Amongst the mix of rights that data subjects have under the General Data Protection Regulation 2018 (GDPR) and the Data Protection Act 2018 (DPA), is a “lesser-known” right, tucked away in section 166 of the DPA, which has been recently tested.
Under the DPA, in certain circumstances data subjects have the right of appeal to the First-tier Tribunal (Information Rights) (FTT (IR)), if they consider the Information Commissioner’s Office (ICO) has not properly handled their complaint. Depending on the facts, the FTT (IR) then has the power to make an order against the ICO. In the employment context, such complaints to the ICO might be made by a current or former employee who thinks their employer has not properly responded to a data subject access request (DSAR). Before GDPR, the only way to contest how the ICO handled such a complaint was by making an application for judicial review.
This right is limited to procedural failings only, and there is no general right of appeal against the substantive decision of the ICO following any investigation. This was confirmed in the recent case of Tabidi v Information Commissioner  UKFTT 2019_0030 (GRC) (24 July 2019)) (Tabidi).
Complaints that can correctly be referred to the FTT (IR) include situations where the ICO has failed to take appropriate steps to respond to a complaint, or to inform the complainant about progress on their complaint, or to tell an individual about the outcome of a complaint in a timely fashion.
In Tabidi, the applicant initially complained to the ICO that he did not receive a reply to a DSAR he had submitted to the Employment Tribunal – when he’d requested a copy of the Judge and panel members’ notes. The ICO considered his complaint, but agreed the Tribunal was not required to respond to the DSAR, based on the applicable exemption under the DPA, for data processed by a judicial office holder or tribunal acting in a judicial capacity.
The ICO concluded it was unlikely Mr Tabidi was entitled to the data he’d requested, and had informed him of its decision. However, Mr Tabidi believed the ICO had not taken appropriate steps to properly investigate his complaint, and subsequently applied to the FTT (IR) for an order requiring the ICO to progress his complaint. Mr Tabidi’s appeal was refused by the FTT (IR) on the grounds that procedurally, the ICO had in fact taken entirely appropriate steps to investigate his complaint. Whilst Mr Tabidi was not happy with the ICO’s decision, the powers of the FTT (IR) are limited to determining errors of ICO procedure only. In this case there was no basis for the FTT (IR) to change the substantive decision of the ICO.
The case of Tabidi helpfully confirms the limited scope of this right for employees. However, for employers, it highlights how employees have yet another forum to raise data-related issues and complaints in the workplace – in this case, if they are dissatisfied with the ICO’s handling of their complaint. In our view, there is potential for both current and former employees to use this knowledge to their advantage, particularly where the employment relationship has become strained.