First-tier Tribunal (Information Rights) vs Court (Data Protection)
An appeal to the First-tier Tribunal (Information Rights) challenges an ICO decision notice on the merits and on points of law. A court claim under UK GDPR Art.82 and Data Protection Act 2018 s.168 seeks compensation from the data controller or processor for damage caused by a data protection breach.
Overview
Data protection disputes in England and Wales can be resolved through two distinct legal routes depending on the nature of the dispute. Where the ICO has issued a decision notice โ for example, following a complaint about a data controller's handling of a Subject Access Request (SAR), or a failure to comply with UK GDPR Art.17 (right to erasure) โ the decision notice can be appealed to the First-tier Tribunal (Information Rights) under the Data Protection Act 2018 s.27 and the Freedom of Information Act 2000 s.58. The Tribunal can review both the merits and the legal basis of the ICO's decision and can substitute its own decision. Separately, where a data subject has suffered material or non-material damage (including distress) as a result of a data protection breach, they have a right to compensation under UK GDPR Art.82 and DPA 2018 s.168. This is a private law claim brought in the civil courts, not before the Tribunal. The two routes serve different purposes and are not mutually exclusive โ a data subject may appeal the ICO's decision to the Tribunal and simultaneously bring a compensation claim in the civil courts.
Side-by-Side Comparison
First-tier Tribunal (Information Rights)
Pros
- Free to appellants โ no fee to appeal an ICO decision notice to the FTT
- Full merits and law review โ the Tribunal is not limited to reviewing whether the ICO was reasonable; it substitutes its own decision on the facts
- Relatively accessible โ Tribunal procedure is less formal than court litigation; many appellants are unrepresented
- Specialist judges with expertise in information rights law โ faster and more expert than a generalist court on FOIA/EIR/DPA issues
Cons
- Cannot award compensation โ the FTT can only set aside, vary, or substitute the ICO's decision; it cannot award damages to the data subject
- Only available after an ICO decision notice โ cannot go straight to the FTT without first complaining to the ICO
- Scope limited to the ICO decision โ the Tribunal reviews what the ICO decided; it cannot deal with compensation or ancillary private law issues
- Further appeal to the Upper Tribunal on points of law only โ limited further right of appeal (permission required)
Best For
Data subjects or public authorities who wish to challenge the substance or legal basis of an ICO decision notice โ for example, whether the ICO was correct that a FOIA exemption applied, or whether a SAR response was compliant under UK GDPR.
Court Claim (Data Protection Compensation)
Pros
- Compensation can be awarded โ both material and non-material (distress) damages are available under UK GDPR Art.82
- Claimant controls the proceedings โ not dependent on the ICO's willingness to investigate or take action
- Injunctive relief available โ court can order the controller to stop processing or to delete data
- Representative actions under CPR 19.8 allow groups of data subjects to bring coordinated claims
Cons
- Costs risk โ standard civil litigation costs apply; unsuccessful claimant risks paying defendant's costs (except in small claims track)
- Proving damage โ non-material damage (distress) must be more than trivial; mere technical breach without proven damage may not be sufficient
- Limitation period โ 1 year from awareness of the breach (DPA 2018 s.169); 6-year longstop โ tighter than many contract/tort claims
- Complex to litigate โ establishing the nature of the breach, causation, and quantum of loss requires evidence and often expert support
Best For
Data subjects who have suffered identifiable material or non-material damage as a result of a data protection breach โ particularly where the breach involves sensitive personal data, reputational harm, financial loss, or distress โ and where the ICO has not provided adequate individual redress.
Key Differences
Our Recommendation
Data subjects should generally complain to the ICO first โ it is free and the ICO has investigatory powers that private claimants do not. If the ICO issues a decision notice adverse to the data subject, an appeal to the FTT is free and provides a full merits review. A court compensation claim under UK GDPR Art.82 is appropriate where the data subject has suffered identifiable damage and the amount justifies the costs of litigation. Both routes can be pursued concurrently โ the ICO/Tribunal route for systemic compliance; the court route for individual compensation. Limitation periods for the court claim must be monitored carefully โ the 1-year period from awareness of the breach is short.