Upper Tribunal Upholds Decision on Late Data Protection Complaint

[NAME] v [NAME] [2020] UKUT 196 ([NAME])

DECISION OF THE UPPER TRIBUNAL (ADMINISTRATIVE APPEALS CHAMBER)

The DECISION of the Upper Tribunal is to dismiss the appeal by the Appellant.

The decision of the First-tier Tribunal (General Regulatory Chamber) ([NAME]) dated 10 October 2019 under file reference EA/2019/0145/GDPR does not involve any material error on a point of law. The First-tier Tribunal’s decision stands.

This decision is given under section 11 of the Tribunals, Courts and Enforcement Act 2007.

REASONS FOR DECISION

The outcome in a couple of sentences 1. The First-tier Tribunal made some mistakes in how it dealt with [NAME]’s case, but those errors did not materially affect the outcome. Ultimately the First-tier Tribunal (“the Tribunal”) was right to conclude that (i) [NAME]’s application to the Tribunal was late; and (ii) he should not be granted an extension of time.

The factual context to this appeal 2. [NAME] is a former employee of Rochdale Metropolitan Borough Council (“the Council”). Over the years, [NAME] has made a series of requests to the Council under both FOIA and the data protection legislation. Such requests typically concern information in the form of e-mails that [NAME] believes the Council holds in the work e-mail account he had whilst employed with the authority. The parting of the ways between [NAME] and the Council in 2009 was acrimonious and led to his unsuccessful claim for unfair dismissal and disability discrimination in the Employment Tribunal. [NAME]’s subsequent appeal was dismissed by the Employment Appeal Tribunal (see further [NAME] v Rochdale Metropolitan Borough Council (UKEAT/0032/17/DM)) and the Court of Appeal later refused him permission to appeal (A2/2018/1007). [NAME] has also brought separate proceedings under the Freedom of Information Act 2000 (FOIA) in the First-tier Tribunal (General Regulatory Chamber) – see [NAME] v [NAME] and [NAME] (EA/2011/0229) and [NAME] v [NAME] (EA/2017/0144) (which concerned a complaint against Oldham MBC, rather than Rochdale).

3. There have also been proceedings in the criminal courts. In December 2014 [NAME] was convicted on a charge of harassment contrary to section 2 of the Protection from Harassment Act 1997. The alleged harassment referred to a course of conduct in contacting two employees of the Council between 2011 and 2014 (for the purposes of this decision those employees, who were his managers, are referred to simply as [NAME] and [NAME]). However, the Appellant’s conviction was subsequently quashed on appeal by Manchester Crown Court (see what appears to be an unofficial transcript of the judgment at pp.19-23 of the file). However, as we shall see, that acquittal was accompanied by a restraining order made against [NAME], which is still in force.

The legislative context to this appeal 4. The Data Protection Act (DPA) 2018, which received Royal Assent on 23 May 2018, updated data protection legislation, especially in the light of the EU’s General Data Protection Regulation (GDPR). In particular, section 165 of the DPA 2018 sets out a data subject’s right to make a complaint to the [NAME] about

[NAME] v [NAME] [2020] UKUT 196 ([NAME])

an infringement of the data protection legislation in relation to his or her personal data (reflecting Articles 57 and 77 of the GDPR). Section 166 then enables a data subject to apply for an order from the Tribunal if the Commissioner does not take certain actions in relation to the data subject’s complaint. This provision, which had no equivalent in the DPA 1998, reflects the right set out in Article 78(2) of the GDPR:

“Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to an effective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77.”

5. The material parts of section 166 of the DPA 2018 provide as follows:

“Orders to progress complaints 166.―(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner— (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months. (2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner— (a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order. (3) An order under subsection (2)(a) may require the Commissioner— (a) to take steps specified in the order; (b) to conclude an investigation, or take a specified step, within a period specified in the order.”

