First-tier Tribunal (General Regulatory Chamber)

First-tier Tribunal
(General Regulatory Chamber)
Information Rights

		28 November 2024

Decision made without a hearing

Decisions:

1. The Respondent's application to strike out the application of the Applicant is granted. The appeal FT/EA/2024/0326 is struck out under Rule 8(2)(a) as an application that cannot be made to this Tribunal and under Rule 8(3)(c) on the basis that there is no realistic prospect of the application in being successful.

2. The Tribunal strikes out the Applicant's application in FT/EA/20204/0118 of its own motion on the basis that this Tribunal has no jurisdiction to consider it under Rule 8(2)(a).

3. The Applicant' s applications to bar the Respondent from responding or to strike out their response is refused.

4. Noting that there have been four applications made under the Data Protection Act 1998 and four application struck out, any further applications may be summarily dismissed without notice to the Applicant and without requiring a response from the Respondent if the application cannot be considered due to a lack of jurisdiction (Rule 8(2)(a).

5. The costs of the Respondent in any future applications under the Data Protection Act 1998 which are struck out under Rule 8(2)(a) are reserved. This means the Tribunal may make an order against the Appellant to pay the costs of the Respondent incurred in responding to any future application which is subsequently struck out under Rule 8(2)(a).

REASONS

FT/EA/2024/0326

1. The Applicant lodged a notice of appeal to the Tribunal on 9^th August 2024. It was apparent from the appeal form (including the amended appeal form) that the Applicant was appealing against a decision of the Commissioner as regards a data handling complaint. Unusually the Commissioner was both the handler of the information and the Regulator for the purposes of the Complaint.
2. The grounds of appeal concluded that –

70. I believe that the respondent has failed to consider all the aspects of this case. The communication of both the respondent and the ICO has been unclear, and neither have not made it emphatically clear whether the consent of the relevant individuals was sought in order to satisfy the requirements of paragraph 16 of Schedule 2 of DPA18.

71. I also contend that the respondent considered the detriment to Ms Baker in relation to potentially disclosing copies of my personal data to me, however it has failed to demonstrate why the interests of Ms Baker outweigh my interests.

72. I believe that a fair and appropriate legitimate interests assessment, taking all the factors outlined in this document into account, would likely highlight my legitimate interests in having copies of Ms Baker's statement, and that these would outweigh any interests of the respondent or Ms Baker.

73. The respondent has also failed to disclose any of my personal data contained within Ms Baker's statement, despite its own requirement obliging a data controller to communicate as much of the requested information as it can, without disclosing the third-party's identity, as outlined in para. 52 of this document. I do not consider the withholding of this personal data to be fair or in line with its own requirements or legislation.

74. I believe that, in assessing my case, the Tribunal should also consider whether, given that I am likely to seek legal recourse in regard to the unlawful processing of my personal data conducted by Ms Baker and the respondent, the respondent is likely to need to provide copies of Ms Baker's statements anyway. It would therefore be reasonable to request this document for the purpose of receiving fair and accurate legal advice.

75. I also believe that the respondent has an interest in preventing the release of this statement. The respondent and the ICO are the same entity; given that the unlawful nature of Ms Baker's conduct and processing of my personal data have been identified, and admitted to by the respondent, the release of Ms Baker's statement would not likely cast the organisation in a good light. Ms Baker's team has been involved in some of the most prominent cases relating to the GDPR, and any issues relating to the conduct of Ms Baker or the ICO would naturally cause the efficacy and validity of any investigations conducted into question. I therefore believe that it would be in the public interest for this statement to be released to me, so that I can take appropriate action.

3. The Appellant sought the following remedies from the Tribunal –

76. I would like to request that the respondent provide me with a copy of Ms Baker's statement(s), as I believe that this constitutes my personal data relating to my service as an employee of the respondent.

77. I believe that the respondent has failed to apply a lawful exemption to the information requested and therefore would like the Tribunal to consider whether the exemption applied by the respondent was appropriate and correct based upon the legislation outlined.

78. Given that the unlawful processing of my personal data by Ms Baker has been identified as contravening Articles 5 (1)(a) & (f) of the UK GDPR, and the fact that the respondent themselves have identified that Ms Baker subjected me to bullying behaviours, I do not believe that her rights as a data subject outweigh mine, as the affected data subject.

79. I also believe that the release of her statement is crucial to ensuring that I can execute my rights as a data subject and obtain appropriate legal advice pursuant to anticipated litigation.

80. If the Tribunal does agree with my assertion, then I would like to request that the respondent be required to disclose the information requested without delay.

