Key Facts
- •Eduardo Cortes (Applicant) appealed to the First-tier Tribunal (Information Rights) under section 166 of the Data Protection Act 2018 (DPA18) against the Information Commissioner's (Respondent) handling of his complaint.
- •The complaint concerned Kingston Hospital Foundation Trust's handling of personal information; the ICO found the complaint related to third-party data, not the Applicant's.
- •The Applicant argued the ICO failed to inform him of his rights under section 166 DPA18 and that his data rights were infringed.
- •The Respondent argued the appropriate recourse for data rights infringement is via civil proceedings under section 167 DPA18, not a Tribunal appeal.
Legal Principles
Article 77(1) GDPR grants data subjects the right to complain to a supervisory authority about GDPR infringements.
GDPR
Section 165 DPA18 outlines the Commissioner's duties regarding data subject complaints, including informing complainants of their rights under section 166.
DPA18
Section 166 DPA18 provides a procedural, not substantive, right of appeal against the Information Commissioner; it doesn't allow appeals on the merits of the substantive outcome.
DPA18, Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC), Scranage v Information Commissioner [2020] UKUT 196 (AAC)
Section 167 DPA18 allows data subjects to pursue civil proceedings against data controllers for breaches of data rights.
DPA18
Outcomes
The Tribunal struck out the application.
The Tribunal lacks the power to review the merits of the Information Commissioner's decision. The Applicant's recourse is through civil courts under section 167 DPA18, not this Tribunal. The application has no reasonable prospect of success.