“The EAT must respect the factual findings of the Employment Tribunal and should not strain to identify an error merely because it is unhappy with any factual conclusions; it should not ‘use a fine toothcomb’ to subject the reasons of the Employment Tribunal to unrealistically detailed scrutiny so as to find artificial defects; it is not necessary for the Tribunal to make findings on all matters of dispute before them nor to recount all the evidence, so that it cannot be assumed that the EAT sees all the evidence; and infelicities or even legal inaccuracies in particular sentences in the decision will not render the decision itself defective if the Tribunal has essentially properly directed itself on the relevant law.”
“Analysis and discussion 74. The remedy in s.166 is limited to the mischiefs identified in s.166(1). We agree with Judge Wikeley’s conclusion in Leighton (No 2) that those are all procedural failings. They are (in broad summary) the failure to respond appropriately to a complaint, the failure to provide timely information in relation to a complaint and the failure to provide a timely complaint outcome. We do not need to go further by characterising s.166 as a “remedy for inaction” which we regard as an unnecessary gloss on the statutory provision. It is plain from the statutory words that, on an application under s.166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the s.166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a Tribunal from the procedural failings listed in s.166 towards a decision on the merits of the complaint must be firmly resisted by Tribunals. 75. We do not accept that the limits of s.166 mean that the rights of data subjects are not protected to the extent required by the GDPR or by the CFR. Infringement of rights under data protection legislation is remediable in the courts (ss.167-169 DPA). In addition, if a data subject decides to complain to the Commissioner, s.166 provides procedural protections in order to ensure that the complaint receives appropriate, timely and transparent consideration. The Tribunal as a judicial body has expertise in procedural matters. It is therefore apt for a Tribunal to provide a remedy against procedural failings in complaints handling. 76. The Tribunal does not have the same expertise in determining the appropriate outcome of complaints. The Commissioner is the expert regulator. She is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome. In so far as the Commissioner’s regulatory judgments would not and cannot be matched by expertise in the Tribunal, it is readily comprehensible that Parliament has not provided a remedy in the Tribunal in relation to the merits of complaints. 77. This does not leave data subjects unprotected. If the Commissioner goes outside her statutory powers or makes any other error of law, the High Court will correct her on ordinary public law principles in judicial review proceedings. The combination of a statutory remedy in the Tribunal in relation to procedures and to the supervision of the High Court in relation to substance provides appropriate and effective protection to individuals. It does not require us to strain the language of s.166 to rectify any lack of protection or to correct any defect in Parliament’s enactment of the UK’s obligations to protect an individual’s data.”
“83. We agree however with Ms Lester’s submission that a s.166 order should not be reduced to a formalistic remedy and that the various elements of s.166(2) have real content in the sense of ensuring the progress of complaints. Parliament has empowered the Tribunal to make an order requiring the Commissioner to take appropriate steps to respond to a complaint (s.166(2)(a)). Any such steps will be specified in the order (s.166(3)(a)). Appropriate steps include “investigating the subject matter of the complaint, to the extent appropriate” (s.165(5)(a)). 84. There is nothing in the statutory language to suggest that the question of what amounts to an appropriate step is determined by the opinion of Commissioner. As Mr Black submitted, the language of s.165 and s.166 is objective in that it does not suggest that an investigative step in response to a complaint is appropriate because the Commissioner thinks that it is appropriate: her view will not be decisive. Nor has Parliament stated that the Tribunal should apply the principles of judicial review which would have limited the Tribunal to considering whether the Commissioner’s approach to appropriateness was reasonable and correct in law. In determining whether a step is appropriate, the Tribunal will decide the question of appropriateness for itself. 