First-tier Tribunal (General Regulatory Chamber)

Neutral Citation Number: [2022] UKFTT 417 (GRC)

 

Case Reference: EA/2021/0046/GDPR

First-tier Tribunal

(General Regulatory Chamber)

Information Rights

Heard by: CVP

Heard on: 22 August 2022

Decision given on: 17 November 2022

 

Before

 

TRIBUNAL JUDGE NEVILLE

 

Between

 

Representation:

For the Applicant:          No attendance

For the Respondent:      No attendance

 

DECISION

 

The proceedings are struck out pursuant to r.8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.

 

REASONS

 

1.      On 27 July 2021 Mr Calvert made a request to his employer, the North East Ambulance Service NHS Foundation Trust. The request can be briefly summarised as requesting rectification of data held by the Trust that Mr Calvert asserted was inaccurate, pursuant to Article 16 of UK GDPR. Dissatisfied with its response, on 27 August 2021 Mr Calvert complained to the Commissioner.

2.      An outcome to the complaint was issued by the Commissioner on 21 December 2021, rejecting Mr Calvert’s complaint. He sought a review, and on 20 January 2022 the Commissioner’s decision was maintained. On 15 February 2022 Mr Calvert made the present application to the Tribunal under s.166 of the Data Protection Act 2018. The relief sought in the notice of application was as follows:

I would like the tribunal to review their decision based on the evidence and if the evidence once tested proves the decision made by the ICO was inaccurate, for this to be acknowledged by the ICO and for the organisation to uphold my information rights as a data subject and member of the public.

That being the case, I would then like the ICO to take any action they see legitimate and proportionate to the circumstances comment given the enforcement powers available to them, if indeed the data controllers have breached the referenced acts within the documents attached as supporting evidence.

3.      The Commissioner provided his rule 23 response on 24 June 2022. It contained an application for an order striking out the proceedings under rule 8(3)(c) as having no reasonable prospect of succeeding. Mr Calvert responded with his own written representations against the strike-out application, and the matter was listed for hearing. Neither party attended, each confirming that they were content to rely on their written submissions. I have carefully taken everything said into account. This decision has been delayed for reasons unrelated to this particular appeal, for which I apologise.

Legal principles

4.      The complaint to the Commissioner engages ss.165 and 166 of the Data Protection Act 2018, which set out how the Commissioner must respond to complaints and the Tribunal’s jurisdiction to make orders to progress them. The Commissioner’s statutory duty upon receiving a complaint is contained within s.165:

(4)  If the Commissioner receives a complaint under subsection (2), the Commissioner must—

(a)  take appropriate steps to respond to the complaint,

(b)  inform the complainant of the outcome of the complaint,

(c)  inform the complainant of the rights under section 166, and

(d)  if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.

(5)  The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—

(a)  investigating the subject matter of the complaint, to the extent appropriate, and

(b)   informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with [a]2 foreign designated authority is necessary.

5.      At s.166, the 2018 Act provides the following redress for a failure to meet that statutory duty:

166 Orders to progress complaints

(1)  This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the [UK GDPR] , the Commissioner—

(a)  fails to take appropriate steps to respond to the complaint,

(b)  fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or

(c)  if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.

(2)  The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—

(a)  to take appropriate steps to respond to the complaint, or

(b)  to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

(3)  An order under subsection (2)(a) may require the Commissioner—

(a)  to take steps specified in the order;

(b)  to conclude an investigation, or take a specified step, within a period specified in the order.

(4)  Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).

6.      It can be seen from the plain language of the statute that the section will only apply at all if one of the conditions at s.166(1)(a), (b) or (c) is met. There are further rights of action against the data controller or data processor contained at ss.167-169. These may only be pursued in the High Court or the county court, not in this Tribunal.

7.      The scope of s.166 was considered by the Upper Tribunal in Leighton v The Information Commissioner (No.2) (Information rights - Data protection) [2020] UKUT 23 (AAC). The Upper Tribunal’s analysis, which is binding upon me, was as follows:

31. I note that in Platts v Information Commissioner (EA/2018/0211/GDPR) the FTT accepted a submission made on behalf of the Commissioner that “s.166 DPA 2018 does not provide a right of appeal against the substantive outcome of an investigation into a complaint under s.165DPA 2018” (at paragraph [13]). Whilst that is a not a precedent setting decision, I consider that it is right as a matter of legal analysis. Section 166 is directed towards providing a tribunal based remedy where the Commissioner fails to address a section 165 complaint in a procedurally proper fashion. Thus, the mischiefs identified by section 166(1) are all procedural failings. “Appropriate steps” mean just that, and not an “appropriate outcome”. Likewise, the FTT’s powers include making an order that the Commissioner “take appropriate steps to respond to the complaint”, and not to “take appropriate steps to resolve the complaint”, least of all to resolve the matter to the satisfaction of the complainant. Furthermore, if the FTT had the jurisdiction to determine the substantive merits of the outcome of the Commissioner’s investigation, the consequence would be jurisdictional confusion, given the data subject’s rights to bring a civil claim in the courts under sections 167-169 (see further DPA 2018 s.180).

