BAILII
British and Irish Legal Information Institute


Freely Available British and Irish Public Legal Information

[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]

First-tier Tribunal (General Regulatory Chamber)


You are here: BAILII >> Databases >> First-tier Tribunal (General Regulatory Chamber) >> Panossian v Information Commissioner [2025] UKFTT 610 (GRC) (05 June 2025)
URL: http://www.bailii.org/uk/cases/UKFTT/GRC/2025/610.html
Cite as: [2025] UKFTT 610 (GRC)

[New search] [Printable PDF version] [Help]

Neutral Citation Number: [2025] UKFTT 610 (GRC)
Case Reference: FT/EA/2025/0032/GDPR

First-tier Tribunal
General Regulatory Chamber
Information Rights

Heard: on the papers in Chambers
Heard on: 30 May 2025
Decision Given On: 05 June 2025

B e f o r e :

TRIBUNAL JUDGE HAZEL OLIVER
____________________

Between:
ARAM PANOSSIAN
Applicant
- and -

INFORMATION COMMISSIONER
Respondent

____________________


____________________

HTML VERSION OF DECISION
____________________

Crown Copyright ©

    Decision:

    1. The decision on 7 March 2025 striking out the Applicant's application is set aside under Rule 41(2)(d) because there has been a procedural irregularity.

    2. The proceedings are struck out under Rule 8(3)(c) because there is no reasonable prospect of the Applicant's case, or part of it, succeeding.

    REASONS

  1. These proceedings involve an application to the Tribunal under section 166(2) of the Data Protection Act 2018 ("DPA"). The Applicant asks for an order in relation to a complaint to the Information Commissioner (the "Commissioner").
  2. Set-aside of previous decision

  3. On 7 March 2025 I decided to strike out these proceedings under Rule 8(3)(c) because there was no reasonable prospect of the Applicant's case, or part of it, succeeding.
  4. The Applicant made an application for permission to appeal this decision on 18 March 2025. The grounds of appeal were 70 pages long. It is not necessary for me to address all the grounds of appeal in this decision. One of the grounds was that the Applicant's submissions were not before the Tribunal. This is correct – the Applicant has sent the Tribunal detailed representations on why the application should not be struck out, but I did not see these representations when I made my decision.
  5. This was clearly a procedural irregularity. If an Applicant provides representations, these should be considered before a strike-out decision is made. My original decision cannot stand. The most appropriate way to deal with this issue is to set aside the decision and make it again, taking into account the Applicant's representations. I therefore set aside my decision of 7 March 2025 under Rule 41(2)(d) because there has been a procedural irregularity.
  6. New strike-out decision

  7. I make a new decision on strike-out as follows.
  8. Under Rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009, the Tribunal may strike out the whole or part of the proceedings if the Tribunal considers there is no reasonable prospect of the applicant's case, or part of it, succeeding.
  9. In his response to the application, the Commissioner submits that the Tribunal has no jurisdiction to consider the application and/or it has no reasonable prospect of succeeding and accordingly should be struck out. The Commissioner has made a strike out application on this basis.
  10. The Commissioner says that the remedies sought by the Applicant are not outcomes that the Tribunal can grant under section 166 DPA because an order can only be made in relation to procedural failings, and the Applicant was provided with an outcome to his complaint.
  11. Applicable law

  12. Section 165 DPA sets out the right of data subjects to complain to the Commissioner about infringement of their rights under the data protection legislation. Under section 166 DPA a data subject can make an application to this Tribunal for an order as follows:
  13. 166 Orders to progress complaints

    (1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner -

    (a) fails to take appropriate steps to respond to the complaint,
    (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or
    (c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.

    (2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner -

    (a) to take appropriate steps to respond to the complaint, or
    (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.
  14. The Tribunal can only make an order under section 166(2) if one of the conditions at section 166(1)(a), (b) or (c) is met. There have been a number of appeal decisions which have considered the scope of section 166. It is clearly established that the Tribunal's powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint. Some key decisions are:
  15. a. Killock v Information Commissioner [2022] 1 WLR 2241, Upper Tribunal at paragraph 74 - "…It is plain from the statutory words that, on an application under section 166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the section 166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a tribunal from the procedural failings listed in section 166 towards a decision on the merits of the complaint must be firmly resisted by tribunals."

    b. Mostyn J in the High Court in R (Delo) v Information Commissioner [2023] 1 WLR 1327, paragraph 57 - "The treatment of such complaints by the commissioner, as before, remains within his exclusive discretion. He decides the scale of an investigation of a complaint to the extent that he thinks appropriate. He decides therefore whether an investigation is to be short, narrow and light or whether it is to be long, wide and heavy. He decides what weight, if any, to give to the ability of a data subject to apply to a court against a data controller or processor under article 79. And then he decides whether he shall, or shall not, reach a conclusive determination...".

    c. Mostyn J's decision in Delo was upheld by the Court of Appeal ([2023] EWCA Civ 1141) – "For the reasons I have given I would uphold the conclusion of the judge at [85] that the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint." (paragraph 80, Warby LJ).

    d. The recent decision of the Upper Tribunal in Cortes v Information Commissioner (UA-2023-001298-GDPA) which applied both Killock and Delo in confirming that the nature of section 166 is that of a limited procedural provision only. "The Tribunal is tasked with specifying appropriate "steps to respond" and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court)….As such, the fallacy in the Applicant's central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation, and thereby launch a collateral attack on the outcome itself with the aim of the complaint decision being re-made with a different outcome. Such a scenario would be inconsistent with the purport of Article 78.2, the heading and text of section 166 and the thrust of the decisions and reasoning in both Killock and Veale and R (on the application of Delo). It would also make a nonsense of the jurisdictional demarcation line between the FTT under section 166 and the High Court on an application for judicial review." (paragraph 33).