6. In my experience – both in the present appeal and in many other cases – there is a widespread misunderstanding about the reach of section 166. Contrary to many data subjects’ expectations, it does not provide a right of appeal against the substantive outcome of the [NAME]’s investigation on its merits. Thus, section 166(1), which sets out the circumstances in which an application can be made to the Tribunal, is procedural rather than substantive in its focus. This is consistent with the terms of Article 78(2) of the GDPR (see above). The prescribed circumstances are where the Commissioner fails to take appropriate steps to respond to a complaint, or fails to update the data subject on progress with the complaint or the outcome of the complaint within three months after the submission of the complaint, or any subsequent three month period in which the Commissioner is still considering the complaint. As I observed in Leighton v Information Commissioner (No.2) [2020] UKUT 23 ([NAME]) (emphasis in the original):

“31. I note that in [NAME] v [NAME] (EA/2018/0211/GDPR) the FTT accepted a submission made on behalf of the Commissioner that ‘s.166 DPA 2018 does not provide a right of appeal against the substantive outcome of an investigation into a complaint under s.165 DPA 2018’ (at paragraph [13]). Whilst that is a not a precedent setting decision, I consider that it is right as a matter of legal analysis. Section 166 is directed towards providing a tribunal- based remedy where the Commissioner fails to address a section 165 complaint

[NAME] v [NAME] [2020] UKUT 196 ([NAME])

in a procedurally proper fashion. Thus, the mischiefs identified by section 166(1) are all procedural failings. ‘Appropriate steps’ mean just that, and not an ‘appropriate outcome’. Likewise, the FTT’s powers include making an order that the Commissioner ‘take appropriate steps to respond to the complaint’, and not to ‘take appropriate steps to resolve the complaint’, least of all to resolve the matter to the satisfaction of the complainant. Furthermore, if the FTT had the jurisdiction to determine the substantive merits of the outcome of the Commissioner’s investigation, the consequence would be jurisdictional confusion, given the data subject’s rights to bring a civil claim in the courts under sections 167-169 (see further DPA 2018 s.180).”

7. The data subject’s right to make an application to the Tribunal under section 166(2) is subject to a time limit. That time limit is not spelt out in DPA 2018 itself. Rather, the rule is to be found buried in the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (SI 2009/1976; “the 2009 Rules”). Rule 22 lays down the rules governing the time limits for starting proceedings in the Tribunal. The default position is that the standard time limit in the General Regulatory Chamber is “within 28 days of the date on which notice of the act or decision to which the proceedings relate was sent to the appellant” (rule 22(1)(b), which I call “the 28- day default time limit”). Section 166 came into effect (other than for regulation-making powers) on 25 May 2018, two days after Royal Assent (see the Data Protection Act 2018 (Commencement No. 1 and Transitional and Saving Provisions) Regulations 2018 (SI 2018/625, reg.2(1)(f)). At that time, section 166 was subject to the 28-day default time limit (in the same way, for example, as an ordinary FOIA case).

8. However, the position was changed with effect from 30 October 2018, when a new rule 22(6)(f) was inserted into the 2009 Rules by rule 4(3)(b)(v) of the Tribunal Procedure (Amendment No.

2) Rules 2018 (SI 2018/1053). This provides an exception to the 28-day default time limit. The specified exception is that the time limit “in the case of an application under section 166(2) of the Data Protection Act 2018 (orders to progress complaints)” is “within 28 days of the expiry of six months from the date on which the Commissioner received the complaint”. So, this more generous (and, it has to be said, arithmetically more complicated) time limit applied with effect from 30 October 2018.

The First-tier Tribunal proceedings in this case 9. When granting permission to appeal, I set out the chronology of the Tribunal proceedings. For convenience I repeat that here, subject only to one typographical correction relating to a date:

“5. On 24 April 2019, [NAME] filed a T98 Notice of appeal form with the FTT administration (pp.28-34). The T98 form was in some respects sketchy and incomplete – for example, there was no date given for the [NAME]’s decision or notice that he was appealing against (p.30). However, it was plain from the free text entered in Box 5a (grounds of appeal or application) that [NAME] wanted [NAME] to produce copies of e- mails and wanted the Commissioner (and, failing that, the FTT) to intervene to that end.

6. On 9 September 2019, the [NAME] e-mailed the FTT stating that the application appeared to relate to a complaint made to her office on 13 September 2018 and dealt with by the Commissioner on 10 December 2018. The Commissioner argued the application of 24 April 2019 was out of time and should not be granted an extension of time.

[NAME] v [NAME] [2020] UKUT 196 ([NAME])

7. On 10 September 2019, the FTT Registrar refused to extend time and so dismissed [NAME]’s application (pp.9-10). She concluded that [NAME] was subject to the old 28-day time limit for lodging his application and so was 3 months and 10 days out of time (“a very serious breach of the rules”). [NAME] asked for that ruling to be reconsidered by a judge.