81. I would like the respondent to detail the steps that it took to confirm that the conditions for exemption under Paragraph 16 of Schedule 2 of the DPA18 were met. By way of example, it should be able to provide examples of where it sought the consent of the relevant data subjects.

82. I would also like the respondent to confirm whether it conducted a legitimate interests assessment when considering my request and whether the interests of both myself and Ms Baker were fully considered. I would like to request that it provides a copy of any LIA produced as part of this process.

83. I would like to request that the Tribunal consider whether the respondent has met its obligations under the UK GDPR.

84. I am also disappointed in the length of time and the manner in which the ICO, in its role as regulator dealt with providing me with updates in my case. I would like the Tribunal to consider the ICO's actions, particularly in relation to Article 57 of the UK GDPR, and for the ICO to explain the reason as to why it took 218 days to reach a regulatory outcome in this case.

85. Given that this issue relates to sensitive personal data about my personal life and potential criminal activities, I would like to request anonymity. This will help to protect my rights as set out under the Victim's Code and prevent unnecessary intrusion into my private life.

4. The Respondent responded to the Applicant's application to the Tribunal on 24^th September 2024. In that response, the Commissioner confirmed that he provided the outcome of the complaint on 12^th March 2024 and provided that document to the Tribunal. The Commissioner also made an application to strike out the application on the basis that the Tribunal did not have jurisdiction to hear the Applicant's complaint/appeal and that the application had no reasonable prospects of success.
5. The Applicant responded on 2^nd October 2024 and issued an application for the Respondent to be barred from participating in the proceedings due to the (perceived) late responsible/unreasonable actions of the Commissioner and that the response of the Respondent be struck out. He did not address the issue of jurisdiction or whether he could succeed in his application. He reiterated his complaint about the handling of his request and complaint to the Commissioner.
6. The Commissioner further responded to the Applicant's response and highlighted that the Applicant had made a number of similar applications.
7. The Commissioner said –

Mr Farr has made five s.166 DPA 2018 applications to the Tribunal since April 2023, two of which have been struck out following applications by the Commissioner. The Commissioner has applied to have the remaining three s.166 applications struck out on the grounds that the applications have no reasonable prospect of success and/or that the Tribunal does not have jurisdiction to consider the applications.

We note that Mr Farr had sought orders that the Commissioner's Responses be struck out or that he be barred from responding to these s.166 applications. Mr Farr now appears to seek an order that the Commissioner be barred "from proceedings in this case or restricting their involvement in proceedings". The Commissioner is the Respondent in these s.166 applications, which are procedural applications. The barring application appear to be an abuse of process, and the Commissioner refers our attached letter of 26 September 2024.

To assist the Tribunal we make the following points-

1. We note that the latest application includes a request for disclosure around an extension request in case FT/EA/2024/0118 however, the Tribunal granted an automatic extension due to the delay in providing documents in the case.

2. Mr Farr alleges a delay in the Commissioner filing his Response in accordance with the Case Management Directions issued on 27 August 2024 in cases EA/2024/0118 and EA/2024/0131. The Commissioner refutes this. The Response was filed on 24 September 2024, 27 days after receiving the complete set of the filed documents from the Tribunal on 28 August 2024, the Commissioner is entitled to 28 days to respond.

3. The Commissioner filed the abovementioned letter/response to Mr Farr's correspondence on 26 September 2024 which was not pursuant to a Case Management Direction.

FT/EA/2024/0118

8. There has been significant confusion about the application bought by the Applicant and to which data processing complaints they relate. It is very clear that his case is a further complaint about a data processing appeal. This appeal started in May 2024 but has been continued by the Appellant despite the very indication from this Tribunal on two previous occasions that it cannot deal with his complaint.
9. What is clear from the history is that the Applicant is choosing to make repeated applications that are not appropriate to the outcome that he seeks and that cannot be considered by this Tribunal. That is an abuse of the process of this Tribunal and a waste of public resources.
10. On 17^th May 2024 the Applicant's application EA/2024/0463 was stuck out by Judge Buckley who dealt with all the substantive issues that pertain to this application and struck out the Applicant's application. She said -

As the Commissioner correctly states in his response, if the Applicant wishes to seek an order of compliance against the Controller (the ICO) for breach of their data rights, the correct route for them to do so is by way of separate civil proceedings in the County Court or High Court under section 167 of the DPA18. If they wish to pursue the allegation of the section 173 offence further, the police are the appropriate body to deal with the complaint.