8.      The Upper Tribunal reached the same conclusion in Scranage v Information Commissioner [2020] UKUT 196 (AAC), holding that - contrary to many data subjects’ expectations - s.166 does not provide a right of appeal against the substantive outcome of the Commissioner’s investigation on its merits. The provision is procedural rather than substantive in its focus.

9.      In Killock & Ors v Information Commissioner [2021] UKUT 299 the Upper Tribunal held that s.166 is ‘forward-looking’. The Tribunal is concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint, specifying appropriate “steps to respond” rather than assessing the appropriateness of a response that has already been given. The same applies to orders under s.166(2)(b) requiring the Commissioner to inform the complainant of progress on the complaint or of the outcome of the complaint within a specified period. These are procedural matters (giving information) and should not be used to achieve a substantive regulatory outcome. A dissatisfied complainant must instead have recourse to the legal remedies at ss.167-169, or bring judicial review proceedings against the Commissioner in the Administrative Court.

10.  Killock does contain an important caveat to the above, expressed by the Upper Tribunal as follows:

87. … We do not rule out circumstances in which a complainant, having received an outcome to his or her complaint under s.165(b), may ask the Tribunal to wind back the clock and to make an order for an appropriate step to be taken in response to the complaint under s.166(2)(a). However, should that happen, the Tribunal will cast a critical eye to assure itself that the complainant is not using the s.166 process to achieve a different complaint outcome.

11.  The Upper Tribunal held that it is the Tribunal rather than the Commissioner which decides whether a particular investigative step is reasonable, the Commissioner’s view is not decisive. But in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. In the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations he should undertake into any particular issue, and how he should conduct those investigations. This will be informed not only by the nature of the complaint itself but also by a range of other factors such as his own registry priorities, other investigations in the same subject area and his judgement on how to deploy his limited resources most effectively. It should be noted that one of the parties in Killock, EW, was successful. The Commissioner had misconstrued and misapplied her own Service Standards, so in simply declining to investigate the complaint at all had not taken such steps as were appropriate to respond to the complaints.

12.  As to when it is appropriate to strike out proceedings due to a lack of reasonable prospects of success, in HMRC v Fairford Group (in liquidation) and Fairford Partnership Limited (in liquidation) [2014] UKUT 329 it was held that the approach should be similar to that taken in the civil courts pursuant to r.3.4 of the Civil Procedure Rules. The Tribunal must consider whether there is a realistic, as opposed to a fanciful (in the sense of being entirely without substance) prospect of succeeding on the issue on full consideration. A ‘realistic’ prospect of success is one that carries some degree of conviction and not one that is merely arguable. The Tribunal must avoid conducting a ‘mini-trial’. The power to strike out must be exercised in accordance with all aspects of the overriding objective (at r.2 of the Procedure Rules) to deal with cases fairly and justly, its effect being to debar a litigant from a full hearing of his claim. Yet striking out will be the correct course of action, and support the overriding objective, where an appeal or application raises an unwinnable case and continuance of the proceedings would be without any possible benefit to the parties and a waste of resources.

The parties’ arguments

13.   The Commissioner’s strike-out application principally argues that Mr Calvert’s quarrel is with the outcome of the complaints rather than its progression, in contravention of the legal principles set out above. The Commissioner accepts that it delayed in providing a timely outcome, but further complaint about the service provided is a matter for the Parliamentary and Health Service Ombudsman rather than the Tribunal. If Mr Calvert disagrees with the outcome, the Commissioner argues, he retains a private cause of action under the Act that can be pursued in the courts.

14.  Mr Calvert’s response correctly sets out some of the governing legal principles. his first argument concerns the delay and providing him with an outcome. Upon receiving the outcome letter on 21 December 2021, Mr Calvert had contacted the Commissioner’s case officer to advise that further evidence relevant to the case had emerged during the delay. The Trust had conducted a second investigation, the findings of which had contradicted the original investigation that had been submitted with the complaint. As the outcome had been reached following consideration of solely the original investigation, the situation had changed. Mr Calvert was advised to conduct a case review. When the case review outcome had been received, it appeared to Mr Calvert that the Commissioner had failed to consider all the available and pertinent documentary evidence. He had brought this to the attention of the reviewing officer, who had declined to take further action.

