Olufunke Osifeso v The Information Commissioner

An application under section 166 of the Data Protection Act 2018 provides a procedural remedy concerning the handling and progress of a complaint to the Information Commissioner. It does not confer jurisdiction on the First-tier Tribunal to determine the merits or outcome of the complaint. The Tribunal decides objectively whether investigative or other procedural steps are appropriate, but must give substantial weight to the Commissioner’s regulatory expertise and interfere with an established regulatory judgment only for good reason. The remedy is principally forward-looking, although the Tribunal may exceptionally require further steps after an outcome has been given if this is not being used to obtain a different substantive result. Appellate review of tribunal reasons must be contextual and restrained.

The appellant complained to the Information Commissioner about the Royal Bank of Scotland’s handling of her personal data. After receiving responses, she applied to the General Regulatory Chamber of the First-tier Tribunal under section 166 of the Data Protection Act 2018. The application was struck out as having no reasonable prospect of success, and that decision was reaffirmed on reconsideration. Permission to appeal to the Upper Tribunal was granted.

The appeal concerned whether section 166 permitted the First-tier Tribunal to examine the appropriateness of the investigative steps leading to the Commissioner’s outcome, rather than merely requiring a response or update.

1. Appeal dismissed. The First-tier Tribunal’s decision involved no material error of law. The strike-out decision was therefore upheld.

2. Section 166 is concerned with procedural failings. The First-tier Tribunal has no power under that provision to determine the merits of a data-protection complaint or to alter the Commissioner’s substantive outcome. Its jurisdiction includes objectively deciding whether appropriate steps were taken, including whether the subject matter was investigated to the extent appropriate.

3. The Tribunal must take account of the Commissioner’s position as expert regulator. Her view is not decisive, and the Tribunal retains its judicial function, but where a regulatory judgment has been exercised the Tribunal requires good reason to interfere and cannot simply substitute its own view. The appropriate oversight is relatively light touch but not hands-off.

4. Section 166 is forward-looking and is directed to ongoing procedural defects. It is not ordinarily a means of assessing whether a response already given was substantively appropriate. The possibility of requiring a further step after an outcome has been provided is not excluded, but the Tribunal must ensure that the procedure is not being used to obtain a different complaint outcome.

5. The First-tier Tribunal’s statement that it was for the Commissioner to determine the appropriate extent of investigation was read in context as referring to institutional competence, rather than exclusive legal power. The omission of words such as “in the first instance” did not create a material error of law. Appellate courts should not isolate an imperfect phrase or infer misdirection merely because every step in the reasoning is not expressed.

6. In any event, even if the First-tier Tribunal had erred, setting aside the decision would have been refused because, on the facts, the Tribunal had reached the only realistically available decision. The Commissioner had handled the complaints promptly, taken appropriate investigative steps and informed the appellant of their outcome. Any challenge to the substantive outcome required a different remedy, including judicial review or proceedings under section 167 of the Data Protection Act 2018.

• Upper Tribunal (Administrative Appeals Chamber): appeal dismissed; the First-tier Tribunal’s decision of 31 January 2020 was held not to involve an error of law.
• First-tier Tribunal (General Regulatory Chamber): the appellant’s section 166 application was struck out as having no reasonable prospect of success. The decision was reaffirmed by Judge Macmillan on 20 February 2020, and permission to appeal was refused on 30 March 2020.