One of the conspicuous failures of the DPA 2018 has been the right to apply to the Tribunal under s166 for an order that the ICO progress a complaint made to it. Data subjects assume that this allows them to ask the Tribunal to overturn how the ICO has resolved their complaint. They perhaps not unreasonably assume the process would be of limited value if it were limited to the sort of procedural steps set out in s166(1), and they are instead left having to sue the controller under ss167-169. Some very well-regarded commentators have expressed the view that s166 ought to be interpreted more generously. They may think all of those things. But they would think wrong.
We have had cause to blog here before about the Upper Tribunal’s emphasis in Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC) (see here) and Scranage v Information Commissioner [2020] UKUT 196 (AAC) (here) that s166 only concerns procedural rights in connection with the complaint made under s165 or Article 77 UK GDPR. Now the Upper Tribunal has addressed the issue head-on in a series of three joined cases, two of which had been transferred from the FTT: Killock & Veale & others v Information Commissioner (GI/113/2021 & others) (Killock v ICO UT). The panel included the Chamber President, Farbey J.
The judgment is a relatively long one, and there is a good deal of factual context to wade through for each of the three cases, none of which need be the focus of the discussion here. For present purposes, the Upper Tribunal has authoritatively reconsidered the s166 issue and approved the long-standing analysis of the FTT and that of Judge Wikeley in Leighton and in Scranage.
The core of the judgment is at [74]: the Upper Tribunal reiterated that the failings which set the jurisdiction of the Tribunal in s166(1) are all procedural, and that there is no power to deal with the merits or outcome of the complaint. That, it said, followed from the plain statutory language and was further supported by the Explanatory Notes. “Any attempt by a party to divert a Tribunal from the procedural failings listed in s.166 towards a decision on the merits of the complaint must be firmly resisted by Tribunals.” A data subject who wants a decision on the merits will have to bring a claim before the ordinary courts.
So far, so straightforward. Some of the subsequent commentary might be thought more surprising. At [76] the Upper Tribunal emphasised the expertise of the ICO and relative lack of it in the Tribunal to express the view that the ICO was best placed to consider the merits and outcome. It accepted that the Tribunal must determine the appropriateness of any relevant step within the meaning of s166(2)(a) itself, but was also bound to give weight to the views of the regulator, because of the “institutional competence” and “special position” of the ICO: at [85]. There will need to be a good reason to interfere with an exercise of regulatory judgement and the Tribunal “cannot simply substitute its own view”: at [86]. This is a decidedly hands-off approach, although the Upper Tribunal endorsed some sample FTT decisions where procedural failings of the ICO were identified and made the subject of suitable orders and it insisted that s166 was not to be left as “formalistic” (at [83]).
The Upper Tribunal had, rightly, little truck with the suggestion there was any contravention of the principles of equivalence or effectiveness by comparing s166 with the FOIA appeal regime; that simply does not fit with what those principles apply to: at [78]-[81]. Reliance on the right to an effective remedy did not assist; data subject complainants can judicially review the outcome if the Commissioner has gone wrong in law: at [82].
There followed longer sections dealing with the application of these principles to the individual cases before it. The appeal of Mr Killock and Dr Veale (leading lights of the Open Rights Group – unsuccessful here but generally a “Good Thing” in 1066 and All That terms) ran into limitation problems. The Upper Tribunal confirmed that rule 22(6)(f) of the GRC Rules “means what it says: time starts to run from the date on which the Commissioner received the complaint and ends six months and 28 days thereafter”, and no moving target is allowed: at [95]. It was assumed without deciding that an extension of time was to be granted, no doubt because the Upper Tribunal found there had been no failure of the ICO within the terms of s166. In contrast, EW’s appeal succeeded because the ICO had refused to investigate the complaint at all applying a strict three month limit from the decision of the controller complained of, which was inconsistent with its policies having framed such a time limit in less absolute terms. The ICO was ordered to conduct an investigation. The appeal in Coghlan failed because it was not brought within time (and following the ICO’s internal review process was not a sufficient basis to extend time), and there was no failure to comply with any of the matters addressed by s166.
Subject to any further appeal, one suspects that Killock has brought clarity and finality to the grumbling about the judicial interpretation of s166. As in Scranage, the Upper Tribunal thought s166 was not serving the purpose intended, and was clogging up the Tribunals with misconceived appeals. Whether this is picked up on the data protection reform agenda of the Government we wait to see. In the meantime, s166 has a very narrow purchase indeed.
Julian Milford QC and Harini Iyengar acted for the ICO.
Christopher Knight