[2025] UKUT 74 (AAC)

The approach the First-tier Tribunal should take to section 166 applications where the Commissioner has been asked to investigate a complaint against the ICO

However, all that still leaves the question of the appellant’s argument on this appeal that, as a “biased regulator” the Tribunal should not have afforded the Commissioner’s views any respect in this case. I disagree.

As noted above, if I had had to decide in this case whether the Commissioner is apparently biased when investigating the ICO, I would have concluded that he was not. Nor do I consider that there is enough in the appellant’s apparent bias argument to justify or require the Tribunal to take any generally different approach to section 166 cases like this. Apparent bias is about appearances, not actuality. If there is an appearance of bias, that needs to be addressed by changing the role of the Commissioner in the statutory scheme, not by altering the legal principles that the Tribunal applies when considering a section 166 application. The factors that make the Commissioner an expert regulator will in general apply equally in cases where the Commissioner is investigating himself. The Commissioner remains the expert regulator, both in terms of assessing the merits of a complaint (in respect of which his decisions may only be challenged by way of judicial review) and as to the procedural matters with which section 166 is concerned, including whether any steps should be taken to investigate a complaint at all and, if so, what resources to deploy on that investigation. In the ordinary course of events, and as a matter of principle, the team at the Commissioner responsible for dealing with such complaints can therefore be expected to approach the exercise with the same expertise and in the same way as they would complaints about a third party data controller - and so should the Tribunal.

That said, the weight that the Tribunal gives to the Commissioner’s views in any particular case will inevitably vary depending on the nature of the case and the view that the Tribunal forms as to the quality of the decision-making on the part of the Commissioner in the particular case. It will generally be a relevant factor for the Tribunal to take into account in such cases that the Commissioner is investigating himself. However, the relevance of the identity of the data controller under investigation is really no more or less important in such cases than it is in other cases. Depending on the circumstances, the identity of the data controller (their profile, size, resources, whether or not they are a public authority, etc) may lead the Commissioner and (in turn) the Tribunal to take a different approach in a particular case.

In all cases, the Tribunal must be astute on a section 166 application to consider whether there has been any actual bias or other improper conduct by the Commissioner in relation to the investigation, whether as a result of the identity of the data controller or otherwise. If there has been any actual bias or other improper conduct, the Tribunal will need to take these matters into account when deciding what weight to give to the views of the Commissioner in a particular case and whether to make any order for an appropriate step to be taken under section 166.