8. On 10 October 2019, a FTT Judge reconsidered the matter afresh (pp.16-18). She agreed with the FTT Registrar’s decision not to extend time to admit the application. In particular, she agreed with the Registrar that the application was 3 months and 10 days out of time and so significantly in breach of the 28-day time limit (see para [8] of her ruling). She rejected the argument that the application related to a complaint made in January 2019; rather, she found, it related to the original complaint made on 13 September 2018 (see paras [6]-[7] of her ruling).

9. On 25 November 2019, the FTT Judge considered [NAME]’s application for permission to appeal (pp.12-15). She refused that application, and in doing so expanded upon her reasons for not granting an extension of time. She confirmed her finding that the application to the FTT related to the original complaint made on 13 September 2018 (see paragraph [23] of her ruling). However, she did not repeat her finding that the application was 3 months and 10 days late. Rather, she now found that the application was made 14 days outside the new time limit, being a maximum of 28 days after the expiry of 6 months from the date the Commissioner received the complaint (see paragraph [3] of her ruling).”

10. By way of further background, the Commissioner’s email of 9 September 2019 (referred to in paragraph 6 of the extract immediately above) included the following passage:

“The Applicant has made a large number of complaints to the Commissioner under both the Freedom of Information Act and Data Protection Act. It remains unclear to the Commissioner precisely which complaint this application relates to. It is assumed to be in connection with a complaint made by the Applicant to the Commissioner on 13 September 2018, which was dealt with under reference number RFA0780195. In that complaint the Applicant raised concerns that Rochdale Borough Council would not respond to a subject access request as he was subject to a restraining order which, amongst other things, prohibited him from contacting any employee of the Council other than via a solicitor. Having taken the matter up with the Council, a case officer wrote to the Applicant on 6 December 2018 explaining that she had advised the Council that it should in the alternative consider accepting a subject access request made on his behalf by an ‘advocate’. The Applicant was advised that the Commissioner was not able to act on his behalf by making the request for him. On 10 December 2018, the case officer suggested that the Applicant contact the [NAME] for assistance in obtaining an advocate to make a request on his behalf. In subsequent emails dated 14 and 19 December 2018 the case officer confirmed that the complaint had been closed.”

The proceedings in the Upper Tribunal 11. I gave [NAME] permission to appeal as it was arguable the Tribunal went wrong in law in refusing to grant him an extension of time in which to lodge his application under section 166(2) of the DPA 2018. In doing so I also made the following preliminary observations on the question as to the date from which the time limit for making a section 166 application ran:

[NAME] v [NAME] [2020] UKUT 196 ([NAME])

“18. It is tolerably clear that [NAME]’s undated document of 8 January 2019 (file name [NAME].DPA.request.080119.docx) was directed to [NAME] and not addressed to the Commissioner. However, [NAME] followed that up with an email to [EMAIL] on 14 January 2019 stating “as expected I haven’t received any response to my data protection act request” (p.39). His argument, as noted in his e-mail of 19 December 2019, is that “my application has ALWAYS related to my subject access request of 8 Jan 2019 and to my complaint to the ICO of 14 January 2019” (original emphasis). Neither the FTT Registrar nor the FTT Judge referred to the e-mail of 14 January 2019. I accept it is possible that e-mail was not included in the papers before them, which would account for their omission to refer to it.

19. There is no prescribed format for a section 165 complaint by a data subject to the Commissioner, although there is an on-line facility (in accordance with section 165(3)). However, it is at least arguable that the e-mail of 14 January 2019 was a section 165 complaint. If so, the time limit of 6 months + 28 days ran from that date, and so the application of 24 April 2019 made to the FTT was well in time.

20. I recognise that there may be a separate argument as to the likely prospects of a section 166(2) application, but [NAME]’s case could not be knocked out simply on time grounds.”

12. That final comment, of course, was premised on the assumption that the relevant complaint to the [NAME] was indeed made on 14 January 2019 (and so would have been in time) and not (as the Tribunal had found) on 13 September 2018 (in which event it would have been 14 days out of time).

13. [NAME], Solicitor, has provided a response on behalf of the [NAME] (pp.53-57). His submission, in summary, is that [NAME]’s e-mail to the Commissioner of 14 January 2019 was not a new complaint, but rather in substance the same complaint as that he had made on 13 September 2018. He argued that the Commissioner had dealt with that complaint. He further submitted that the Tribunal was therefore correct to conclude that the relevant complaint was made on 13 September 2018 and that the application under section 166 was accordingly out of time. He invites me to dismiss the appeal.

