data protection act
📖 What is data protection act? Meaning and definition
The Data Protection Act 2018, often referred to as DPA 2018, is a significant piece of legislation in the UK that sets out the framework for data protection. It works alongside other regulations, such as the GDPR, to ensure that organisations handle personal information responsibly and lawfully. Individuals who believe their data protection rights have been infringed can make an application under this Act, typically to the First-tier Tribunal (General Regulatory Chamber).
These applications, often brought under specific sections like section 166(2) of the DPA 2018, allow individuals to seek an order from the Tribunal to progress complaints they have made to the Information Commissioner. For instance, if an individual has concerns about how an organisation is processing their data, they might complain to the Information Commissioner. If they are not satisfied with the progress or outcome of that complaint, they can then apply to the Tribunal under the DPA 2018.
However, the Tribunal's ability to hear such an application can be affected by various factors. For example, if an outcome to the complaint has already been provided, there might be no basis for the Tribunal to make an order. Applications can also be struck out if the Tribunal determines it lacks jurisdiction or if the application has no reasonable prospect of success. The Tribunal aims to deal with cases fairly and justly, considering whether to proceed with or without a hearing, and may dismiss applications under certain circumstances.
📋 Requirements
- An application must be brought under a specific section of the Data Protection Act 2018, such as section 166(2).
- The application concerns an individual's complaints against an organisation regarding the processing of data.
- The complaint must have been submitted to the Information Commissioner.
- The Tribunal must have jurisdiction to deal with the application.
- There must be a basis for the Tribunal to make an order, meaning an outcome of the complaint has not yet been provided.
📝 Procedure
- An individual submits a complaint to the Information Commissioner regarding data processing concerns.
- If dissatisfied with the progress or outcome, the individual lodges an application under section 166(2) of the Data Protection Act 2018 with the First-tier Tribunal.
- The respondent (the organisation) may oppose the application and apply for it to be struck out.
- The Tribunal considers the application, potentially without a hearing, to determine if it has jurisdiction or if an outcome has already been provided.
- The Tribunal makes a decision, which could include dismissing the application or striking it out.
💡 Examples
- An individual applies to the First-tier Tribunal under the Data Protection Act 2018 because they believe the Information Commissioner has not adequately progressed their complaint about a company's handling of their messaging data.
- A person's application under the Data Protection Act 2018 is dismissed by the Tribunal because the Information Commissioner had already provided an outcome to their complaint before the Tribunal could make an order.
- An application brought under the Data Protection Act 2018 is struck out by the Tribunal because it determined it did not have the legal authority (jurisdiction) to deal with the specific issue raised.
- A Tribunal decides to hear an application under the Data Protection Act 2018 at an oral hearing after an initial decision to dismiss it on papers was appealed.
📚 Legal basis
- Data Protection Act 2018
- The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009
❓ Frequently asked questions
What is the purpose of the Data Protection Act 2018?
The Data Protection Act 2018 (DPA 2018) sets out the legal framework for data protection in the UK, governing how personal data is processed. It allows individuals to bring applications to tribunals if they have concerns about data processing.
Can I make an application under the DPA 2018 if I'm unhappy with how my data is handled?
Yes, you can make an application under sections like 166(2) of the DPA 2018 to the First-tier Tribunal if you have concerns about an organisation's data processing and are seeking an order to progress a complaint you've already made to the Information Commissioner.
What happens if an outcome to my complaint has already been provided?
If an outcome to your complaint has already been provided, the Tribunal may find there is no basis for it to make an order under the DPA 2018, and your application might be dismissed or struck out.
What does it mean for an application to be 'struck out'?
When an application is 'struck out', it means the Tribunal has decided to end the case without a full hearing. This can happen if the Tribunal lacks jurisdiction, if the application has no reasonable prospect of success, or if an outcome has already been provided.
Do I always get an oral hearing for my DPA 2018 application?
Not necessarily. The Tribunal may dispose of proceedings without a hearing, especially when considering striking out a party's case. However, a decision to proceed without a hearing can sometimes be a ground for appeal if proper notification or reasons were not given.
Where do I submit a complaint about data processing before going to the Tribunal?
Before making an application to the Tribunal under the DPA 2018, you typically need to submit your complaint to the Information Commissioner, who is responsible for dealing with such matters.