Amongst the mix of rights that data subjects have under
the General Data Protection Regulation 2018 (GDPR) and the Data
Protection Act 2018 (DPA), is a "lesser-known" right,
tucked away in section 166 of the DPA, which has been recently
tested.
Under the DPA, in certain circumstances data subjects have the
right of appeal to the First-tier Tribunal (Information Rights)
(FTT (IR)), if they consider the Information Commissioner's
Office (ICO) has not properly handled their complaint. Depending on
the facts, the FTT (IR) then has the power to make an order against
the ICO. In the employment context, such complaints to the ICO
might be made by a current or former employee who thinks their
employer has not properly responded to a data subject access
request (DSAR). Before GDPR, the only way to contest how the ICO
handled such a complaint was by making an application for judicial
review.