14. [NAME] has provided a reply to the Commissioner’s response (pp.148- 152). Most of his reply is concerned with setting out his grievances against the Council, which (as already noted) he considers to have withheld evidence (principally e-mails from his former work account). He adds that “there is obviously much more evidence I could present but there is a tendency that I send too much and people switch off” (pp.150-151). As if to demonstrate the point, he also forwarded to the Upper Tribunal a further e-mail with multitudinous attachments, mostly comprising e- mails relating to his dispute with the Council (pp.58-144). I have taken these into account insofar as they are relevant to the issues raised by the present appeal. In his reply he stresses his argument that he had made a new subject access request to the Council on 8 January 2019 and had followed this up with a new complaint to the Commissioner on 14 January 2019. This complaint, he argued, was different from any previous complaint made on 13 September 2018 and so was in time.

The Upper Tribunal’s analysis 15. The crux of this appeal turns on whether [NAME]’s complaint to the Commissioner on 14 January 2019 was a new complaint or merely a repetition of the

[NAME] v [NAME] [2020] UKUT 196 ([NAME])

complaint made on 13 September 2018. If it was a new complaint, it was in time, given the more generous time limit in place since October 2018. If it was a re-heated complaint, then it was out of time and could only be admitted if the Tribunal decided it was fair and just to extend time under rule 5(3)(a). On that latter point, I should say at the outset that I am entirely satisfied that the Tribunal Judge directed herself properly as to the applicable law (see Data Select Limited v HMRC [2012] UKUT 187 (TCC)).

16. Accordingly, it is necessary to examine the communications in question. [NAME]’s communication of 13 September 2018, which was addressed to [EMAIL] as well as to various courts, tribunals, the police and the CPS, had the message line “ABUSE, PERJURY, CONSPIRACY, PERVERTING THE COURSE OF JUSTICE – CORRUPTION.” The e-mail itself read as follows:

“Please see the attached.

Thank you.

I am disabled and am being abused.

I am now having to pay huge legal costs to people who have clearly abused me, committed hate crimes and then lied and deliberately withheld evidence in order to cover it up.

This isn't right.

Not for publication without my express written consent.”

17. Attached to this e-mail were a total of 11 documents, mostly relating to the previous court and tribunal proceedings. These attachments included one new document, also dated 13 September 2018, and entitled “Abuse and Cover Up by [NAME]” (emphasis as in the original). The gist of that document was that the Council and several of its senior employees (including [NAME] and [NAME]) had conspired to lie in various legal proceedings. [NAME] further demanded access to the evidence contained in his work e-mail account. He concluded:

“Because I KNEW what was happening to me I retained specific evidence in my council email account and computer but despite a claim to do 'everything in their power to oppose all forms of bullying and harassment' (A CLAIM WHICH IS CLEARLY A LIE) [NAME] have done everything in their power to support the abuse….

I DEMAND ACCESS TO THAT EVIDENCE.”

18. It is not known what if any action most of the addressees took on receipt of this communication. I rather suspect [NAME]’s e-mail was simply ignored by most of them. However, I am satisfied that the ICO took the steps summarised by [NAME] in his e-mail of 9 September 2019 (see paragraph 10 above).

19. I then turn to consider [NAME]’s request to the Council on 8 January 2019. This was a 4-page Word document which started in the following terms (emphasis again as in the original):

“For the attention of [NAME] Protection Act and/or Freedom of Information Act

[NAME] v [NAME] [2020] UKUT 196 ([NAME])

Please provide copies of all the emails received in my [NAME] email account [e-mail address redacted by Upper Tribunal] (from commencement of my employment in 2004 to date).

If these are not available for any claimed reason it will clearly be a further attempt at perverting the course of justice.”

20. A week later (or, to be precise 6 days later) on 14 January 2019, [NAME] e- mailed a copy of the 8 January request direct to the Commissioner (as well as copying it to the then Prime Minister, his MP and various media organisations). His covering e-mail was short and to the point (emphasis also as in the original):

“As expected I haven’t received any response to my data protection act request.

Please do the job you are supposed to do and ensure I get access to the evidence I retained since 2006 and before because I KNEW I WAS BEING ABUSED (HATE CRIMES).

