Tribunal dismisses appeal over GDPR complaint