Tianli Cui v Information Commissioner
[2024] UKFTT 1047 (GRC)
Gramam Nightingale v The Information Commissioner
30 January 2024
[2024] UKFTT 93 (GRC)
First-tier Tribunal
Someone complained to the Information Commissioner about a company. The Commissioner investigated and decided the company hadn't followed data protection rules. The complainant was unhappy with the outcome and went to court. The court said it couldn't change the Commissioner's decision because its job is only to deal with problems in how the Commissioner handled the complaint, not the decision itself. The complaint was dismissed.
Key Facts
- •Gramam Nightingale applied to the Tribunal under section 166(2) of the Data Protection Act 2018 (DPA) concerning a complaint to the Information Commissioner.
- •The complaint related to the Football Pools' failure to respond to a request for information after a fraudulent application was made in Nightingale's name.
- •The Information Commissioner responded, stating the Football Pools hadn't complied with data protection obligations and had been contacted to rectify the situation.
- •Nightingale challenged the Commissioner's response, leading to a review which upheld the original decision.
- •Nightingale's application to the Tribunal challenged the substantive outcome of the complaint, not procedural failings.
Legal Principles
The Tribunal's powers under section 166 DPA are limited to procedural issues, not the merits of a complaint.
Data Protection Act 2018, section 166
Section 166 only allows orders regarding procedural failings in the Commissioner's handling of complaints, not the substantive outcome.
Killock v Information Commissioner [2022] 1 WLR 2241, Upper Tribunal (paragraph 74)
The Commissioner has broad discretion in investigating complaints, including deciding the scope and depth of investigation and whether to reach a conclusive determination on infringement.
R (Delo) v Information Commissioner [2023] 1 WLR 1327, High Court (paragraph 57) & [2023] EWCA Civ 1141, Court of Appeal (paragraph 80)
A section 166 application cannot be used for a collateral attack on the Commissioner's decision, aiming to have the outcome remade.
Cortes v Information Commissioner (UA-2023-001298-GDPA), Upper Tribunal (paragraph 33)
Outcomes
The proceedings were struck out.
The Tribunal found no reasonable prospect of the Applicant's case succeeding because it challenged the substantive outcome of the complaint, which is beyond the Tribunal's powers under section 166 DPA. The Commissioner had taken steps to investigate and respond to the complaint.