Thank you.”

21. [NAME]’s submission is simple. He says the complaints of 13 September 2018 and 14 January 2019 are in substance the same complaint, namely that the Council were not responding to his subject access requests for e-mails stored on his old work e-mail account. Thus, [NAME] argues that [NAME] is simply repeating his earlier complaint to the ICO, which had been dealt with as explained in his e-mail of 9 September 2018. As such, the application to the Tribunal on 24 April 2019 was out of time (by 14 days), even applying the more generous new time limit.

22. [NAME]’s case is equally straightforward (as e.g. set out in his detailed grounds in his e-mail of 19 December 2019). It is best summed up in a statement from his recent e-mail to the Upper Tribunal of 5 June 2020:

“As far as I am concerned these proceedings relate to the complaint I made to the ICO in January 2019 after the ICO said I would have to make a new subject access request to Rochdale Council. I have made numerous requests for the information since 2 August 2011 (see attached) and before, none of which have been properly addressed (if at all) by Rochdale Council (or the ICO).”

23. [NAME] appears to have misunderstood the advice he was given by the ICO. I have seen no evidence that the ICO advised him simply to go ahead and make a fresh subject access request to the Council. Instead, it appears that the ICO, recognising that there was a restraining order in place, sought to broker some sort of compromise between the parties. As [NAME] put it in his e-mail of 9 September 2019 (see paragraph 10 above),

“… a case officer wrote to the Applicant on 6 December 2018 explaining that she had advised the Council that it should in the alternative consider accepting a subject access request made on his behalf by an ‘advocate’. The Applicant was advised that the Commissioner was not able to act on his behalf by making the request for him. On 10 December 2018, the case officer suggested that the Applicant contact the [NAME] for assistance in obtaining an advocate to make a request on his behalf.”

[NAME] v [NAME] [2020] UKUT 196 ([NAME])

24. However, it is plain from the file that [NAME] had already been unable to obtain assistance either from a solicitor or from [NAME], as demonstrated by the emails on file from October and November 2018 (pp.100-115).

25. It is true that in his e-mail of 13 September 2018 [NAME] did not refer to any specific subject access request made by him to the Council. However, section 165(2) of the DPA 2018 is expressed in very broad terms: “A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act.” Section 165 does not require any specific request to be identified. Given that statutory context, the [NAME] was perfectly entitled to treat the 13 September 2018 communication as a section 165 complaint, not least as the tenor of that e-mail was certainly an allegation by [NAME] that the Council had committed “an infringement of Part 3 or 4 of this Act.” Indeed, that complaint has been the central thrust of [NAME]’s campaign for some years past.

26. Furthermore, a comparison of the complaints of 13 September 2018 and 14 January 2019 shows that they were essentially making the same point and requesting the same information under the guise of the DPA 2018. The whole point of [NAME]’s various communications is that he says he has been repeatedly denied access to information held by the Council which, he says, will prove that Council officers have lied and acted so as to pervert the course of justice. That being so, the essence of the 14 January 2019 complaint was the same as that on 13 September 2018. As such, the time limit for making an application to the Tribunal under section 166 ran from the earlier date. It followed the application was out of time. As I have already noted, there was no error of law by the Tribunal in its treatment of the issue of whether an extension of time should be granted. It follows too that there was no material error of law on the Tribunal’s part.

27. I should also refer to the issue of the restraining order.

The restraining orders 28. On 27 January 2015, the Bury and Rochdale Magistrates’ Court made a restraining order (case reference [PHONE]) against [NAME]. The Order stipulated that he was “1) not to contact [[NAME] or [NAME]] directly or indirectly [and] 2) not to name or publish any photographs of [[NAME] or [NAME]] in any document circulated to the public or any social media”. The Order was made to protect [NAME] and [NAME] “from further conduct which amounts to harassment or will cause fear of violence” and was for a two-year term, i.e. until 27 January 2017.

29. A further restraining order (case reference A2015 0037) was made by Manchester Crown Court, under section 5A(1) of the Protection from Harassment Act 1997, following [NAME]’s subsequent acquittal on those charges (on 27 July 2016). Section 5A(1) provides that “A court before which a person (‘the defendant’) is acquitted of an offence may, if it considers it necessary to do so to protect a person from harassment by the defendant, make an order prohibiting the defendant from doing anything described in the order.” The Crown Court restraining order itself was made on 6 March 2017 and was made “until further order”. The terms of the Crown Court’s restraining order prohibited [NAME] from:

“1. Contacting either directly or indirectly [[NAME] or [NAME]].

