Tianli Cui v Information Commissioner
[2024] UKFTT 1047 (GRC)
Robin Levi v The Information Commissioner
18 December 2023
[2023] UKFTT 1033 (GRC)
First-tier Tribunal
Someone complained to the ICO about a company's data breach. The ICO decided not to punish the company. The complainant appealed. The judge said the appeal was pointless because the ICO's decision was final; the judge could only review how the ICO handled the complaint, not the decision itself.
Key Facts
- •Robin Levi (Applicant) complained to the Information Commissioner (ICO) about Group 1 Auto's (Group1) data breach.
- •Group1 incorrectly added Levi's house number to a DVLA registration document.
- •Group1 rectified the error and the ICO decided not to take regulatory action.
- •Levi appealed to the First-tier Tribunal (FTT) seeking a penalty against Group1 and an explanation from the ICO.
- •The ICO argued the application should be struck out for having no prospect of success.
Legal Principles
The Tribunal may strike out proceedings if there is no reasonable prospect of success.
Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009, Rule 8(3)(c)
A 'realistic' prospect of success is one that carries some degree of conviction, not merely arguable.
HMRC v Fairford Group [2014] UKUT 0329
Striking out should only be exercised in plain and obvious cases, considering interests of justice.
AW v Information Commissioner [2013] 30 ACC
Section 166 DPA allows the Tribunal to order the Commissioner to take appropriate steps, but not to challenge the merits of the Commissioner's outcome decision.
Killock & Veale v Information Commissioner [2021] UKUT 299 ACC, R (Delo) v Information Commissioner [2022] EWHC 3046 (Admin)
The Commissioner has a wide discretion in deciding whether to take further action on a complaint.
R (Delo) v Information Commissioner [2022] EWHC 3046 (Admin)
Outcomes
The Application was struck out.
The Tribunal found Levi had no reasonable prospect of succeeding, as his challenge concerned the merits of the ICO's decision, not procedural deficiencies under section 166 DPA. The ICO's decision not to take further action was within their discretion and not subject to Tribunal review under Section 166.