85. However, in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. The GRC is a specialist tribunal and may deploy (as in Platts) its non-legal members appointed to the Tribunal for their expertise. It is nevertheless our view that, in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations. As Mr Milford emphasised, her decisions about these matters will be informed not only by the nature of the complaint itself but also by a range of other factors such as her own regulatory priorities, other investigations in the same subject area and her judgment on how to deploy her limited resources most effectively. Any decision of a Tribunal which fails to recognise the wider regulatory context of a complaint and to demonstrate respect for the special position of the Commissioner may be susceptible to appeal in this Chamber. 86. We do not mean to suggest that the Tribunal must regard all matters before it as matters of regulatory judgment: the Tribunal may be in as good a position as the Commissioner to decide (to take Mr Milford’s example) whether a complainant should receive a response to a complaint in Braille. Nor need the Tribunal in all cases tamely accept the Commissioner’s judgment which would derogate from the judicial duty to scrutinise a party’s case. However, where it is established that the Commissioner has exercised a regulatory judgment, the Tribunal will need good reason to interfere (which may in turn depend on the degree of regulatory judgment involved) and cannot simply substitute its own view. 87. Moreover, s.166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question. We do not rule out circumstances in which a complainant, having received an outcome to his or her complaint under s.165(b), may ask the Tribunal to wind back the clock and to make an order for an appropriate step to be taken in response to the complaint under s.166(2)(a).However, should that happen, the Tribunal will cast a critical eye to assure itself that the complainant is not using the s.166 process to achieve a different complaint outcome. 88. The same reasoning applies to orders under s.166(2)(b) requiring the Commissioner to inform the complainant of progress on the complaint or of the outcome of the complaint within a specified period. These are procedural matters (giving information) and should not be used to achieve a substantive regulatory outcome.”
“The treatment of such complaints by the Commissioner, as before, remains within his exclusive discretion. He decides the scale of an investigation of a complaint to the extent that he thinks appropriate. He decides therefore whether an investigation is to be short, narrow and light or whether it is to be long, wide and heavy.”
“… the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation, and, if so, to what extent. [Counsel for the Commissioner] correctly submits, further, that this discretion properly recognises that the Commissioner is an expert Regulator who is best placed to determine on which cases he should focus.”
“128. Section 166(2) thus provides the "effective judicial remedy" for dilatoriness referred to in Article 78.2. Sections 166(2) and (3) allow the Tribunal to order the Commissioner to take steps specified in the order to respond to the complaint. In my judgment, this would not extend to telling the Commissioner that he had to reach a conclusive determination on a complaint where the Commissioner had rendered an outcome of no further action without reaching a conclusive determination. This is because s.166 by its terms applies only where the claim is pending and has not reached the outcome stage. It applies only to alleged deficiencies in procedural steps along the way and clearly does not apply to a merits-based outcome decision.”
“131. For my part, if an outcome has been pronounced, I would rule out any attempt by the data subject to wind back the clock and to try by sleight of hand to achieve a different outcome by asking for an order specifying an appropriate responsive step which in fact has that effect. The Upper Tribunal rightly identified in [77] that if an outcome was pronounced which the complainant considered was unlawful or irrational then they can seek judicial review in the High Court. ...”
