Tribunal Limits Scope in Orford v The Information Commissioner under Data Protection Act 2018

Citation: [2023] UKFTT 1024 (GRC)
Judgment on

Introduction

In the recent case of Colin Orford v The Information Commissioner ([2023] UKFTT 1024 (GRC)), the First-tier Tribunal (General Regulatory Chamber) [Information Rights] has provided an important decision on the application of section 166 of the Data Protection Act 2018 (DPA 2018). The case discusses the limited scope of the Tribunal in compelling the Information Commissioner’s Office (ICO) to take certain actions in response to a complaint. This article analyses the judgment and the legal principles invoked, with a focus on their application in this particular case.

Key Facts

The Applicant, Colin Orford, appealed to the First-tier Tribunal, seeking an order under s. 166 DPA 2018 after making a complaint to the ICO. The Information Commissioner responded to this appeal by proposing a strike out due to no prospects of success, asserting that an outcome letter had been issued, and argued that s. 166 could not be used to alter the substantive outcome or to compel a ‘proper investigation’.

Judge Alison McKenna considered the appeal on 8 December 2023 and issued her decision to strike out the appeal on 11 December 2023, following the provision of an outcome letter by the ICO on the Applicant’s complaint.

The main legal issue in this case revolves around the scope and applicability of s. 166 of the DPA 2018. The judgment reiterates that this section provides only procedural remedies and does not allow the Tribunal to review the merits or make substantive changes to a decision by the ICO.

The Tribunal adhered to the principles laid down in R (Delo) v ICO [2022] EWHC 3046 (Admin), as referenced by Mostyn J., This principle is critically expressed in the passage cited from that judgment which clarifies the limitations of the Tribunal’s powers, highlighting that s. 166 pertains to instances where a complaint remains ‘pending’ and has not reached an ‘outcome stage’.

Judge McKenna also referenced rule 8 (2) (a) and rule 8 (3) (c) of the Tribunal’s rules. The former would require a mandatory strike out if the complaint was not pending, while the latter allows for a strike out on the basis that there are no reasonable prospects of success for the Notice of Appeal.

Outcomes

Concluding that the ICO had indeed progressed the complaint and informed the Applicant of its decision, and being bound by Mostyn J.’s interpretation, Judge McKenna determined that there was a lack of jurisdiction under s. 166 DPA as the complaint was no longer ‘pending.’ Consequently, there were no prospects of success for the appeal, thus warranting a strike out under rule 8 (3) (c).

The judge acknowledged the Applicant’s concerns but emphasized that the ICO’s outcome letter essentially removed any potential remedy under s. 166 DPA 2018 that the Tribunal could offer. However, she noted that the sought order might be obtained through the courts, indicating that the court’s jurisdiction differs from that of the Tribunal in this context.

Conclusion

In Orford v The Information Commissioner, the Tribunal’s decision reinforces the view that its powers are limited to procedural enforcement under s. 166 DPA 2018 and cannot be utilized to influence the substantive outcome of an ICO decision. This case reiterates the Tribunal’s lack of supervisory jurisdiction over ICO complaint outcomes and the importance of recognizing the finality of an ‘outcome letter’ in determining the Tribunal’s ability to act. Legal practitioners should be mindful of these limitations when advising clients on the potential courses of action following an ICO decision.