Ashu Mathia Ashu v The Information Commissioner
[2023] UKFTT 383 (GRC)
Jefferson Moutinho Arnauth v The Information Commissioner
28 February 2023
[2023] UKFTT 217 (GRC)
First-tier Tribunal
Someone complained to the Information Commissioner about a data protection issue. The Commissioner investigated and gave their decision. The person then tried to appeal to a Tribunal, but the Tribunal said it couldn't change the Commissioner's decision because the investigation was already finished. The appeal was dismissed.
Key Facts
- •Applicant appealed under s. 166 of the Data Protection Act 2018 (DPA 2018) against the Information Commissioner's (ICO) handling of a complaint.
- •The ICO issued an outcome letter and a case review letter to the Applicant.
- •The ICO proposed striking out the appeal for lack of prospects of success.
- •The Applicant argued that his GDPR rights had been infringed.
Legal Principles
The Tribunal's powers under s. 166 DPA 2018 are limited to ordering the ICO to take specified steps to respond to a pending complaint; it cannot review the merits of the ICO's decision or change the substantive outcome.
s. 166(2) DPA 2018, R (Delo) v ICO [2022] EWHC 3046 (Admin)
Section 166 DPA 2018 only applies to procedural deficiencies in handling a complaint and not to merits-based outcome decisions. Once the ICO has issued an outcome decision, the complaint is no longer 'pending'.
R (Delo) v ICO [2022] EWHC 3046 (Admin) at [128]
Outcomes
The appeal was struck out.
The ICO progressed the complaint and issued outcome and review letters. The Tribunal lacked jurisdiction under s. 166 DPA 2018 as the complaint was no longer pending. The appeal had no reasonable prospects of success.