Lee Cruickshank v The Information Commissioner
[2024] UKFTT 730 (GRC)
Gordon Murray v The Information Commissioner
28 July 2023
[2023] UKFTT 633 (GRC)
First-tier Tribunal
Mr. Murray disagreed with the government's decision about his data request. The court said they couldn't change the government's mind about that specific decision, but Mr. Murray can try a different court if he wants to challenge how the data was handled.
Key Facts
- •Mr. Gordon Murray applied to the tribunal under section 166 of the Data Protection Act 1998 (DPA) after disagreeing with the Information Commissioner's decision on his complaint.
- •The complaint related to Comhairle nan Eilean Siar's (CnES) response to Mr. Murray's Subject Access Request (SAR).
- •The Information Commissioner applied to strike out the application under rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.
- •Mr. Murray's application focused on whether CnES should have released the requested information.
Legal Principles
The tribunal has no power to deal with the merits of a complaint to the Commissioner or its outcome under section 166 DPA 1998.
Killock & Veale & ors v Information Commissioner [2021]UKUT 299 (AAC) and Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC)
An application under section 166 is not a means to challenge the substantive outcome of the Commissioner’s investigation.
Tribunal's own reasoning
To seek an order of compliance against a data controller for breach of data rights, separate civil proceedings in the County Court or High Court under section 167 of the DPA 1998 are necessary.
Tribunal's own reasoning
Outcomes
The application under section 166 of the Data Protection Act 1998 was struck out.
The application lacked reasonable prospects of success as it challenged the merits of the Commissioner's decision, which is beyond the tribunal's power under section 166. The tribunal lacks the jurisdiction to assess whether the information should have been released by CnES.