[2025] UKUT 74 (AAC)

In Killock and Veale v Information Commissioner [2021] UKUT 299 (AAC), [2022] AACR 4 an Upper Tribunal panel consisting of the then Chamber President Farbey J, Upper Tribunal Judge West and Tribunal Member Pieter De Waal considered three joined cases. Having reviewed the case law up to that date, the Upper Tribunal held as follows regarding the scope and effect of section 166:

74 The remedy in section 166 is limited to the mischiefs identified in section 166(1). We agree with Upper Tribunal Judge Wikeley’s conclusion in Leighton (No 2) [2020] UKUT 23 (AAC) that those are all procedural failings. They are (in broad summary) the failure to respond appropriately to a complaint, the failure to provide timely information in relation to a complaint and the failure to provide a timely complaint outcome. We do not need to go further by characterising section 166 as a ‘remedy for inaction’ which we regard as an unnecessary gloss on the statutory provision. It is plain from the statutory words that, on an application under section 166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the section 166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a tribunal from the procedural failings listed in section 166 towards a decision on the merits of the complaint must be firmly resisted by tribunals.

75 We do not accept that the limits of section 166 mean that the rights

of data subjects are not protected to the extent required by the GDPR or by the CFR. Infringement of rights under data protection legislation is remediable in the courts (sections 167—169 of the DPA). In addition, if a data subject decides to complain to the Commissioner, section 166 provides procedural protections in order to ensure that the complaint receives appropriate, timely and transparent consideration. The Tribunal, as a judicial body, has expertise in procedural matters. It is therefore apt for a tribunal to provide a remedy against procedural failings in complaints handling.

76 The Tribunal does not have the same expertise in determining the

appropriate outcome of complaints. The Commissioner is the expert

regulator. She is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome. In so far as the Commissioners regulatory judgments would not and cannot be matched by expertise in the Tribunal, it is readily comprehensible that Parliament has not provided a remedy in the Tribunal in relation to the merits of complaints.

77 This does not leave data subjects unprotected. If the Commissioner

goes outside her statutory powers or makes any other error of law, the High Court will correct her on ordinary public law principles in judicial review proceedings. The combination of a statutory remedy in the Tribunal in relation to procedures and to the supervision of the High Court in relation to substance provides appropriate and effective protection to individuals. It does not require us to strain the language of section 166 to rectify any lack of protection or to correct any defect in Parliament’s enactment of the Uks obligations to protect an individual’s data.

At [77]-[82], the Upper Tribunal then considered whether its interpretation of section 166 would be compliant with the EU principles of equivalence and affording an effective remedy and concluded that it was because judicial review provided the effective remedy in relation to the substance of the Commissioner’s decision on a complaint.

The Upper Tribunal then went on to give further guidance as to how the Tribunal should approach an application under section 166, and the question of whether ‘appropriate steps’ have been taken by the Commissioner or should be ordered by the Tribunal. The Upper Tribunal concluded that the task of the Tribunal is not merely to review the decision of the Commissioner, applying judicial review principles, but to decide for itself, applying an objective test, whether appropriate steps have been taken, albeit giving weight to the views of the Commissioner as an expert regulator on any matter on which the Commissioner has exercised regulatory judgment. The key passage from Killock and Veale is as follows:

84 There is nothing in the statutory language to suggest that the question of what amounts to an appropriate step is determined by the

opinion of Commissioner. As Mr Black submitted, the language of section 165 and section 166 is objective, in that it does not suggest that an investigative step in response to a complaint is appropriate because the Commissioner thinks that it is appropriate: her view will not be decisive. Nor has Parliament stated that the Tribunal should apply the principles of judicial review which would have limited the Tribunal to considering whether the Commissioners approach to appropriateness was reasonable and correct in law. In determining whether a step is appropriate, the Tribunal will decide the question of appropriateness for itself.

85 However, in considering appropriateness the Tribunal will be bound to take into consideration, and give weight to, the views of the Commissioner as an expert regulator. The GRC is a specialist tribunal and may deploy (as in Platts) its non-legal members appointed to the Tribunal for their expertise. It is nevertheless our view that, in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations. As Mr Milford emphasised, her decisions about these matters will be informed not only by the nature of the complaint itself but also by a range of other factors, such as her own regulatory priorities, other investigations in the same subject area and her judgment on how to deploy her limited resources most effectively. Any decision of a tribunal which fails to recognise the wider regulatory context of a complaint and to demonstrate respect for the special position of the Commissioner may be susceptible to appeal in this chamber.

