Lee Cruickshank v The Information Commissioner
[2024] UKFTT 730 (GRC)
Olubukunola Mabadeje v The Information Commissioner
28 July 2023
[2023] UKFTT 632 (GRC)
First-tier Tribunal
Someone complained to the Information Commissioner about a company mishandling their data. The Commissioner investigated, and the person didn't like the result, so they went to court. The court said the person didn't use the right process to complain, and the original complaint was dismissed. They'd have to start a new case to challenge the company directly.
Key Facts
- •Olubukunola Mabadeje (Applicant) applied to the First-tier Tribunal (General Regulatory Chamber) against the Information Commissioner (Respondent).
- •The application challenged the Commissioner's handling of a data protection complaint, alleging the Commissioner did not follow GDPR/DPA rules and instead relied on Civil Procedure Rules.
- •The Commissioner applied to strike out the application under rule 8(3)(c) of the Tribunal Procedure Rules 2009 (no reasonable prospects of success).
Legal Principles
The First-tier Tribunal's jurisdiction is defined by statute and limited in relation to challenges against the Information Commissioner's actions.
Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009
Under the DPA 1998 and GDPR, the only applicable challenge to the Commissioner's actions is an application under section 166.
Data Protection Act 1998
Section 166 provides a procedural, not substantive, remedy. The Tribunal can consider the appropriateness of investigative steps, but not substitute its judgment for the Commissioner's regulatory judgment.
Killock & Veale & ors v Information Commissioner [2021]UKUT 299 (AAC)
Outcomes
The application was struck out.
The application lacked reasonable prospects of success as it was not a valid section 166 application and challenged the Commissioner's outcome rather than the process. The Tribunal lacks jurisdiction to review the Commissioner's reliance on CPR in their decision.