Can an individual who alleges that a data controller has infringed the data protection legislation utilise a simple procedure claim to, in effect, seek an order under section 167 of the Data Protection Act 2018? That was one of several matters addressed by the Sheriff Appeal Court (Sheriff Principal Ross) in a recent appeal involving a father and the General Teaching Council for Scotland.

Background

The appellant (pseudonymised in the court’s opinion to protect the identity of his daughter) complained to the school that his daughter attended. Despite the school addressing the problem about which the appellant complained, it persisted. The appellant became concerned that records had been retrospectively falsified. The appellant reported the teachers to the respondent, the General Teaching Council for Scotland, who are responsible for regulating teachers in Scotland. The respondent began an investigation, but it ceased due to the passage of time and a lack of evidence. The appellant recovered from the school metadata from the school’s IT system and made a further referral to the respondent who deemed it to be frivolous.

The appellant thereafter submitted a request for information to the respondent under the Freedom of Information (Scotland) Act 2002. The respondent declined to comply with the request for information on the ground that it was vexatious. The appellant sought an internal review and then complained to the Scottish Information Commissioner who issued a decision in favour of the respondent.

The appellant then raised a simple procedure claim for the sum of £750. The claim centred on the response to the appellant’s FOI request. The Sheriff held that the data in question was not inaccurate for the purpose of Article 16 of the UK GDPR. The purpose was not to make factual findings about the appellant’s motive, rather it explained the respondent’s decision to refuse the appellant’s FOI request.

The use of Simple Procedure

Simple procedure was introduced to replace two separate processes in the Sheriff Court: small claims and summary cause. It hasn’t totally replaced them, but that is something that isn’t relevant for present purposes. The types of claims that can be raised under Simple Procedure are set out in Section 72(3) of the Courts Reform (Scotland) Act 2014.

The Sheriff who heard the claim considered that the claim was essentially an attempt to challenge the reasons given for refusing the appellant’s FOI request through data protection law. The Sheriff Appeal Court agreed. [14] A Sheriff has no jurisdiction, under simple procedure or otherwise, to interfere with a FOI decision as the legislation makes provision for how such decisions can be challenged. [6] Describing it as an action of payment of money created only a tenuous link with simple procedure. [14]

The appellant’s claim was based on sections 167, 168 and 180 of the Data Protection Act 2018 (not Article 82 of the UK GDPR). An application under section 167 of the Data Protection Act 2018 cannot be made under simple procedure. [19] Nor can simple procedure be used to seek an order under section 168 of the Data Protection Act 2018. [20] Section 170 of the Data Protection Act 2018 does not create a private law remedy for damages or compensation [18] and therefore simple procedure cannot be used. [21]

In essence, the appellant had no remedy for his claim under simple procedure, but even if he did the Sheriff did not err in finding that the personal data concerned was not inaccurate as it accurately recorded an opinion. [27] In essence, even if his claim had proceeded on the basis of Article 82, there would have been no infringement of the UK GDPR. The appeal was refused. [27]

Comment

Claims for damages are available under Article 82 of the UK GDPR or, for processing that falls within the ambit of the Data Protection Act 2018 rather than the UK GDPR, section 169 of the Data Protection Act 2018. If data subjects wish to exercise their right under section 167 of the Data Protection Act 2018 this cannot be done through a simple procedure claim. It is also not possible to effectively seek to challenge a response to a FOI request through a simple procedure claim, the Scottish Parliament has reserved that issue to the Scottish Information Commissioner and thereafter the Court of Session. If a simple procedure claim is going to be used to seek payment of damages, the claim needs to proceed on the basis that it is a claim for damages under Article 82 or section 169. However, if other orders are to be sought under the Data Protection Act 2018 instead of, or in addition to, a claim for damages, those cannot be obtained through a simple procedure claim.

As this is an opinion of the Sheriff Appeal Court it is binding on all Sheriffs and Summary Sheriffs in Scotland.

^{Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.}