  16. The Applicant made a complaint to the Commissioner on 4 June 2024 about the handling of a subject access request relating to his late father by Sainsbury's Supermarkets Limited ("Sainsburys"). I have seen a copy of this original request to Sainsbury's. He asked for details of what a number of payments made by his father related to. The Commissioner sent an outcome letter to the Applicant in response to his complaint on 4 September 2024. The letter explained that data protection rights only apply to living individuals, and data controllers are no longer legally obliged to respond to a subject access request after a person has passed away.
  17. The Applicant complained about this response on the basis that he was asking for his own personal data. The Commissioner provided a review outcome on 11 October 2024 which maintained the view that the request was not for his own personal data, explain "Personal data is defined as information from which a living individual can be identified. While we note you have advised you are the co-executor and co-beneficiary of your late father's will this does not cause the information requested to be your personal data". The letter also explained that if another individual's correspondence made reference to him, it will also be their personal data, and Sainsbury's would need to consider whether disclosure was reasonable. The letter provided some further advice on his options.
  18. The Applicant says that the Commissioner has failed to handle his complaint and failed to take appropriate steps to respond to his complaint.
  19. Representations from the Applicant

  20. The Applicant provided a response to the Commissioner's strike-out application on 24 February 2025. The response is 66 pages, plus supporting documents (including submissions in a different application involving Barclays bank). I have read and considered this response.
  21. The Tribunal's powers under section 166(2) are very limited, as set out in the caselaw referred to above. Cortes makes it clear that the Tribunal is not to assess the appropriateness of a response that has already been given. This is not a route to getting the complaint decision re-made with a different outcome. This principle applies where an applicant is dissatisfied with the Commissioner's complaint decision. My reading of the authorities is that this principle also applies where an applicant says the Commissioner has misinterpreted a complaint and/or misapplied the law in a complaint outcome. The Tribunal is not concerned at all with the merits of a complaint outcome. It is only concerned with whether the complaint has been dealt with, meaning whether a complaint outcome has been provided to the applicant.
  22. I have assessed the various arguments put forward by the Applicant against these legal principles, and whether the Commissioner failed to take appropriate procedural steps to respond to the complaint. I do not consider that any of these arguments show that the application has any reasonable prospect of success. My reasons are as follows.
  23. a. The Applicant says that he made a request for his own personal data, including data where he is directly identified. As noted above, if the Commissioner has made an error in a complaint outcome, this is not a matter for the Tribunal. In addition, the Commissioner's review outcome addressed the issue of personal data that might be contained in another individual's personal correspondence. The Applicant has referred to another first-tier Tribunal decision in Bartosik where there was a failure to consider one of the complaints at all. I do not agree that is comparable to this application. The review response from the Commissioner did refer to personal data (including where this is mixed with others' data), and in addition I find that the Applicant's wide definition of personal data is incorrect (see (b) below)

    b. The Applicant says that the processing of all the requested data is likely to have an impact on his "rights and interests" and so constitutes his personal data. He says this is the case because he is the personal representative of his late father's estate and beneficiary, previous LPA holder, and close family member.

    i. Again, if the Commissioner has made an error in a complaint outcome, this is not a matter for the Tribunal.
    ii. In addition, I do not agree that this is the correct legal definition of personal data under the DPA. It is not sufficient for information to impact a person's rights and interests in order to be their personal data. "Personal data" is any information relating to an identified or identifiable natural person, i.e. someone who can be identified (directly or indirectly) from the information. The Applicant makes detailed arguments that the definition of personal data includes any information that has an impact on his rights and interests. I do not agree. If the Applicant cannot be identified from that information, it is not his personal data. I understand that the Applicant has good reasons for wanting to know what happened to his late father's affairs, but this does not make the information the Applicant's personal data.

    c. The Applicant complains that the Commissioner mischaracterised his complaint, failed to engage with and clarify the issues raised, provided misleading information in the review letter, was inconsistent, and provided inadequate/insufficient reasons. The Applicant says that these are all procedural matters that the Tribunal can deal with. I disagree. The Tribunal's powers are very narrow. The Commissioner did consider the complaints and provided an outcome to the complaint, and this cannot be reopened by the Tribunal.

    d. The Applicant argues that his human rights have been breached – Article 6 (right to a fair trial) and Article 8 (private life). I do not agree that either of these rights would allow the Tribunal to go beyond the limited remit set out in the DPA and related caselaw, and I am required to follow the authorities set out above.