15.  Mr Calvert argues that his case does not simply seek to disagree with the outcome, but rather asks the Tribunal to direct the Commissioner to take proper steps to respond - in this by properly considering the documents he has put forward. The failure to have done this is put forward as a breach of the Commissioner’s case review and complaints policy, which states:

We will not necessarily respond to each of the points you have raised in the course of your complaint. However, we will … review the information relating to your data protection complaints and consider the points you have raised.

Consideration

16.  It is clear that the original complaint solely concerned a request for rectification of inaccurate data. Article 16 of UK GDPR provides as follows:

Article 16 Right to rectification

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

17.  The outcome letter set out the Trust’s response to the complaint. The Trust had declined to alter occupational health information provided by Mr Calvert’s line manager as it was a subjective opinion, and it was not possible for the Trust to confirm that it was inaccurate. The Trust had nonetheless placed the request for rectification on the file so that it would be apparent that Mr Calvert did not agree. Within the outcome letter, the Commissioner concluded that the Trust had complied with Article 16 and the relevant ICO guidance:

With regard to the Trust's response, they are correct in identifying that information that centres on opinion or recollections of past events cannot be considered inaccurate due to the subjective nature of opinions.

Our view is that in situations such as this, when there are differences of opinion, the data should highlight those differences. This is usually achieved by attaching a ‘note of dispute’ to the data that outlines the concerns about the accuracy of the information. And we can see that in your case the trust has taken steps to ‘save your request to rectification on your personal file in order to document that you disagree with the content. Following updates from yourself and your GP coming your personal file will be updated accordingly which made in counteract the original documents but for audit purposes the original document will remain on your file.

However, if you are adamant that the information should be rectified then you would need to consider exercising your right to a judicial remedy as outlined at Article 79 of the UK GDPR.

18.  Mr Calvert’s request for a review is clear and detailed. It can be summarised as arguing that the impugned data concerned facts rather than opinion: first, a referral form contained text at the top stating that it must be discussed with the employee, and it had not; second, it set out the wrong number of absences from work; third, the manager had signed a statement on the form confirming that it had been discussed with Mr Calvert and was accurate, when it was plainly not.  Mr Calvert provided documentary evidence to support his assertions that these matters were, objectively, inaccurate.

19.  The review of 21 December 2021 can be summarised as reaching two conclusions. First, the legal duty of rectification extends only to taking appropriate steps to investigate, then contacting the data subject with an outcome and, if refusing to correct the data, explaining why and (if appropriate) recording that the data’s accuracy had been challenged. The Commissioner’s view was confirmed that the Trust had complied with that duty. It should be noted that the Commissioner was not made aware prior to the review outcome that the Trust had changed its position and upheld the complaint.

20.  I consider that there is no reasonable prospect of Mr Calvert persuading a fully constituted Tribunal to make a s.166 direction. While in its letter of 30 December 2021 the Trust agreed to rectify some of the data, the Commissioner was not in possession of the Trust’s change of position when issuing the outcome and review. His investigation cannot be criticised for failing to take into account facts that were never put before him, and which post-dated the outcome. It might be open to Mr Calvert to make a fresh complaint based on what might be described as an acknowledged failure to correctly complete the rectification process within the one month period required by law. Whether or not that is the case, the situation having now been resolved through the Trust’s internal grievance procedure it is impossible to see that any action would follow that complaint. As correctly observed by the Commissioner, the duty to address the complaint has, beyond argument, been discharged.

21.  Ultimately the issue is best seen through the lens of what s.166 direction could ever be made. That put forward in the notice of application explicitly asks that the Tribunal consider the correctness of the outcome, which falls outside the jurisdiction conferred by the statute. Nor, I consider, can a realistic direction be formulated on Mr Calvert’s behalf. Re-considering the complaint by reference to the Trust’s investigation would illegitimately require the Commissioner to consider post-decision evidence with no identifiable benefit. Requiring the Commissioner to reconsider the complaint on the basis that the data was not subjective opinion would be illegitimately telling the Commissioner what to make of the substantive complaint, and he has plainly assessed that issue already. There is nothing left for the Commissioner to do, and Mr Calvert simply disagrees with the outcome. The Act gives a cause of action for breach of UK GDPR in the civil courts should Mr Calvert wish to pursue it. There is no realistic prospect of a s.166 direction being made by the Tribunal, and it would be wrong to let the case proceed further.

Signed                                                                                  Date:

Judge Neville                                                                    16 November 2022