86 We do not mean to suggest that the Tribunal must regard all matters before it as matters of regulatory judgment: the Tribunal may be in as good a position as the Commissioner to decide (to take Mr Milford’s example) whether a complainant should receive a response to a complaint in Braille. Nor need the Tribunal in all cases tamely accept the Commissioner’s judgment which would derogate from the judicial duty to scrutinise a party’s case. However, where it is established that the Commissioner has exercised a regulatory judgment, the Tribunal will need good reason to interfere (which may, in turn, depend on the degree of regulatory judgment involved) and cannot simply substitute its own view.

87 Moreover, section 166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the

timely resolution of a complaint. The Tribunal is tasked with specifying

appropriate ‘steps to respond’ and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question. We do not rule out circumstances in which a complainant, having received an outcome to his or her complaint under section 165(4)(b), may ask the Tribunal to wind back the clock and to make an order for an appropriate step to be taken in response to the complaint, under section 166(2)(a). However, should that happen, the Tribunal will cast a critical eye to assure itself that the complainant is not using the section 166 process to achieve a different complaint outcome.

88 The same reasoning applies to orders under section 166(2)(b) requiring the Commissioner to inform the complainant of progress on the complaint or of the outcome of the complaint within a specified period. These are procedural matters (giving information) and should not be used to achieve a substantive regulatory outcome.

In Killock and Veale itself, the Upper Tribunal went on to dismiss the section 166 application. In that case, the Commissioner had considered a complaint and undertaken some investigation, but then decided to take the complaint itself no further (although a related but separate investigation continued). The Upper Tribunal treated this discontinuance as the outcome of the complaint and held that the request for further steps to be taken to investigate the subject matter of the complaint was an impermissible attempt to ‘wind back the clock’ and achieve a different complaint outcome (see [105]).

In the joined case of EW v IC, by contrast, the Commissioner had misapplied his own policy and declined to engage at all with the data subject’s complaint. There had been no investigation. The Upper Tribunal ordered the Commissioner to take further appropriate steps to investigate and to respond to the complaint within a specific timescale (see [118]).

Killock and Veale was considered further in R (Delo) v Information Commissioner [2024] 1 WLR 263. In Delo the claimant had made a subject access request to a financial services company and then complained to the Information Commissioner about the company’s response. Having received and reviewed the complaint, the Commissioner decided to take no further action, finding that the scope of the complaint was too widely drawn and that the company was likely to be exempt from giving the disclosure sought. That decision was maintained on a reconsideration. The claimant brought a claim for judicial review, contending that the Commissioner’s decision to take no further action was unlawful. The High Court (Mostyn J) dismissed the claim and the Court of Appeal dismissed the claimant’s appeal.

The Court of Appeal (Warby LJ giving the leading judgment) upheld Mostyn J’s judgment that the Commissioner was not required to determine every complaint on its merits (see [62]), but only “to address and deal with every complaint by arriving at and informing the complainant of some form of ‘outcome’, having first investigated the subject matter ‘to the extent appropriate’ in the circumstances of the case” ([63]). The Court of Appeal also noted that “there are also second tier obligations, to inform the complainant of the progress of the investigation and of the complaint”. The Court of Appeal further held that an “outcome” in this context could include a decision not to investigate further, not just a merits assessment ([64]). At [80] Warby LJ concluded as follows:-

“80.

For the reasons I have given I would uphold the conclusion of the

judge at [85] that the legislative scheme requires the Commissioner to

receive and consider a complaint and then provides the Commissioner

with a broad discretion as to whether to conduct a further investigation

and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint.”

The Court of Appeal went on to hold (at [90]) that Mostyn J had been right to find that the Commissioner had acted lawfully in that case in declining to investigate the complaint further.

In reaching its judgment in that case, the Court of Appeal specifically considered the decision of the Court of Justice in Data Protection Comr v Facebook Ireland Ltd (Case C-311/18) [2021] 1 WLR 751, in which (among other things) the Court of Justice emphasised that “the supervisory authority is … required to execute its responsibility for ensuring that the GDPR is fully enforced with all due diligence”. At [68]-[71] Warby LJ explained why these dicta of the Court of Justice added nothing to its analysis of the legislation: it remained the case that the Commissioner enjoys a discretion, the exercise of which was challengeable on judicial review on the usual judicial review principles.

