Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
In Cox v Information Commissioner [2022] UKFTT 00297 the Tribunal dealt with an application by the Commissioner to strike out Mr Cox’s application inviting the Tribunal to make an order under s.166 of the DPA 2018 requiring the Commissioner to take additional steps so as to reopen its investigation into Mr Cox’s complaint concerning the handling of his data by Bangor University.
The crux of Mr Cox’s complaint was his belief that, in the course of investigating his complaint into the handling of his data, Bangor University had provided the Commissioner with incomplete and misleading information. The Commissioner, however, submitted that: – (i) Mr Cox had received an outcome on his complaint, (ii) s.166 DPA 2018 did not provide for a right of appeal against a decision on outcome, and (iii) as such, there was no scope for the Tribunal to make any order under s.166 DPA 2018. In support of this position the Commissioner relied on Leighton v The Information Commissioner (No.2) (Information rights – Data protection) [2020] UKUT 23 in which the Upper Tribunal confirmed that “s.166 DPA 2018 does not provide a right of appeal against the substantive outcome of an investigation into a complaint under s.165DPA 2018”.
In its decision the Tribunal emphasised that the remedy under s.166 was concerned with enabling steps to be taken to remedy ongoing procedural defects which stand in the way of the timely resolution of a complaint, by specifying appropriate “steps to respond”, rather than assessing the appropriateness of a response that has already been given. The Tribunal emphasised that s.166 should not be used by dissatisfied complainants as a device to challenge outcome decisions, who should instead have recourse to the legal remedies at ss.167-169, or bring judicial review proceedings against the Commissioner in the Administrative Court.
With these considerations in mind the Tribunal held that, applying the approach in HMRC v Fairford Group (in liquidation) and Fairford Partnership Limited (in liquidation) [2014] UKUT 329m Mr Cox had no realistic prospect of establishing that there had been a flaw in the approach taken by the Commissioner. The Tribunal refused to revisit the substance of the complaint, and held that it was impermissible for Mr Cox to seek to criticise the Commissioner for not looking into matters which had not been directly raised in his complaint, nor to seek to rely on matters arising in to other complaints concerning the University he was pursuing.
This case illustrates the very real limits on the remedy available to complainants under s.166 DPA 2018 and the judicial willingness to strike out applications under s.166 which are, in reality, a challenge to Commissioner’s decision on a complaint. Moreover, since appeals by data controllers against a Notice issued by the Commissioner on a complaint will be to the FTT, this approach, though required by the legislation, remains all too ripe for procedural confusion and jurisdictional conflict.
Cox v Information Commssioner [2022] UKFTT 00297
A monthly data protection bulletin from the barristers at 5 Essex Chambers
The Data Brief is edited by Francesca Whitelaw KC, Aaron Moss and John Goss, barristers at 5 Essex Chambers, with contributions from the whole information law, data protection and AI Team.
