Sandra Dennerlein – Court Ruling (United Kingdom, 2023)

In April 2023, a data subject complained to the UK Data Protection Authority (ICO) that a bank (the controller) had failed to update their systems, resulting in her personal banking data being sent to the incorrect address. Furthermore, even after she informed the controller of this fact, they continued to send her letters and cheques to the incorrect address. In May 2023, the ICO replied to her complaint. They stated that they had raised the issue with the controller who had provided a full response and addressed all the ICO's questions. The ICO was satisfied with the controller's response and their handling of the data subject's personal data and subject access requests. As such, the ICO closed the case. The data subject asked the ICO to show her the response from the the controller. The ICO took 26 days to reply and told her that they would not release it as it had been provided by the the controller's DPO for the sake of the investigation. In June 2023, the data subject appealed the ICO's decision to the First Tier Tribunal under Section 166 of the UK Data Protection Act (DPA 2018). Section 166 governs the Tribunal's jurisdiction to give orders to the Information Commissioner to progress complaints when the complaint has been made under Section 165 Data Protection Act or Article 77 UK GDPR.Article 77 remains the same in both the UK and EU GDPR. The data subject accused the ICO of failing to take reasonable steps to resolve her complaint in accordance with the DPA 2018. They argued that it was impossible for her to verify whether the controller had told the ICO the truth. Through appealing the decision, she wanted her complaint to be acted upon and to receive all the personal data related to her accounts held with the controller. The Tribunal struck out the data subject's appeal because it fell outside its jurisdiction. First, Section 166 DPA 2018 does not give data subjects a right of appeal against the merits of the Information Commissioner’s decisio