Patrick Wainwright v The Information Commissioner
[2024] UKFTT 262 (GRC)
Lee Cruickshank v The Information Commissioner
15 August 2024
[2024] UKFTT 730 (GRC)
First-tier Tribunal
Someone complained to the Information Commissioner about how their data was handled. The Commissioner decided against the complainant. The complainant then tried to challenge that decision in court. The judge said that court wasn't the right place to do it and dismissed the case. The judge said the correct way to challenge how the data was handled was to sue the company directly.
Key Facts
- •Mr. Lee Cruickshank (Applicant) applied to the First-tier Tribunal (General Regulatory Chamber) under section 166 of the Data Protection Act 2018 (DPA 2018) against the Information Commissioner (Respondent).
- •The application challenged the Information Commissioner's handling of Mr. Cruickshank's data protection complaint.
- •The Information Commissioner applied to strike out the application under rule 8(3)(c) of the Tribunal Procedure Rules.
- •The Information Commissioner's decision on Mr. Cruickshank's complaint was communicated on 5 December 2023.
- •The Tribunal decided the case without a hearing.
Legal Principles
The Tribunal has no power to review the merits of a complaint to the Information Commissioner or its outcome under section 166 DPA 2018.
Killock & Veale & ors v Information Commissioner [2021]UKUT 299 (AAC)
The Tribunal cannot retrospectively order the Commissioner to take steps leading to a different outcome after a complaint decision.
Killock & Veale and R (on the application of Delo) v Information Commissioner and Wise Payments Limited [2022] EWHC 3046 (Admin) (upheld by Court of Appeal [2023] EWCA Civ 1141)
Challenges to the lawfulness or rationality of the Information Commissioner's decision are matters for judicial review, not the Tribunal.
Killock & Veale and R (on the application of Delo) v Information Commissioner and Wise Payments Limited [2022] EWHC 3046 (Admin) (upheld by Court of Appeal [2023] EWCA Civ 1141)
Section 166 DPA 2018 does not provide a mechanism to challenge the substantive outcome of a complaint.
Case at hand
Outcomes
The application under section 166 DPA 2018 was struck out.
The Tribunal found no reasonable prospects of success. The Tribunal lacks the jurisdiction to review the merits of the Information Commissioner's decision on the underlying complaint. The appropriate route for challenging the data controller's actions is through separate civil proceedings.