Key Facts
- •Mr. Gordon Murray applied to the tribunal under section 166 of the Data Protection Act 1998 (DPA) after disagreeing with the Information Commissioner's decision on his complaint.
- •The complaint related to Comhairle nan Eilean Siar's (CnES) response to Mr. Murray's Subject Access Request (SAR).
- •The Information Commissioner applied to strike out the application under rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.
- •Mr. Murray's application focused on whether CnES should have released the requested information.
Legal Principles
The tribunal has no power to deal with the merits of a complaint to the Commissioner or its outcome under section 166 DPA 1998.
Killock & Veale & ors v Information Commissioner [2021]UKUT 299 (AAC) and Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC)
An application under section 166 is not a means to challenge the substantive outcome of the Commissioner’s investigation.
Tribunal's own reasoning
To seek an order of compliance against a data controller for breach of data rights, separate civil proceedings in the County Court or High Court under section 167 of the DPA 1998 are necessary.
Tribunal's own reasoning
Outcomes
The application under section 166 of the Data Protection Act 1998 was struck out.
The application lacked reasonable prospects of success as it challenged the merits of the Commissioner's decision, which is beyond the tribunal's power under section 166. The tribunal lacks the jurisdiction to assess whether the information should have been released by CnES.