In the course of its judgment, the Court of Appeal also considered the question of alternative remedies, as the High Court will not normally permit a claimant to proceed by way of judicial review if they have an adequate alternative remedy available to them.

At [72]-[80], the Court of Appeal concluded that the fact that a data subject could also choose to pursue a claim against the data controller (under Article 77 GDPR) did not prevent the data subject judicially reviewing the Commissioner in respect of his handling of a complaint; these remedies were not in the Court’s view mutually exclusive and may be pursued concurrently.

Earlier in the judgment, at [41]ff, the Court of Appeal also addressed the Commissioner’s argument that the availability of a right to apply to the First-tier Tribunal under section 166 was an alternative remedy that should have resulted in permission being refused in the judicial review or the judicial review claim being dismissed.

This argument had been run (albeit not in quite the same form) before Mostyn J. Mostyn J had firmly rejected the Commissioner’s attempt to persuade him that section 166 presented an adequate alternative remedy for the claimant in that case. He held ([2023] 1 WLR 1327 at [128]) that section 166 did not provide an adequate alternative remedy to a judicial review claim because it “applies only where the claim is pending and has not reached the outcome stage” and “only to alleged deficiencies in procedural steps along the way and clearly does not apply to a merits-based outcome decision”. In his judgment, Mostyn J also made further observations, building on what had been said by the Upper Tribunal in Killock and Veale, about the possibility of using section 166 to ‘wind back the clock’ after the Commissioner has ostensibly provided an ‘outcome’ to a complaint. At [131] Mostyn J held, with respect to the Commissioner’s argument that the claimant was in reality ‘merely’ seeking an order requiring the Commissioner to take appropriate steps in relation to the complaint so that section 166 provided an appropriate alternative remedy:

“131.

For my part, if an outcome has been pronounced, I would rule out any attempt by the data subject to wind back the clock and to try by sleight of hand to achieve a different outcome by asking for an order specifying an appropriate responsive step which in fact has that effect. The Upper Tribunal rightly identified in [77] that if an outcome was pronounced which the complainant considered was unlawful or irrational then they can seek judicial review in the High Court. ...”

133 In my judgment this [the Commissioner’s argument] is precisely the sort of sleight of hand with which I disagree. The commissioner’s argument seeks to clothe a merits-based outcome decision with garments of procedural failings. The substantive relief sought by the claimant was disclosure of the documents. The commissioner’s argument is that the tribunal could have made a mandatory procedural order specifying as a responsive step the disclosure of those very documents.

On appeal, the Court of Appeal declined to decide whether Mostyn J was right about what he had said in these passages or not, but recorded the Commissioner’s submissions as to why Mostyn J was wrong, noting in the following passage that the Commissioner’s argument was an important one and thus indicating that it was one that might fall to be determined in future:

46 The Commissioner submits that the judge was wrong to hold that section 166 applies only where a complaint is ‘pending’ and has not reached an ‘outcome’. A data subject is always entitled to complain to the First-tier Tribunal of any failure by the Commissioner to ‘handle’ a complaint or to ‘take appropriate steps’ to respond to it (such as to investigate ‘to the extent appropriate’. These rights are not taken away just because the Commissioner complies with his duty to provide an ‘outcome’. So, a data subject who complains that the Commissioner has provided an ‘outcome’ without first ‘handling’ the complaint or taking ‘appropriate steps’ to respond or investigate it can rely on section 166. In such a case, the FtT has jurisdiction. Judicial review is not necessary or appropriate.

47 All the more so, says the Commissioner, when section 167 creates the potential for a claim to enforce the provision of subject access by the data controller. That, it is submitted, is a direct means of providing what claimant such as Mr Delo is ultimately after when he seeks to enforce his rights against the Commissioner via an application to the FtT or a claim for judicial review. All of this is said to apply equally if, as Mr Delo contends the obligation to provide the data subject with an ‘outcome’ means that the Commissioner must determine the merits of the complaint.

