General Regulatory Chamber
Information Rights
Heard on: 30 May 2025 |
||
B e f o r e :
____________________
ARAM PANOSSIAN |
Applicant |
|
- and - |
||
INFORMATION COMMISSIONER |
Respondent |
____________________
____________________
Crown Copyright ©
Decision:
1. The decision on 7 March 2025 striking out the Applicant's application is set aside under Rule 41(2)(d) because there has been a procedural irregularity.
2. The proceedings are struck out under Rule 8(3)(c) because there is no reasonable prospect of the Applicant's case, or part of it, succeeding.
Set-aside of previous decision
New strike-out decision
Applicable law
166 Orders to progress complaints
(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner -
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or
(c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner -
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.
a. Killock v Information Commissioner [2022] 1 WLR 2241, Upper Tribunal at paragraph 74 - "…It is plain from the statutory words that, on an application under section 166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the section 166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a tribunal from the procedural failings listed in section 166 towards a decision on the merits of the complaint must be firmly resisted by tribunals."
b. Mostyn J in the High Court in R (Delo) v Information Commissioner [2023] 1 WLR 1327, paragraph 57 - "The treatment of such complaints by the commissioner, as before, remains within his exclusive discretion. He decides the scale of an investigation of a complaint to the extent that he thinks appropriate. He decides therefore whether an investigation is to be short, narrow and light or whether it is to be long, wide and heavy. He decides what weight, if any, to give to the ability of a data subject to apply to a court against a data controller or processor under article 79. And then he decides whether he shall, or shall not, reach a conclusive determination...".
c. Mostyn J's decision in Delo was upheld by the Court of Appeal ([2023] EWCA Civ 1141) – "For the reasons I have given I would uphold the conclusion of the judge at [85] that the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint." (paragraph 80, Warby LJ).
d. The recent decision of the Upper Tribunal in Cortes v Information Commissioner (UA-2023-001298-GDPA) which applied both Killock and Delo in confirming that the nature of section 166 is that of a limited procedural provision only. "The Tribunal is tasked with specifying appropriate "steps to respond" and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court)….As such, the fallacy in the Applicant's central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation, and thereby launch a collateral attack on the outcome itself with the aim of the complaint decision being re-made with a different outcome. Such a scenario would be inconsistent with the purport of Article 78.2, the heading and text of section 166 and the thrust of the decisions and reasoning in both Killock and Veale and R (on the application of Delo). It would also make a nonsense of the jurisdictional demarcation line between the FTT under section 166 and the High Court on an application for judicial review." (paragraph 33).
Representations from the Applicant
a. The Applicant says that he made a request for his own personal data, including data where he is directly identified. As noted above, if the Commissioner has made an error in a complaint outcome, this is not a matter for the Tribunal. In addition, the Commissioner's review outcome addressed the issue of personal data that might be contained in another individual's personal correspondence. The Applicant has referred to another first-tier Tribunal decision in Bartosik where there was a failure to consider one of the complaints at all. I do not agree that is comparable to this application. The review response from the Commissioner did refer to personal data (including where this is mixed with others' data), and in addition I find that the Applicant's wide definition of personal data is incorrect (see (b) below)
b. The Applicant says that the processing of all the requested data is likely to have an impact on his "rights and interests" and so constitutes his personal data. He says this is the case because he is the personal representative of his late father's estate and beneficiary, previous LPA holder, and close family member.
i. Again, if the Commissioner has made an error in a complaint outcome, this is not a matter for the Tribunal.
ii. In addition, I do not agree that this is the correct legal definition of personal data under the DPA. It is not sufficient for information to impact a person's rights and interests in order to be their personal data. "Personal data" is any information relating to an identified or identifiable natural person, i.e. someone who can be identified (directly or indirectly) from the information. The Applicant makes detailed arguments that the definition of personal data includes any information that has an impact on his rights and interests. I do not agree. If the Applicant cannot be identified from that information, it is not his personal data. I understand that the Applicant has good reasons for wanting to know what happened to his late father's affairs, but this does not make the information the Applicant's personal data.
c. The Applicant complains that the Commissioner mischaracterised his complaint, failed to engage with and clarify the issues raised, provided misleading information in the review letter, was inconsistent, and provided inadequate/insufficient reasons. The Applicant says that these are all procedural matters that the Tribunal can deal with. I disagree. The Tribunal's powers are very narrow. The Commissioner did consider the complaints and provided an outcome to the complaint, and this cannot be reopened by the Tribunal.
d. The Applicant argues that his human rights have been breached – Article 6 (right to a fair trial) and Article 8 (private life). I do not agree that either of these rights would allow the Tribunal to go beyond the limited remit set out in the DPA and related caselaw, and I am required to follow the authorities set out above.
e. The Applicant also refers to natural justice and the right to be heard. He says that his submissions cannot be considered a complete response on all relevant matters, and requests a hearing. I address this further below.
f. The Applicant says that his application has been mischaracterised as challenging the substantive outcome rather than the procedure. He says his complaint has not been handled at all. I disagree – his complaint has been handled and an outcome was provided, as explained at (a) above.
g. The Applicant says that the Commissioner rejected or dismissed the complaint for lack of jurisdiction because it considered the information in question did not constitute his personal data, and this was wrong because it was a request for personal data. I disagree, as explained in (a) and (b) above.
h. In section Q of his submissions (paragraphs 253 to 376), the Applicant makes a number of points about how the Commissioner has failed to handle his complaint or take appropriate steps to respond to the complaint. I have considered these submissions. I do not consider that they show that his application has any reasonable prospect of success. The essential point remains that I am required to follow the caselaw set out above on the limits of the Tribunal's powers. The things the Applicant is asking the Tribunal to consider fall outside these powers.
i. The Applicant says that the caselaw frequently undermines an effective judicial remedy, and argues that Delo is obiter in relation the Commissioner's discretion, He complains that, "What began as a clear and straightforward legislative mandate, designed to provide robust protections for data subjects, has been diluted into an approach that effectively removes any meaningful pathway to a remedy. The result is a system where data subjects are left without an effective remedy and the Information Commissioner is left to operate without oversight or supervision." I do have some sympathy for the Applicant's point. As I have said a number of times, the Tribunal's powers are very limited. The current legal position is not clear from the wording of section 166 alone, and many applicants to this Tribunal find this confusing and unsatisfactory. However, I am bound to follow the authorities set out above – including Cortes which makes clear that the inadequacy of an investigation into a complaint is not a matter for the Tribunal. As explained above, I disagree that the Commissioner failed to investigate or handle the complaint at all.
Request for disclosure and a stay
Request for a hearing
Conclusion on strike-out
Other procedural matters
Signed: Judge Hazel Oliver
Date: 30 May 2025