Tribunal’s Power Under Section 166 Of The DPA 2018 To Compel The ICO To Respond To A Complaint

Background

In this case, the Applicant sent a Subject Access Request (SAR) to Tower House Surgery. Unhappy with the handling of his request, he lodged a complaint with the Information Commissioner on 24 January 2024.

The Commissioner’s case officer contacted Tower House Surgery and asked for details of the SAR. Tower House Surgery provided a detailed chronology in relation to the handling of the Applicant’s SAR. The case officer was able to determine that the Applicant had requested hard copies of his notes and that this element of the request had not been complied with.

The case worker contacted the Applicant to confirm that they had instructed Tower House Surgery to provide him with the hard copy of the records in response to his SAR. The Commissioner closed the complaint on their system.

Following this, the Applicant sent further correspondence to the Commissioner. The case worker acknowledged the correspondence and noted that the Applicant’s concerns related to the NHS app, in respect of which they were unable to assist. The Commissioner, therefore, once again closed the complaint.

The Applicant applied to the Tribunal under Section 166(2) of the Data Protection Act 2018 (DPA 2018) to progress his complaint in relation to the handling of his DSAR by Tower House Surgery. Section 166(2) of the DPA 2018 gives the Tribunal the power to make an order requiring the commissioner to take appropriate steps to respond to a complaint or to inform the complainant of the progress of the complaint or the outcome of the complaint within a certain timescale.

The Commissioner applied to strike out the application on the basis that the order sought was not one which the Tribunal had the power to grant under Section 166 of the DPA 2018. The Commissioner also pointed out that if the Applicant wanted to seek an order of compliance against Tower House Surgery, the correct route would be to do so through the civil courts under Section 167 of the DPA 2018.

The law

Section 165 of the DPA 2018 gives data subjects the right to complain to the Information Commissioner in relation to infringement of their rights. As set out above, Section 166 of the DPA 2018 gives data subjects the right to apply to the Tribunal for an order requiring the Commissioner to deal with a complaint.

The Tribunal’s power is, however, limited to procedural issues and does not extend to establishing the merits of or the substantive outcome of a complaint.

Decision

The Tribunal determined that by instructing Tower House Surgery to provide hard copies of the documents, the Commissioner had dealt with the complaint. The Commissioner advised the Applicant that the complaint was closed and that they had instructed Tower House Surgery to disclose hard copy records. The Tribunal was therefore satisfied that the Commissioner had notified the Applicant of the outcome of the complaint.

The Applicant also expressed dissatisfaction with the response received from Tower House Surgery. The Tribunal made it clear that it does not have the power under Section 166 of the DPA 2018 to compel a public authority (in this case, Tower House Surgery) to comply with a request for information.

The proceedings were therefore struck out as it was determined that there was no reasonable prospect of success, and accordingly, the Tribunal did not have jurisdiction.

Comment

This case is an important reminder of the Tribunal’s limited powers under Section 166 of the DPA 2018. It is also an important reminder to seek legal advice if you are unsure as to your position and what steps you should take if you are dissatisfied with an ICO decision or a response to a SAR.