Tribunal Clarifies Limits of Data Rights Appeals in Panossian v Information Commissioner Decision

On 5 June 2025, the First-tier Tribunal (General Regulatory Chamber) issued a decision in the case of Aram Panossian v Information Commissioner, focusing on the procedural aspects of data rights complaints. This case originated from Panossian's grievances regarding how Sainsbury's Supermarkets Limited handled a subject access request concerning his late father's information, as well as the actions taken by the Information Commissioner.

The Tribunal operates under the stringent legal frameworks established by the Data Protection Act 2018 (DPA), particularly regarding section 166 applications. The initial application by Panossian was struck out on 7 March 2025 after the Tribunal concluded that his claims lacked a reasonable prospect of success. Following this, Panossian appealed, asserting that his detailed submissions had not been duly considered, which he argued constituted a procedural irregularity.

In examining his appeal, Tribunal Judge Hazel Oliver observed that the original decision indeed overlooked the applicant's submissions during its deliberation, which warranted setting the first ruling aside. Yet, after a thorough reassessment, Judge Oliver concluded that Panossian's arguments did not impact the Tribunal's assessment of the case's merit.

The backdrop of this case revolves around the DPA, which inherently outlines the rights of individuals to lodge complaints against the handling of personal data. Panossian sought information related to personal data about himself as a co-beneficiary of his deceased father's estate. However, the Tribunal determined that it lacked jurisdiction in this matter, stressing that it does not have the authority to reassess outcomes derived from complaints lodged with the Commissioner.

This judgement elucidates fundamental legal principles related to data protection and administrative justice. Notably, it reinforces that while individuals possess the right to appeal decisions made by the Information Commissioner, the Tribunal's role is confined to reviewing procedural adherence, not the substantive merits of data protection complaints. Judge Oliver referenced relevant case law, drawing parallels with the Cortes v Information Commissioner case, to substantiate the Tribunal's limitations in such matters.

In dismissing Panossian's application, the Tribunal asserted that the Information Commissioner's actions adequately addressed his complaint and adhered to procedural standards. Despite Panossian's claims regarding the insufficiency of the Commissioner's responses and allegations of a breach of natural justice, the Tribunal stood by existing case law. It reiterated the narrow parameters within which it is required to operate.

Ultimately, the Tribunal's ruling established that there was no reasonable prospect of success for Panossian's case, culminating in the striking out of his proceedings. This judgment highlights the complexities surrounding data rights within the UK legal framework, underscoring the critical need for clear procedural guidelines to assist individuals navigating the intricacies of the DPA and its implementation.

Judge Oliver’s verdict underscores the significance of procedural integrity within the legal system and illustrates the limitations imposed on complainants under the current framework for data protection law in the United Kingdom