It is well known that, under the UK GDPR and Data Protection Act 2018 (“DPA 2018”), data subjects can enforce their data protection rights against data controllers directly in the courts and seek compensation for breaches of those rights.

Entirely separate to that, data subjects also have the right to make a complaint to the Information Commissioner’s Office (“ICO”) if they consider that, in connection with personal data relating to them, there is an infringement of the UK GDPR. Many complaints are made to the ICO about alleged failures of data controllers to adequately deal with data subject access requests (“DSAR”). But what if the ICO sits on a complaint or does not investigate it properly? Whilst the traditional remedy for the failure of a public body to properly exercise its decision making powers is to seek a judicial review, the DPA 2018 makes specific provision for failures of the ICO to progress a complaint under section 166 DPA. Under this provision, a data subject can apply to the First-tier Tribunal (“FTT”) for an order that the ICO progress a complaint which has been made to it under section 165 or Article 77 GDPR.

Given the huge workload of the ICO and its limited resources, it is no surprise that it does not investigate every complaint it receives to the nth degree. The entitlement of complainants to use s166 DPA to compel it to do so and to get the ICO to review any decision not to investigate has been the subject of some recent judicial consideration, reaffirming the limited scope of the provision in practice.

Aligning with precedents set in Killock and Veale in 2021 and Delo in November 2022, a decision by the Upper Tribunal (“UT”) in early 2023 in Lawton v Information Commissioner struck out a data subject’s complaints against the ICO’s decisions not to consider any further two DSAR complaints he made.

Background

Mr Lawton complained to the ICO about how two separate organisations had handled his DSARs. In both complaints the ICO decided that no further action was required by it.

Mr Lawton subsequently complained to the FTT that in both instances the ICO had “not taken appropriate steps to investigate his complaint”.

The FTT considered both complaints separately with two different FTT Judges reaching the same conclusion. They both determined that his applications had “no reasonable prospects of success”. Therefore, both FTT Judges struck out his complaints.

Points of contention

Mr Lawton appealed the FTT’s decision to the UT on the basis that the ICO did not investigate his complaints regarding the processing of his personal data “to the extent appropriate”. In addition, he claimed that although the ICO had provided an outcome i.e., that it would not consider his complaints any further, the FTT had powers under section 166 DPA 2018 to order the ICO “to investigate to the extent appropriate, including specifying particular investigatory steps to be taken”.

The ICO’s defence rested on its view that its decision not to consider the complaints further was the outcome. The ICO also submitted that section 166 DPA 2018 is inapplicable in the said case because it only applies when “there has been a total absence of any investigation”. Additionally, the ICO argued that a “considered decision” not to pursue a complaint any further falls within the ICO’s “lawful exercise of its broad discretion as an expert regulator” and should “not be interfered with in the absence of good reason”.

Section166 DPA 2018 – Orders to progress complaints

(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner—

• fails to take appropriate steps to respond to the complaint,

• fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or

• if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.

(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—

• to take appropriate steps to respond to the complaint, or

• to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

(3) An order under subsection (2)(a) may require the Commissioner—

• to take steps specified in the order;

• to conclude an investigation, or take a specified step, within a period specified in the order.

Judgment

In reaching a judgment, UT Judge Wikeley considered a previous UT decision in Killock and Veale and the High Court judgment in Delo.

In Killock and Veale, it was decided that the complainant’s appeal was time barred because they failed to appeal the ICO’s decision within 6 months and 28 days of the ICO receiving their complaint, as required by Rule 22(6)(f) GRC Procedure Rules.

The UT Judge decided not to consider whether to grant an extension of time in the instant case because “the application itself lacks merit”. The UT Judge stated, “the quality, adequacy or merits of the Complaints outcome fall outside the scope of section 166 and outside the jurisdiction of the Tribunal.” Rather, the complainants should have invoked their right to apply to the High Court for a judicial review if they were unhappy with the outcome of their complaint.

In Delo, the High Court Judge determined that section 166 only applies narrowly to “deficiencies in procedural steps along the way” and does not apply to “merits-based outcome decisions”. As such, the court could not tell the ICO to reach a “conclusive determination” on a complaint in instances where the ICO’s decision on the complaint is that it would take no further action.

The High Court Judge emphasised that where an outcome was given by the ICO, including an outcome of no further action, data subjects cannot “wind back the clock and to try by sleight of hand to achieve a different outcome by asking for an order specifying an appropriate responsive step which in fact has that effect”.

In Lawton, UT Judge Wikeley determined that there was no compelling reason for him to depart from the decisions in Killock and Veale, and Delo. He was satisfied that they were correctly decided and relevant to Mr Lawton’s case.

UT Judge Wikeley remarked that the purpose of section 166 DPA 2018 was to provide “Orders to progress complaints” not “Orders to re-open or re-investigate complaints”. Therefore, as Mr Lawton’s complaint had been progressed to an outcome, albeit an outcome he was dissatisfied with, and his claims did not relate to procedural shortcomings, the provisions of section 166 DPA 2018 did not apply.

UT Judge Wikeley added that if Mr Lawton’s claims were indeed correct that section 166 DPA 2018 could be exercised by complainants who were dissatisfied with the outcome of their complaints then this would allow complainants to challenge the outcome itself with the purpose of seeking a new decision with a different outcome. This interpretation is plainly wrong and would be contrary to section 166 DPA 2018 itself as evident by its heading – “Orders to progress complaints”, as well as the Killock and Veale, and Delo decisions. It would also create jurisdictional ambiguity between section 166 DPA 2018 and the application for a judicial review to the High Court because in essence, if Mr Lawton’s view was correct then complainants could pursue a complaint about the outcome of an ICO decision via section 166 DPA 2018 and via a judicial review, with the potential for inconsistent results. This possibility is clearly not reflected in the wording nor is the intention of section 166 DPA 2018.

For these reasons, UT Judge Wikeley denied Mr Lawton’s permission to appeal the decision of the FTT to strike out his claim.

Comment

The Lawton decision provides further confirmation that section 166 DPA 2018 cannot be used as an avenue to challenge the outcome of ICO decisions, it can only be used to force the ICO to deal with complaints themselves and generally if it is tardy in doing so.

This outcome should provide additional comfort for data controllers that are subjected to spurious or minor complaints that a decision of the ICO not to investigate should stand and can only be challenged by the data subject on the usual grounds required for a judicial review – being irrationality, procedural impropriety and illegality, a far more complex and expensive process.