48 I can see the logic of the argument about the scope of section 166. And it may be that in a case where section 166 does not avail the claimant because his grievance is about the ‘outcome’ of a complaint to the Commissioner) a private law claim against the data controller under section 167 could be considered an adequate alternative to judicial review I am not convinced that refusal of judicial review on that basis would necessarily be at odds with the CJEU’s reasoning in BE. But I do not think this is the right case in which to decide these points.

49 The Commissioner’s argument about the effect of section 166 is an important one but it is subtle and it was raised belatedly. He evidently failed to make it clear in the court below. We do not have the benefit of the lower court’s assessment of that contention. Nor, as it happens, do we have the lower court’s view on the section 167 argument. Whatever their merits those arguments would provide no answer to Mr Delo’s Ground 3, so judicial review claim was the only means of pursuing that aspect of the claim. And for reasons I have already given, the public interest favours decision from this court on all the substantive issues raised by the appeal.

The parties in the present appeal have also referred me to two permission decisions of Judge Wikeley. The first, Lawton v Information Commissioner (UA-2021-000457-GIA and UA-2022-000676-GIA), was decided after Killock and Veale and the High Court decision in Delo, but before the Court of Appeal decision in Delo. The second, Cortes (UA-2023-001298-GDPA), was decided after the Court of Appeal decision in Delo.

For the moment, I only need to refer to Lawton for what Judge Wikeley says at [21]-[29] about the doctrine of precedent and how it applies in relation to the decision of the panel of two judges and one specialist member who decided two out of the three cases in Killock and Veale and also the decision of Mostyn J in Delo. In short, Judge Wikeley concludes that neither are strictly speaking binding on a single judge of the Upper Tribunal, but that as a matter of comity a single judge should generally follow such a decision unless convinced the decisions are wrong. I agree with Judge Wikeley and in this case I have found no reason to disagree with the Upper Tribunal’s decision in Killock and Veale. As to Mostyn J’s decision in Delo,as I have noted, aspects of his decision were called into question by the Court of Appeal’s judgment in that case and, insofar as he went further than the Upper Tribunal in Killock and Veale in narrowing the scope of section 166, I decline to follow his judgment. I explain why below in the context of considering Judge Wikeley’s decision in Cortes.

Judge Wikeley’s decision in Cortes contains an analysis of the substance of the decisions in Killock and Veale and Delo. At [31]ff, Judge Wikeley summarised the law as it appeared to him to be in the light of Killock and Veale and Delo as follows:-

31.

I am satisfied that I am bound by both Killock and Veale and R (on the application of Delo). The thrust of the case law and its direction of travel is very clear, and cannot be derailed by the fact there is a pending reference to the CJEU in AB v Land Hesse (Case C-64/22). The domestic decisions demonstrate beyond any doubt that the nature of section 166 is that of a limited procedural provision. Professor Engelman argues, however, that section 166 in effect enables Mr Cortes to challenge whether the Commissioner has investigated the subject matter of the complaint to the extent appropriate and thus as a potential failure to take appropriate steps to respond to the complaint

(see DPA 2018 s.166(1)(a), (2)(a) and (4)). But this is just another example of the “sleight of hand” identified by Mostyn J in R (on the application of Delo); it is an attempt to clothe a merits-based outcome decision with the garments of procedural failings. If the FTT were to order the Commissioner under section 166 to take further alternative steps, in the absence of quite exceptional circumstances such as those in EW v IC, then the outcome of the complaint would necessarily be subject to an impermissible collateral challenge – a challenge that the case law confirms beyond any doubt could only be launched by way of a judicial review.

32.

In sum, Article 77.2 provides for an effective judicial remedy where “the Commissioner does not handle a complaint”. Mostyn J ruled that ‘handling’ a complaint includes not acting on a complaint as well as rejecting it (at [68]). Further, Mostyn J acknowledged the very wide scope of the Commissioner’s discretion to handle complaints under section 166 as he thinks best. Indeed, it extended as far as permitting the Commissioner to take no further action on even a non-spurious complaint, a finding echoed by the Court of Appeal. However, in this instance the Commissioner plainly handled Mr Cortes’ complaint, albeit he handled it in a manner and to an end which left Mr Cortes dissatisfied. But the purpose of section 166 is also evident from its heading – it provides for “Orders to progress complaints”, not for “Orders to re-open or re-investigate complaints”.

33.

