Tianli Cui v Information Commissioner
[2024] UKFTT 1047 (GRC)
Rashid Mahmood v The Information Commissioner
2 January 2024
[2023] UKFTT 1068 (GRC)
First-tier Tribunal
Someone complained to the Information Commissioner about a company not giving them all their data. The Commissioner decided not to take further action. The person appealed, but the judge said the Commissioner did enough, and the appeal was only about *how* the Commissioner decided, not *what* they decided. If the person thinks the Commissioner's decision was wrong, they need to go to a higher court.
Key Facts
- •Mr. Mahmood complained to the Information Commissioner (ICO) about Genting Casinos' handling of his subject access requests (SARs).
- •The ICO issued decisions on Mr. Mahmood's complaints (IC-84886-T4Z0 and IC-206527-B3Q7), ultimately closing both cases.
- •Mr. Mahmood appealed the ICO's handling of complaint IC-206527-B3Q7 to the First-tier Tribunal (FTT).
- •The FTT considered whether the ICO had failed to take appropriate steps to respond to the complaint under section 166 of the Data Protection Act 2018.
Legal Principles
Section 166 of the Data Protection Act 2018 provides a remedy for procedural failings in the ICO's handling of complaints, not for substantive merits.
Killock and Veale v Information Commissioner [2021] UKUT 299
The ICO's obligation is to provide an 'outcome' to a complaint, not necessarily a decision on the merits. The 'outcome' can encompass various forms of communication, including a decision to cease handling the complaint.
R (on the application of Delo) v Information Commissioner and Wise Payments Limited [2022] EWHC 3046 (Admin), [2023] EWCA Civ 1141
Challenges to the substantive merits of an ICO decision are matters for judicial review, not section 166 applications.
Killock and Veale v Information Commissioner [2021] UKUT 299; R (on the application of Delo) v Information Commissioner and Wise Payments Limited
Section 166 does not allow the Tribunal to 'wind back the clock' and reassess the substantive merits of a complaint after an outcome has been issued; the Tribunal's role is limited to procedural issues.
Killock and Veale v Information Commissioner [2021] UKUT 299
Outcomes
The application is dismissed.
The ICO provided an outcome to Mr. Mahmood's complaint (IC-206527-B3Q7) by stating that it would take no further action, and this action constitutes an outcome under the GDPR. The FTT's jurisdiction is limited to procedural issues under section 166, not the substantive merits of the ICO's decision. Mr. Mahmood's arguments regarding the ICO's investigation and the merits of his complaint against Genting are matters for judicial review.