    e. The Applicant also refers to natural justice and the right to be heard. He says that his submissions cannot be considered a complete response on all relevant matters, and requests a hearing. I address this further below.

    f. The Applicant says that his application has been mischaracterised as challenging the substantive outcome rather than the procedure. He says his complaint has not been handled at all. I disagree – his complaint has been handled and an outcome was provided, as explained at (a) above.

    g. The Applicant says that the Commissioner rejected or dismissed the complaint for lack of jurisdiction because it considered the information in question did not constitute his personal data, and this was wrong because it was a request for personal data. I disagree, as explained in (a) and (b) above.

    h. In section Q of his submissions (paragraphs 253 to 376), the Applicant makes a number of points about how the Commissioner has failed to handle his complaint or take appropriate steps to respond to the complaint. I have considered these submissions. I do not consider that they show that his application has any reasonable prospect of success. The essential point remains that I am required to follow the caselaw set out above on the limits of the Tribunal's powers. The things the Applicant is asking the Tribunal to consider fall outside these powers.

    i. The Applicant says that the caselaw frequently undermines an effective judicial remedy, and argues that Delo is obiter in relation the Commissioner's discretion, He complains that, "What began as a clear and straightforward legislative mandate, designed to provide robust protections for data subjects, has been diluted into an approach that effectively removes any meaningful pathway to a remedy. The result is a system where data subjects are left without an effective remedy and the Information Commissioner is left to operate without oversight or supervision." I do have some sympathy for the Applicant's point. As I have said a number of times, the Tribunal's powers are very limited. The current legal position is not clear from the wording of section 166 alone, and many applicants to this Tribunal find this confusing and unsatisfactory. However, I am bound to follow the authorities set out above – including Cortes which makes clear that the inadequacy of an investigation into a complaint is not a matter for the Tribunal. As explained above, I disagree that the Commissioner failed to investigate or handle the complaint at all.

    Request for disclosure and a stay

  24. The Applicant had made an application for disclosure and a stay of proceedings. This was on the basis he had not been given sufficient information to identify, confirm or challenge procedural failings in the handling of his complaint. I do not consider that disclosure and/or a stay is required in these circumstances. The Applicant has misunderstood the limited nature of the Tribunal's powers, which do not involve looking at the detail of how a complaint has been handled. A complaint outcome was provided to the Applicant. According to the caselaw that I am required to follow, this means the application to this Tribunal under the DPA cannot succeed.
  25. Request for a hearing

  26. I have considered the Applicant's request for a hearing on strike-out. A strike-out application in section 166 DPA proceedings in this Tribunal will often be dealt with without a hearing, but that does not necessarily mean that a hearing is inappropriate. The Applicant says that his submissions are not a complete response to all relevant matters. He refers to the opportunity to develop and articulate complex or novel legal arguments. He also refers to his disability, saying that preparing written submissions has placed undue toll on him, and the harm of being misunderstood or ignored has not been mitigated. He complains that his previous submissions have been disregarded.
  27. I have thought about whether a hearing would be appropriate and in accordance with the overriding objective in this case. I have decided that it would not be, and it is appropriate to decide this matter on the papers. I have done so on the basis that the Applicant has been able to present lengthy and detailed arguments on paper, which I have considered. These arguments I have found to be entirely without merit. The overriding objective involves dealing with the case in ways which are proportionate to the importance of the case and the complexity of the issues, and avoiding delay so far as compatible with proper consideration of the issues. Although this issue is undoubtedly important to the Applicant, I consider that the point is not complex and the authorities (which I am bound to follow) are clear on the limited nature of the Tribunal's role.
  28. The overriding objective also involves ensuring, so far as practicable, that the parties are able to participate fully in the proceedings. This needs to be taken into account alongside the other elements of the overriding objective, and I have done so. The Tribunal's Rules on strike out require the Applicant to be given an opportunity to make representations, which he has done in considerable detiail. There is no right to a hearing. Having taken all of the circumstances into account, I do not consider that a hearing to discuss the matter further have any realistic prospect of leading to a different decision, and so would not be proportionate in all the circumstances.
  29. Conclusion on strike-out

  30. I understand that the Applicant feels strongly about this matter. However, it is clear that the Commissioner has considered and provided an outcome to the complaint, both in the original response and the review outcome. The Commissioner has handled the complaint and followed the procedure by providing an outcome. The Applicant's complaints about the Commissioner's handling of his complaint do not fall within the Tribunal's powers under section 166 DPA.
  31. I therefore find that there is no reasonable prospect of the case, or any part of it, succeeding. The proceedings are struck out.
  32. Other procedural matters

  33. I note that the Applicant has requested that no details of his address will be published. As in my previous decision, I can confirm that his address is not included in any publicly accessible documents (including this decision).
  34. Signed: Judge Hazel Oliver

    Date: 30 May 2025

About BAILII - FAQ - Copyright Policy - Disclaimers - Privacy Policy amended on 25/11/2010