11. I note that application EA/2024/0232 was struck out on 1^st October 2024 by District Judge Watkins but this Tribunal still have two ongoing applications about the same data processing complaints.
12. The Appellant does have a right to make an application under s166 of the Data Protection Act 2028 as regards a complaint to the Information Commissioner. However, the scope of an application under section 166 of the Data Protection Act 2018 is to achieve some progress in a complaint that has not been progressed. Once an outcome is received, there is nothing left to progress. The Tribunal has no powers to investigate the investigation of the Respondent or supervise their investigation as is suggested in the notice of appeal.
13. As highlighted by the notice of appeal and the subsequent response from the Appellant, he seeks to for the Tribunal to review the complaint outcome which is not an outcome that can be achieved under a section 166 application. He seeks for the Tribunal to give its opinion on the outcome, supervise the Commissioner or direct disclosure which is not the remit of the Tribunal.
14. I considered it appropriate to conduct the review on the papers and without a hearing noting the nature of the strike out application made and having regard that both parties have fully responded to the issues. In addition, the issues have been ventilated twice before in previous cases.. The Tribunal must strike out an application where it does not have jurisdiction.

The legal framework and powers of the Tribunal

15. The Data Protection Act confirms the jurisdiction of the Information Commissioner for upholding information rights and data privacy. The Act provides limited scope for appeals to the Tribunal, proceedings in the County Court and the prosecution of offences before the criminal courts. The courts and tribunals can only deal with those issues that Parliament has intended it to do so as set out by the legislation.
16. As stated on the Information Commissioner's website – complaints about data protection outcomes can be reported for review to the ICO's office or referred to the Parliamentary and Health Service Ombudsman. There is no right of appeal to the First Tier Tribunal from a data protection decision save in the very limited circumstances permitted by the Act for example under s162 as regards penalty notices etc. This is distinct from Freedom of Information requests where decisions of the ICO can be appealed to the First Tier Tribunal. There also exists the right to apply for judicial review albeit that would relate to the reasonableness of decision-making discretion of the ICO rather than a disagreement with the decision itself, and noting the judicial review is costly and time-consuming. There is also a remedy available in the County Court.
17. Since the DPA 18 came into force a person can apply to this Tribunal for an "order to progress complaints" under section 166. That section provides –

166 (1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner—

(a) fails to take appropriate steps to respond to the complaint,

(b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or

(c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.

(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—

(a) to take appropriate steps to respond to the complaint, or

(b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

(3) An order under subsection (2)(a) may require the Commissioner—

(a) to take steps specified in the order;

(b) to conclude an investigation, or take a specified step, within a period specified in the order.

18. Under section 166 DPA18, a data subject has a right to make an application to the Tribunal if they consider that the Commissioner has failed to take action in relation to their complaint. This will no longer apply when an outcome response has been given by the Commissioner.

Analysis and conclusions

19. The Tribunal has no power to order further steps to have been taken when an outcome has been provided and in circumstances when there has clearly been an investigation, nor does the Tribunal have power to demand a different outcome. The remedies sought by the Applicant are not remedies that this tribunal can provide. This tribunal does not have the power to deal with his complaints.
20. I have not considered the merits or otherwise of the Applicant's application to disbar the Respondent or strike out the response. To do so would have little bearing on this case. His application would not succeed, whether to not the Commissioner was disbarred or his response ignored. This Tribunal cannot exercise powers that have not been given to it.
21. Section 166 Data Protection Act 2018 does not provide a right of appeal against the substantive outcome of an investigation into a complaint under s.165 Data Protection Act 2018. Furthermore, the Tribunal does not have any power to supervise or mandate the performance of the Commissioner's functions. This is the very consistent conclusions o the High Court, Upper Tribunal and the Court of Appeal. There is no inherent or overarching jurisdiction of the Tribunal to monitor or scrutinise; these powers lie elsewhere but not with this Tribunal.
22. There is no realistic prospect of the application succeeding in the circumstances and it would be a misuse of the resources of the Tribunal and the parties to allow that application to continue any further. Time spent on a meritless application reduces those resources available to consider other applications. As has been advised on numerous occasions, there are remedies available to the Applicant, just not in this Tribunal.
23. If the Applicant continues to issue applications under the DPA 1988 that cannot be dealt with this by this Tribunal for the reasons explained above, he is on notice that the Tribunal will exercise its case management powers to strike out the application upon receipt, without a hearing and without requiring a response from the Commissioner on the basis that the Tribunal lacks jurisdiction to consider those application. It is inappropriate for public resources to be wasted on hopeless applications and not in accordance with the overriding objective to permit him to do so.

District Judge Moan sitting as a First Tier Tribunal Judge

28^th November 2024