The Applicant, David King, lodged a complaint with the Information Commissioner’s Office (ICO) about the processing of his personal data by the Royal Mail Group, arising from direct marketing material he had received from them.
The ICO responded to the complaint and confirmed that it could not reach a definitive conclusion that Royal Mail had breached data protection legislation. There was no evidence that Mr King had been specifically targeted, and given the age of the marketing material (from 2021) and regulatory priorities, no further action would be taken.
Mr King was unhappy with the decision and asked for an internal review. A reviewing officer reviewed the position and upheld the original outcome, confirming that the complaint had been handled appropriately and in accordance with ICO procedures.
Despite receiving an outcome and a review outcome, Mr King decided to apply to the First-Tier Tribunal under Section 166(2) of the Data Protection Act (DPA 2018), seeking an order requiring the ICO to take appropriate steps to respond to his complaint.
The law
Section 165 of the DPA 2018 gives data subjects a right to complain to the ICO about infringement of their rights under the data protection legislation.
Section 166 of the DPA 2018 allows a data subject to apply to the Tribunal where, after they have complained, the ICO fails to:
- take appropriate steps to respond to a complaint;
- fails to provide information about progress or the outcome within three months of receiving the complaint; or
- if the complaint is not concluded within the three-month period, fails to provide such information during a subsequent three-month period.
The Tribunal, in response to an application under Section 166 of the DPA 2018, makes an order requiring the ICO to take appropriate steps to respond to the complaint, or to inform the complainant of progress of the complaint within a period specified by the order.
The Tribunal does not have the power to make an order beyond the scope of Section 166 of the DPA. This has clearly been established in previous case law:
- Scranage v Information Commissioner [2020] UKUT 196 (AAC) – “Contrary to many data subjects’ expectations, [Section 166] does not provide a right of appeal against the substantive outcome of the Information Commissioner’s investigation on its merits.”
- Killock v Information Commissioner [2022] 1 WLR 2241 – “…It is plain from the statutory words that, on an application under section 166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome.”
Mr King argued that the ICO had not taken appropriate steps because the Commissioner had opted to delegate the investigation to his case officers. In support of his position, Mr King submitted that, had the Commissioner personally investigated the complaint, he would have agreed with him. The Tribunal therefore took the view that Mr King was trying to challenge the substantive outcome of the complaint rather than any procedural point.
Decision
The Tribunal, in its decision, confirmed that the scope of Section 166 of the DPA 2018 is limited to procedural issues. The ICO had taken steps to investigate and respond to the complaints pursuant to Section 165 of the DPA. The ICO had therefore complied with its procedural requirements as set out in Section 166 of the DPA.
By virtue of the above, the Tribunal did not have the power to make any order in the terms sought by Mr King. The proceedings were therefore struck out.
Comment
The above is a useful reminder as to the scope of Section 166 of the DPA 2018. Importantly, it is a means for challenging procedural issues and cannot be used to challenge the outcome of an ICO decision.
How can we help?
Ruby Ashby is a Senior Associate in our expert Dispute Resolution team, specialising in data breach claims, inheritance and Trust disputes and defamation claims.
If you need any advice, please do not hesitate to contact Ruby or another member of the team in Derby, Leicester, or Nottingham on 0800 024 1976 or via our our online enquiry form.
Contact usIf this article relates to a specific case/cases, please note that the facts of this case/cases are correct at the time of writing.