Section 166 DPA 2018: Leighton off the ICO?

Relatively unnoticed in the morass of GDPR and Data Protection Act 2018 provisions is the right under section 166 DPA 2018 to apply to the First-tier Tribunal for an order that the ICO progress a complaint which has been made to it under section 165 or Article 77 GDPR. In other words, the core aim of the provision is to deal with situations in which the ICO has taken too long to address a complaint made about, for example, compliance with a subject access request. But what is the nature of the FTT’s role?The right of application under s166 is distinct from the right to seek enforcement of data protection rights in the ordinary courts (s167) or to seek compensation for breach of those rights (s168). Under s166(2), the FTT is given power to order the ICO to “take appropriate steps to respond to the complaint”, or to inform the complainant of the progress, or outcome, of the complaint within a specified time period.

A series of FTT decisions have interpreted the scope of the s166 jurisdiction relatively narrowly, and in particular, construed it as not affording to the FTT a jurisdiction over the substance of the complaint or the ICO’s view as to the substance of the complaint: see, e.g., Platts v Information Commissioner (EA/2018/0211/GDPR). Now the Upper Tribunal, in the form of Judge Wikeley, has reviewed the position (albeit in a detailed permission to appeal decision) in Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC).

Mr Leighton had made a subject access request to the police under s45 DPA 2018 (i.e. governed by Part 3 and not the GDPR).  He did not consider that the police had dealt with it properly, and complained to the ICO. The ICO concluded that the police had complied with their obligations. Mr Leighton appealed that conclusion to the FTT.

The Upper Tribunal dismissed Mr Leighton’s reliance on s45 DPA directly: that is not a matter within the jurisdiction of the FTT. If a data subject wishes to bring a claim about non-compliance with a subject access request jurisdiction is allocated to the County Court and the High Court: ss 167 and 180 DPA. It held that Mr Leighton’s Article 78 GDPR right to an effective judicial remedy did not mean that he could bring any appeal before the FTT. (The Upper Tribunal did not say, as it could have done, that a request under Part 3 is not subject to the GDPR anyway.)

Judge Wikeley went on to consider the scope of jurisdiction the FTT did have under s166. The ICO had plainly purported to resolve a complaint he had made to it under s165, and a challenge to that resolution brought in the FTT could only be made under s166. It is [31] which of greatest importance to those working in this field. There, the Upper Tribunal cited Platts and its acceptance of the ICO’s submission in that case that “s166 DPA 2018 does not provide a right of appeal against the substantive outcome of an investigation into a complaint under s165 DPA 2018”. Judge Wikeley held that “I consider that it is right as a matter of legal analysis. Section 166 is directed towards providing a tribunal-based remedy where the Commissioner fails to address a section 165 complaint in a procedurally proper fashion. Thus, the mischiefs identified by section 166(1) are all procedural failings”. If that were not right, it would confuse the jurisdictional divide created by ss166 and 167 respectively between the FTT and the civil courts. The FTT had been right to strike out Mr Leighton’s ‘appeal’ because he was seeking remedies the FTT could not grant.

I acted for the Information Commissioner in Platts, so I will confine my comments in this post to drawing attention to the appellate approval of the limited procedural scope of the s166 application jurisdiction. Concerns about substantive compliance with the DPA/GDPR remain matters for a civil claim before the civil courts, just as under the DPA 1998.

Christopher Knight