[2025] UKUT 74 (AAC)

The appellant argues that, even if the Tribunal was right to interpret the 7 February 2023 email as doing no more than communicating that a “lessons learned” process should follow the outcome, the outcome he received from the Commissioner was “incompatible” with this because it just said that the ICO was compliant and made no mention of a lessons learned process.

The Commissioner submits that there is no error of law in the Tribunal’s decision. It was open to the Tribunal to find that the email was not referring to a view that there had been a breach of UK GDPR, merely to a “lessons learned” process, and thus that the email was consistent with the outcome the appellant received. The Commissioner further submits that his obligations under the statutory regime are to take appropriate steps to respond to the complaint and to inform the complainant of the outcome. The Commissioner was not required to inform the appellant of an internal learning opportunity.