The Data Protection Act 2018 (DPA) introduced a new right of appeal, in certain circumstances, to the First-tier Tribunal (FTT), in relation to how the Information Commissioner's Office (ICO) handles data subject complaints. Such complaints to the ICO might, for example, cover failures by organisations to respond to subject access requests. Previously, complainants to the ICO had no right to challenge its handling of their complaint, other than by way of an application for judicial review.
Now, under section 166 of the DPA, a complainant can make an application to the FTT if:
1. the ICO fails to take appropriate steps to respond to her complaint;
2. the ICO fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the ICO received the complaint, or;
3. the ICO's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
Complaints under this provision are therefore restricted to procedural arguments regarding the sufficiency of, or timeliness of, the response to a complaint. There remains no general right of appeal against ICO data protection decisions, as confirmed by three recent FTT decisions: in each of these decisions (Quigley v IC, Platts v IC and Nguyen v IC) the FTT found, in effect, that the application was an attempt to appeal against the substantive outcome of an investigation which had otherwise been properly handled by the ICO.
It is not clear how many such cases have been lodged with the FTT - the latest listings indicate that there may be as many as sixteen pending. However, it seems likely that the FTT will begin to use its case management powers under the relevant rules, and strike such cases out either for want of jurisdiction, or if it considers that there is no reasonable prospect of the case succeeding. Those attempting to bring appeals in relation to the handling of their complaints before the ICO should, therefore, ensure that they rely on appropriate grounds to avoid this eventuality.