“60. For present purposes the most striking point about the language of that provision is that it does not contain any words that are redolent of decisions on the merits of a complaint. Article 57 does not adopt any of the familiar ways of designating a decision-making function. We are not told that the Commissioner must (for instance) adjudicate, decide, determine, rule upon, or resolve a complaint, or that complaints must be "upheld" or not upheld by the Commissioner. Rather, we are told that the Commissioner must "handle" a complaint. He must "investigate the subject-matter of the complaint" but even then only "to the extent appropriate". He must "inform" the complainant of the "progress" of the complaint and its investigation and its "outcome". 61. The same points can be made about Articles 77 and 78. Article 77(2) does not state that the data subject who exercises the Article 77(1) right to lodge a complaint is entitled to have the Commissioner adjudicate, or decide, or determine or resolve that complaint. It states that the Commissioner "shall inform" the complainant "on the progress and the outcome" of the complaint. No remedy is identified other than an "outcome". Article 78 does confer a right to an "effective judicial remedy" but it does not say there must be such a remedy where the Commissioner fails to determine the merits of a complaint. The conduct for which Article 78 requires an effective judicial remedy is failure to "handle" the complaint or to "inform" the data subject of its "progress" or "outcome". 62. These are all distinctive and unusual words to use in a context of this kind. As Mr Delo submits, a regulatory scheme usually provides for decisions to be made by the regulator. A dispute resolution mechanism calls for a definitive conclusion of the dispute. But in my view these are points against the interpretation advocated by Mr Delo rather than in favour of it. If this were domestic UK legislation intended to impose on the Commissioner a duty to reach and pronounce a decision on the merits of all complaints lodged by data subjects, in the same way that a court or tribunal would be bound to do if seized of a disputed allegation of infringement, then one would expect to see language of the kind I have mentioned at [60] above. From the perspective of an English lawyer, the absence of any such language and the use of the quite different terminology which I have highlighted are both remarkable features of Articles 57, 77 and 78. Making all due allowance for differences between the legislative methods of the UK and the EU, these are indications – and in my opinion strong ones – that the legislative intent was not to require the Commissioner to determine every complaint on its merits. 63. In my view, contrary to Mr Delo's submissions, the ordinary and natural interpretation of the language used in these provisions is that the Commissioner's principal obligations are to address and deal with every complaint by arriving at and informing the complainant of some form of "outcome", having first investigated the subject matter "to the extent appropriate" in the circumstances of the case. There are also second tier obligations, to inform the complainant of the progress of the investigation and of the complaint. 64. An "outcome" must be the end point of the Commissioner's "handling" of a complaint. A conclusive determination or ruling on the merits that brings an end to the complaint is certainly an "outcome" but that word is intended to have broader connotations. In Killock, the Upper Tribunal decided, in my view correctly, that it embraced a decision to cease handling a specific complaint whilst using it to inform and assist a wider industry investigation. In the present case, Mostyn J held that the word "outcome" is an apt description of the Commissioner's decision to conclude his consideration of Mr Delo's complaint by informing him of the Commissioner's view that the conduct complained of was "likely" to be compliant with the UK GDPR (or, put another way, that the complaint of infringement was "likely" to be ill-founded). Again, I would agree with that.”
“80. For the reasons I have given I would uphold the conclusion of the judge at [85] that the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint.”
“5.1. It was not the information of the complainee/Applicant that had been “handled” by the ICO but that of a third-party; 5.2. The ICO could not make recommendations to the Trust because it had not concerned itself with the personal data of the complainee/Applicant; 5.3. The ICO could not ask the Trust to explain how they handled the complainee’s/Applicant’s personal data because the ICO had wrongly excluded it from the ICO’s consideration of the subject matter of the complainee’s/Applicant’s complaint instead focusing upon the Wrong Data Subject; 5.4. The ICO could therefore not take regulatory action as it concerned the complainee’s/Applicant’s person data; 5.5. The ICO Case Officer could not weigh up the facts as they related to the complainee’s/Applicant’s personal data but only that of the Wrong Data Subject a third-party to these proceedings; 5.6. The ICO could not ask the Trust or the complainee/Applicant for further information because the Case Worker had not considered the complainee’s/Applicant’s personal data but that of the Wrong Data Subject; 5.7. Tell the complainee/Applicant of the outcome of the ICO’s considerations. In fact, the ICO expressly refused to do so by its email of30 August 2022 . It refused to consider the complainee’s/Applicant’s personal data electing to only consider that of the Wrong Data Subject; 5.8. The ICO could not take steps to cured [sic] the erasure of the complainee’s/Applicant’s personal data from the Trust database data because the ICO had excluded that personal data from its consideration; 5.9. The ‘outcomes’ contemplated by the ICO website questions could not be triggered because the ICO had excluded consideration of the complainee’s/Applicant’s personal data and therefore in consequence his complaint.”