[2025] UKUT 74 (AAC)

On 29 December 2022, the appellant made two complaints to the Commissioner that the ICO had breached data protection laws by failing to retain files relating to previous cases/complaints/requests/appeals that the appellant had brought to or against the ICO/Commissioner in response to requests for retention made by the appellant under Article 18(1)(c) of the UK General Data Protection Regulation (UK GDPR).

Article 18(1)(c) of the UK GDPR provides data subjects with a right to restrict processing of data by a data controller where “the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims”.

The appellant’s first request for retention under Article 18(1)(c) (“the 2020 request”) was made on 16 October 2020.

The appellant’s second request for retention under Article 18(1)(c) was made on 13 November 2022 (“the 2022 request”).

Together, the requests were for the ICO to retain data in relation to eight previous case references. The appellant explained that he considered Article 18(1)(c) applied because they were all cases that were in his view linked, and in respect of which he had either received a First-tier Tribunal judgment he was considering appealing and/or in respect of which he was considering making an application to the County Court under sections 167 or 168 of the DPA 2018. The eight previous references were:-

The ICO replied on 13 December 2022. This was a five-page letter in which the ICO set out in relation to each case reference why the ICO considered it was no longer necessary to retain the information in question.

In summary, the ICO’s response was as follows:-

The appellant complained about the ICO’s reply by further email of 14 December 2022. In this email, the appellant argued that the ICO had made a number of mistakes because (in summary):

The appellant also added that he wanted RFA0804334 and RCC0854800 retained because it was his intention to seek to reopen those cases.

By email of 21 December 2022, the ICO maintained his position in relation to his response to the appellant’s Article 18 requests but did not address (in any way) the points made in the appellant’s email of 14 December 2022. The ICO informed the appellant of his right to complain to the Commissioner.

This the appellant then did, completing two online submissions on 29 December 2022 (pp 73 and 74 of the First-tier Tribunal bundle). The first concerned his request of 16 October 2020 and was numbered IC-67118-V8Y4; the second concerned his 13 November 2022 request and was numbered IC-201926-Y8M5 by the Commissioner. The appellant appended to these his emails of 13 November 2022 and 14 December 2022 (among other documents).

By letter of 17 February 2023, the Commissioner dismissed his complaint, finding that the ICO had complied with the UK GDPR. The Commissioner considered together IC-67118-V8Y4 and IC-201926-Y8M5 and also another (IC-186591-H9C1) which has not featured in this appeal.

Regarding IC-67118-V8Y4, the Commissioner found the ICO was compliant with the UK GDPR. The Commissioner noted that in 2020 the appellant was in contact with both the Freedom of Information team and the Public Advice & Data Protection Complaints Services who had already decided that the appellant’s request should be complied with. Those dealing with the Article 18 request therefore decided that it should be complied with as a matter of good service, although there were no live proceedings ongoing, but the appellant was informed that the preservation only applied to RFA0804334, RCC0854800, and FS50804336.

Regarding IC-201926-Y8M5, the Commissioner wrote as follows in the 17 February 2023 outcome letter:

The IA team came to the conclusion that none of the gateways to restrict processing were met and therefore refused to take action. The preservation status of those cases that had previously been preserved were reconsidered in light of the fact that two years had passed, and it was determined that there were no circumstances in which the ICO was obliged to continue preserving these cases.

Overall, considering the information above, I believe that the ICO has complied with their data protection obligations in this case. This is because none of the Article 18 gateways were met when considering the request and the ICO must ensure they comply with the storage limitation principle (Article 5(1)(e)).

The 17 February 2023 letter again does not deal with any of the points made by the appellant in his email of 14 December 2022.

The appellant was dissatisfied with the outcome and queried it, receiving a further response on 27 February 2023. By email of 17 July 2023, the appellant formally requested a case review of the 17 February 2023 outcome. He complained that, in relation to both his complaints, the Commissioner had not investigated “the subject matter of my complaint” or “whether Article 18(1)(c)) applies”. He made two particular points, specifically:

The appellant asked whether it was the Commissioner’s position that those legal proceedings did not exist at the relevant time, or, if not, on what basis his retention requests had been refused. He queried the case officer’s suggestion that his requests had not met an Article 18(1)(c) “threshold”.

By letter of 25 July 2023 the Commissioner responded to the case review, maintaining his previous position. The material part of the Commissioner’s reasons was as follows:-

You have mentioned you are still unclear as to why your cases have been deleted, despite you submitting a right to restrict request on the basis of Article 18(1)(c), which is when the data controller no longer needs the personal data but the individual needs them to keep it in order to establish, exercise or defend a legal claim.

Having considered the available information, I am satisfied that the ICO’s reasoning has been explained to you with an explanation as to why Article 18(1)(c) doesn’t apply. As such, I am satisfied that [the Commissioner] did not need to reiterate this information in [the 17 February 2023] outcome.

In regard to your query about a ‘threshold’, this just meant that, for example, there are no open legal proceedings, or you are out of time to initiate legal proceedings and therefore the threshold for applying Article 18(1)(c) has not been met.

Having reviewed the matter, I am satisfied that [the Commissioner] dealt with your complaint appropriately. As such this is not something that we intend to pursue further.

As will be noted, this communication takes the position that the Commissioner’s reasoning for finding there was no breach of the UK GDPR has been explained to the appellant previously. Accordingly, it too does not deal with the points made in the appellant’s email of 14 December 2022.

It is convenient to note here that, in his further submissions following the Upper Tribunal hearing, Mr Metcalfe (on behalf of the Commissioner) has indicated that the writer of the 25 July 2023 letter was referring to the ICO’s email of 13 December 2022 when they said that the appellant had been provided previously with reasons why Article 18(1)(c) did not apply to his 12 November 2020 request. However, the ICO’s email of 13 December 2022 understandably did not contain reasons answering the points that the appellant made for the first time the following day in his email of 14 December 2022. The appellant’s email of 14 December 2022 was complaining about what the ICO had said in his email of 13 December 2022. The appellant has thus never had a response to the points that he made in his email of 14 December 2022.

As already noted, one of those points was that the ICO had failed to take into account that appeal EA/2022/0095 was ongoing as the appellant was seeking permission to appeal to the Upper Tribunal against the First-tier Tribunal’s decision in that case (in an appeal later numbered UA-2023-000680-GIA). Mr Metcalfe, on instructions, writes that the Commissioner following the Upper Tribunal hearing has consulted with the officer who drafted the 13 December 2022 email and:

The officer states that, when drafting the [13 December 2022 email], they consulted with FOI complaints about the appeal status and was told that no appeal was pending. On that basis, the officer reached their decision on the basis of the information that was provided to them. The officer accepts that the information was not, in fact, correct and states further that, had they known that the case was under appeal, they would have concluded that Art 18(1)(c) applied to IC-76861-G6C6.

I also directed the Commissioner to provide further submissions following the Upper Tribunal hearing identifying where the Commissioner had set out his reasons for concluding that the ICO was not in breach of the UK GDPR when he decided not to retain the file relating to what the appellant says was FOIA request IC-65359-C1C7 which was the subject of the Decision Notice IC-76861-G6C6 that was in turn the subject of the appeal EA/2022/0095. The Commissioner’s further submissions do not specifically deal with this point, although the acknowledgment that the Commissioner relied on the ICO’s reasons in the 13 December 2022 email explains why the Commissioner has not provided reasons dealing with this issue, which was another of the points identified by the appellant in his email of 14 December 2022.