based on the adequacy of the Tribunal’s reasoning.[24]For the following reasons I find that the decision of the First-tier Tribunal does not involve any material error of law. Paragraph 12 of the decision is simply an explanation or paraphrase of what is meant by “appropriate steps” by reference to the terms of sections 165 and 166. Paragraph 13 of the decision accurately summarises the circumstances in which the First-tier Tribunal can make an order under section 166(1) – merely describing the first such instance as where the Information Commissioner “has failed to respond to a complaint”, rather than “has failed to take appropriate steps to respond to a complaint”, is not an error of law, given that the passage is just a summary. Paragraph 14 is no more than a factual statement as to the outcome of the complaints and was plainly a conclusion that was open to the Tribunal to reach.[25]Paragraph 15 of the First-tier Tribunal’s decision is the one passage which is arguably closest to disclosing a possible error of law. For convenience it is repeated here: 15. Although Ms Osifeso is unhappy with the Commissioner’s conclusions, it is for the Commissioner as regulator to determine to what extent it is appropriate to investigate any complaint. The Tribunal can only make an Order requiring the Commissioner to consider a complaint and/or to provide the person who has made the complaint with a response or an update. These are the only Orders that are available to the Tribunal under s.166(2). These Orders do not relate to the outcome of a complaint, but rather to the Commissioner taking some action in order to reach an outcome.[26]There can be no quibbling with the description in this paragraph of the Tribunal’s powers under section 166. For example, “requiring the Commissioner to consider a complaint” is no more than convenient shorthand for “requiring the Commissioner to take appropriate steps to respond to the complaint”. Furthermore, the observation that the section 166(2) orders “do not relate to the outcome of a complaint, but rather to the Commissioner taking some action in order to reach an outcome” is entirely consistent with the principles expounded in Killock and Veale v IC.[27]The potentially problematic statement in this passage is that “it is for the Commissioner as regulator to determine to what extent it is appropriate to investigate any complaint”. On a narrow reading, this statement could be construed as meaning that the Information Commissioner has the sole power to determine the degree to which it is appropriate to investigate any complaint. If so, that would amount to an error of law, given Killock and Veale v IC. However, this does involve reading the statement as being “it is exclusively for the Commissioner as regulator to determine to what extent it is appropriate to investigate any complaint”.[28]It is important to remember that this is not an exercise in statutory construction but rather the interpretation of a first instance tribunal decision written under time pressures. As Lord Hope observed in R (on the application of Jones) v First-tier Tribunal [2013] UKSC 19, [2013] 2 AC 48, “it is well established, as an aspect of tribunal law and practice, that judicial restraint should be exercised when the reasons that a tribunal gives for its decision are being examined. The appellate court should not assume too readily that the tribunal misdirected itself just because not every step in its reasoning is fully set out in it” (at paragraph 25). It follows that appellate courts and tribunals must be careful not to seize on a particular phrase or passage and take it out of context. As the Court of Appeal held in Re F (Children) [2016] EWCA Civ 546 (at paragraph [23]):
“It is not the function of an appellate court to strive by tortuous mental gymnastics to find error in the decision under review when in truth there has been none. The concern of the court ought to be substance not semantics. To adopt Lord Hoffmann’s phrase, the court must be wary of becoming embroiled in ‘narrow textual analysis’.”
[29]Applying that more contextual approach, the First-tier Tribunal’s statement can be read just as no more or less than a statement about institutional competence – it is for the Information Commissioner as expert regulator to decide what amounts to appropriate steps in handling any given complaint. As such, it chimes with Killock and Veale v IC. Indeed, there could have been no complaint whatsoever if the statement that “it is for the Commissioner as regulator to determine to what extent it is appropriate to investigate any complaint” had been preceded by the phrase “in the first instance” or even by the single word “initially”. The inclusion of that one word might have been optimal, but its omission does not amount to a material error of law. Reading the First-tier Tribunal’s decision as a whole, it is implicit that the Tribunal accepted that the Commissioner had investigated the subject matter of the complaint to the extent appropriate. For example, the Tribunal acknowledged that the Information Commissioner had concluded that RBS had complied with its legal obligations, and that finding was referred to without any adverse comment (paragraphs 4 and 14).[30]If I am wrong about this, and the First-tier Tribunal’s decision does involve an error of law, I would as a matter of discretion decline to set its decision aside in any event. This is because on the facts the Tribunal came to the only decision that was realistically available to it. Ms Osifeso had lodged her complaint with the ICO on 1 July 2019. But as the Information Commissioner’s response to the original section 166 application explained (at paragraph 13): An ICO case officer responded to the complaint on 30 July 2019 to explain that she was of the view that RBS has complied with its data protection obligations as it had the “necessary basis” for processing the data in question. To clarify, what the case officer meant by this was that RBS had a lawful basis for processing the data, namely that set out in Article 6(1)(f), ie the processing was necessary for the purposes of the legitimate interests pursued by RBS, and those interests were not overridden by the interests of the Applicant. In the circumstances, none of the grounds in Article 17(1) applied and therefore RBS were not obliged to comply with the Applicant’s request for erasure.[31]Ms Osifeso may disagree with the substance of that outcome, but that is not in point for the purposes of section 166. Given that background, it is evident that the Information Commissioner complied with his statutory duties in this case in that he(i) handled the Appellant’s complaint promptly,(ii) took appropriate steps to investigate the complaint to the extent appropriate in the circumstances, and(iii) informed the Appellant of the outcome of the complaint. As such, the section 166 application had no reasonable prospect of success and so the strike out decision was justified.[32]The reality, despite the Appellant’s protestations, is that she is seeking to challenge the substantive outcome of the Information Commissioner’s handling of her complaint and/or RBS’s approach to her data protection rights, which she argues have been breached. As to the former, “any attempt by a party to divert a Tribunal from the procedural failings listed in s.166 towards a decision on the merits of the complaint must be firmly resisted by Tribunals” (Killock and Veale v IC at paragraph 74) – any remedy must be pursued in the High Court by way of judicial review. As to the latter, any remedy against a data controller or data processor lies in the county court or High Court (section 167 of the DPA 2018).

Conclusion

[33]It follows that I must dismiss this appeal.[34]Notwithstanding that outcome, which I appreciate will be disappointing for the Appellant, I should put on record my agreement with Upper Tribunal Judge Gray’s observation about the quality of Ms Osifeso’s written submissions. They have been drafted with both a careful attention to relevance and a clarity, crispness and economy of style which is singularly impressive. Nicholas Wikeley Judge of the Upper Tribunal Authorised for issue on 1 June 2022

Cited in 1 later judgment