First-tier Tribunal (General Regulatory Chamber)

A picture containing text Description automatically generated

 

NCN: [2022] UKFTT 301 (GRC)

Case Reference: EA/2022/0102/GDPR [V]

First-tier Tribunal

General Regulatory Chamber

Information Rights

 

Heard by Cloud Video Platform

 

Heard on: 24 August 2022

Decision given on: 30 August 2022

 

Before

 

TRIBUNAL JUDGE NEVILLE

 

Between

 

mike davies

Applicant

and

 

information commissioner

Respondent

 

Representation:

For the Appellant:          The appellant in person.

For the Respondent:      No attendance

 

Decision: The proceedings are struck out pursuant to rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.

 

REASONS

 

1.      On 10 January 2022 the applicant made a complaint to the Commissioner that the Labour Party had not provided a response to his Subject Access Request made on 24 September 2021 within the one month time limit provided by Article 12(3) of UK GDPR. On 26 April 2022 the present application was made to the Tribunal by the applicant pursuant to s.166 of the Data Protection Act 2018:

166   Orders to progress complaints

(1)     This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner—

(a) fails to take appropriate steps to respond to the complaint,

(b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or

(c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.

(2)     The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—

(a) to take appropriate steps to respond to the complaint, or

(b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

(3)     An order under subsection (2)(a) may require the Commissioner—

(a) to take steps specified in the order;

(b) to conclude an investigation, or take a specified step, within a period specified in the order.

(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).

2.      The application was manifestly well-founded when it was made as there had been no response to the initial complaint within an initial period of 3 months. On 4 May 2022 the Commissioner provided an outcome to the complaint, as follows:

Our view

I have considered the information available in relation to this complaint and I am of the view that the Labour Party has not complied with their data protection obligations. This is because the Labour Party has not provided you with a response to your SAR within the one calendar month timeframe set out under Article 12(3) of the UK GDPR.

Next steps

I have therefore written to the Labour Party and explained that they need to ensure they provide you with a response to your request as soon as possible if they haven’t done so already.

I am of the understanding that the Labour Party is aiming to provide a response to all outstanding requests as soon as possible. Therefore, if you continue to not receive a response from the Labour  Party regarding this matter, I would advise contacting the Labour Party about these concerns. The ICO’s role is to provide an outcome individuals and we are unable to act as a mediator in these situations.

3.      The Commissioner subsequently provided a response to the present application pursuant to rule 23 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009, an extension of time having been sought for that purpose. Within the response the Commissioner requests that the application be struck out as having no reasonable prospects of success, the applicant having now had an outcome to this complaint and there being nothing left for the Tribunal to do.

4.      The Tribunal listed a remote hearing on 24 August 2022. The applicant attended. The Commissioner had confirmed that he would not be represented and would rely on his written submissions.

5.      I directed the applicant to the relevant legal principles. The statutory scheme only allows the Tribunal to address procedural failings by the Commissioner, rather than decide on a different substantive outcome to the complaint: Leighton v Information Commissioner (No.2) (Information rights - Data protection) [2020] UKUT 23 (AAC). Contrary to many data subjects’ expectations, s.166 does not provide a right of appeal against the substantive outcome of the Commissioner’s investigation on its merits: Scranage v Information Commissioner [2020] UKUT 196 (AAC). While the Tribunal does have the final say in considering the appropriateness of investigative steps, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. In the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations he should undertake into any particular issue, and how he should conduct those investigations. This will be informed not only by the nature of the complaint itself but also by a range of other factors such as his own registry priorities, other investigations in the same subject area and his judgement on how to deploy his limited resources most effectively: Killock & Ors v Information Commissioner [2021] UKUT 299.

6.      As to when it is appropriate to strike out proceedings due to a lack of reasonable prospects of success, in HMRC v Fairford Group (in liquidation) and Fairford Partnership Limited (in liquidation) [2014] UKUT 329 it was held that the approach should be similar to that taken in the civil courts pursuant to r.3.4 of the Civil Procedure Rules. The Tribunal must consider whether there is a realistic, as opposed to a fanciful (in the sense of being entirely without substance) prospect of succeeding on the issue on full consideration. A ‘realistic’ prospect of success is one that carries some degree of conviction and not one that is merely arguable. The Tribunal must avoid conducting a ‘mini-trial’. The power to strike out must be exercised in accordance with all aspects of the overriding objective (at r.2 of the Procedure Rules) to deal with cases fairly and justly, its effect being to debar a litigant from a full hearing of his claim. Yet striking out will be the correct course of action, and support the overriding objective, where an appeal or application raises an unwinnable case and continuance of the proceedings would be without any possible benefit to the parties and a waste of resources.

7.      Mr Davies told me that he had still not had a response to his SAR despite it having been nearly a year since it was made. This was, he said, part of a wider failure by the Labour Party to respond to SARs in accordance with the law.  The Commissioner was aware of the problem but appeared to be doing nothing about it. Responding to the complaint by simply informing the Labour Party that it had been upheld served no purpose. The result is that the Labour Party is routinely in breach of the law and faces no consequences from the regulator.

8.      Carefully considering Mr Davies’ submissions, I consider that the proceedings ought to be struck out as having no reasonable prospects of success. The obligation of the Commissioner is to take appropriate steps to respond to the complaint. Informing a data controller that it is in breach of the law and that it should now comply does provide the response to a complaint provided by the 2018 Act. I would observe that such a finding is often the final outcome in a wide range of regulatory complaints. Whether the circumstances are such that the Commissioner ought to be taking further action in relation to the Labour Party in particular, in general or in response to this complaint in particular, is a paradigm example of a matter falling within the Commissioner’s regulatory competence. There is no basis in the present case for the Tribunal to interfere that can withstand the principles set out in Killock. The Commissioner is therefore right that there is nothing left for the Tribunal to do.

9.      None of the above should be taken as any criticism of Mr Davies. He simply wants the Labour Party to comply with the law and respond to his Subject Access Request. They should have done so within 1 month (3 months in certain circumstances) but did not. Mr Davies was then entitled to complain to the Commissioner, and to have a response within 3 months. The Commissioner only provided an outcome after the present application to the Tribunal was made, likely causing greater resources to be expended by all concerned than if he had responded within the proper timescale. On one view, that outcome simply told Mr Davies and the Labour what they already knew. So Mr Davies’ frustration, with no response to his SAR nearly a year after it was made, is understandable. But this Tribunal cannot provide a remedy.

Signed                                                                                  Date:

Judge Neville                                                             30 August 2022