The short answer to Mr Cortes’ case is that his complaint had been progressed to an outcome, and so there was no longer any scope for a section 166 order to bite. As Mostyn J held, section 166 “by its terms applies only where the claim is pending and has not reached the outcome stage” (at [128]; presumably in that passage the word ‘claim’ must be a typo for ‘complaint’). In the same vein, the Upper Tribunal ruled in Killock and Veale that “s.166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question” (Killock and Veale, paragraph 87). As such, the fallacy in the Applicant’s central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation, and thereby launch a collateral attack on the outcome itself with the aim of the complaint decision being re-made with a different outcome. Such a scenario would be inconsistent with the purport of Article 78.2, the heading and text of section 166 and the thrust of the decisions and reasoning in both Killock and Veale and R (on the application of Delo). It would also make a nonsense of the jurisdictional demarcation line between the FTT under section 166 and the High Court on an application for judicial review.

It will be noted that Judge Wikeley in that case mentions the then pending reference to the Court of Justice in Land Hessen Case C-768/21. The Court of Justice’s judgment in that case was promulgated on 26 September 2024, although neither party in this case has referred to it. I note that it placesconsiderable emphasis on the principle from the Facebook case as to the obligation of the supervisory authority to deal with all complaints “with all due diligence”, and holds that the discretion the supervisory authority enjoys as to the manner in which it decides to remedy any shortcoming found on an investigation is “limited by the need to ensure a consistent and high level of protection of personal data through strong enforcement of the rules”([37]). However, the principle from the Facebook case was considered by the Court of Appeal in Delo as I have noted and found by the Court of Appeal to make no difference to its analysis in that case. The Facebook case was also considered by the Upper Tribunal at [46]-[49] of Killock and Veale. As such, it seems to me that it is not capable of having any bearing on the proper interpretation and application of section 166 which Killock and Veale and Delo have held to be a matter of domestic law interpretation. What the Court of Justice says in Land Hessen may have some bearing on the approach that the High Court might take in future to judicial reviews of decisions of the Commissioner in relation to GDPR compliance.

That said, I do not wholly share Judge Wikeley’s view as to the narrowness of the scope of the remedy available under section 166. Judge Wikeley’s decision in Cortes is a permission decision, reached after an oral hearing attended only by the appellant and at which Judge Wikeley did not therefore have the benefit of full argument. The decision in Cortes proceeds on the basis that the Court of Appeal in Delo wholly endorsed Mostyn J’s judgment. However, as noted above, the parties’ arguments in the present case have brought to my attention that this is not so as far as concerns what Mostyn J said about section 166 applying only where a complaint is “pending” and has not reached an “outcome”; the Court of Appeal’s judgment leaves a question mark over that aspect of Mostyn J’s judgment. It also seems to me that what Mostyn J said in Delo in this respect may go further than what the Upper Tribunal said in Killock and Veale and, if and insofar as it does, I decline to follow Mostyn J and prefer the analysis in Killock and Veale, which it seems to me is unaffected by the question mark left over Mostyn J’s judgment by the Court of Appeal in Delo.

I do not, though, consider that there is any real doubt about the legal principles applicable in this case. The difference between what Mostyn J said at [130]-[131] of his judgment and the argument that the Commissioner sought to run in the Court of Appeal is really one of emphasis rather than principle. I do not read Mostyn J’s judgment at [130]-[131] as saying that, just because the Commissioner has provided an ‘outcome’, there is no scope at all for an application to the First-tier Tribunal under section 166. Rather, he is making the same point that the Upper Tribunal made in Killock and Veale, i.e. that the scope for finding that an “appropriate step” has been omitted once an ‘outcome’ has been produced is limited. This is the effect of all the authorities, it seems to me. They all hold that, on an application under section 166, it is for the Tribunal to decide, applying an objective test, if an “appropriate step” has been omitted, but observe that, in practice, that is unlikely to be the case where an ‘outcome’ has been produced. That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an “appropriate” step has been omitted is limited.

However, the authorities do not preclude an order being made for an appropriate step to be taken even where an outcome has already been provided. One ready example where that is likely to be appropriate is (it seems to me) where the Commissioner’s outcome only deals with part of a complaint and fails to deal with another part of the complaint as a result of oversight or other mistake. In other words, a case where effectively a single complaint is dealt with in part as the Commissioner dealt with the complaint in the Killock and Veale case itself, while the other part is treated like the complaint in the EW v IC case that was considered by the Upper Tribunal at the same time.