Gramam Nightingale v The Information Commissioner
[2024] UKFTT 93 (GRC)
Tianli Cui v Information Commissioner
26 November 2024
[2024] UKFTT 1047 (GRC)
First-tier Tribunal
Someone complained to the Information Commissioner about a data breach. The Commissioner investigated and decided it was unlikely a breach occurred. The person sued, trying to get the Commissioner to change their mind. The court said it couldn't force the Commissioner to change their decision because the law only lets them fix procedural problems, not the actual outcome of the investigation.
Key Facts
- •Tianli Cui applied to the Tribunal under section 166(2) of the Data Protection Act 2018 (DPA) concerning a complaint to the Information Commissioner (ICO).
- •The ICO argued the Tribunal lacked jurisdiction and the application had no reasonable prospect of success.
- •The Applicant challenged the ICO's substantive finding that an infringement of data protection legislation was unlikely.
- •The Applicant sought an apology, refund, and compensation.
- •The ICO completed its investigation and provided an outcome to the Applicant.
Legal Principles
The Tribunal's powers under section 166 DPA are limited to procedural issues, not the merits of a complaint.
Data Protection Act 2018, section 166
Section 166(2) allows orders requiring the Commissioner to take appropriate steps to respond to a complaint or inform the complainant of progress/outcome within a specified period, only if conditions in section 166(1) are met.
Data Protection Act 2018, section 166
Case law establishes that section 166 remedies are procedural, not substantive. Tribunals should resist attempts to use section 166 to challenge the merits of a complaint.
Killock v Information Commissioner [2022] 1 WLR 2241; R (Delo) v Information Commissioner [2023] 1 WLR 1327; [2023] EWCA Civ 1141; Cortes v Information Commissioner (UA-2023-001298-GDPA)
Outcomes
The proceedings were struck out under Rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.
There was no reasonable prospect of the Applicant's case succeeding because the Tribunal lacks jurisdiction to consider the merits of the ICO's decision. The Applicant's challenge was to the substantive outcome, not a procedural failing.