2. Contacting either directly or indirectly any employee of [NAME] except through a solicitor.

[NAME] v [NAME] [2020] UKUT 196 ([NAME])

3. Making any Freedom of Information Act requests of [NAME] unless, i. the request is made by a solicitor, and ii. it has not been the subject of a previous Freedom of Information Act request.

4. Publicising or seeking to publicise the ruling in this appeal by any means.

5. For the avoidance of doubt, paragraphs 1 and 2 hereof remain in force but do not prevent the Appellant from pursuing matters before the Employment Appeals Tribunal or from lawfully instituting other civil proceedings, however, any pre- action letter addressed to either [[NAME] or [NAME]] should be sent to them:

c/o Legal Services Department, [NAME] [POSTCODE]”

30. I simply note in passing that clause 3 of the Order only refers to FOIA requests, and has no application to subject access requests under the DPA 2018. However, it is at least arguable that the subject access request of 8 January 2019 was made in breach of clause 2 of the Order. Clause 4 is phrased in very wide terms and would in principle appear to cover [NAME]’s production, in the present proceedings, of an apparently unofficial transcript of the Crown Court’s judgment on his acquittal. It would not be appropriate for me to express a decided view on these matters, as the questions of the interpretation and enforcement of the restraining order are for the Crown Court.

31. [NAME] has advised the Upper Tribunal that “I would also like to put on record that I applied to have the restraining order imposed by the court lifted and that [NAME] made no objection, in fact they didn't even reply”. The present status of the Order was therefore not entirely clear.

Accordingly, I directed an Upper Tribunal registrar to make enquiries of the Manchester Crown Court. This revealed that the restraining order was still in place and that [NAME] had made several unsuccessful attempts to have it revoked. In those circumstances it is only proper that I direct that copies of this Upper Tribunal decision should be sent to HH Judge Lever at Manchester Crown Court and to the Council for their information.

Conclusion 32. The First-tier Tribunal Judge’s rule 4(3) decision of 10 October 2019 applied the wrong time limit but correctly concluded that the application related to the complaint of 13 September 2018. The error about the time limit was corrected in the Judge’s ruling on 25 November 2019 refusing permission to appeal. Whichever time limit was applied, the application was late and no good reason for delay had been given. I accordingly conclude that the decision of the First-tier Tribunal involves no material error of law as the outcome was not affected by any error. I dismiss the appeal, not least as there is no point in allowing the appeal but re-making the decision in the same terms.

Final observations 33. I appreciate this decision will come as a disappointment to [NAME]. He has fought a long campaign to rectify what he considers to be the injustices done to him. He has had relatively little success along the way in various courts and tribunals. However, I recognise that HH Judge Eady (as she then was) observed in her [NAME] v [NAME] [2020] UKUT 196 ([NAME])

judgment that it is “fair to say that this Judgment of the Crown Court is fairly damning in terms of the criticisms it makes of [[NAME] and [NAME]] and, to some extent, of the Respondent more generally” (at paragraph [17]). However, whatever the rights and wrongs of the dispute between [NAME] and the Council, I am satisfied that the First-tier Tribunal was correct in finding that in this instance his section 166(2) application was out of time.

34. There is a wider jurisdictional issue in play here. Plainly the GDPR requires that data subjects have an “effective judicial remedy” against both a “supervisory authority” (here, the Commissioner) and a data controller or processor (see GDPR Articles 78 and 79 respectively). Domestic legislation provides that procedural redress against the Commissioner under Article 78(2) is sought from the Tribunal whereas substantive redress under Article 79 must be pursued in the courts (being the county court or the High Court). The policy reason for this jurisdictional disconnect, which is hardly helpful for litigants in person, or for developing a coherent system of precedent, is not immediately apparent. A comprehensive strategic review of the various appellate mechanisms for rights exercisable under the DPA is arguably long overdue. This might include consideration of whether the section 166(2) procedure is working as anticipated. Anecdotally at least, the experience of both the First-tier Tribunal and the Upper Tribunal is that a significant proportion of these applications have little merit yet consume a considerable and disproportionate amount of judicial and administrative resources.

[NAME] (Approved for issue on 15 June 2020)

Judge of the Upper Tribunal