[2025] UKUT 74 (AAC)

The First-tier Tribunal in its decision directed itself as follows in relation to the law:

a.

The Commissioner has a broad discretion to decide whether to investigate a complaint at all, and, if so, to what extent: R (Delo) v IC [2023] 1WLR 1327 (per Mostyn J at 57 and 62/63); R (Delo) v IC [2024] 1 WLR 263 (per Warby LJ at 80).

b.

It is principally for the Commissioner to determine what is an “appropriate” response to a complaint: Killock & Veale v IC [2022] 1 WLR 2241 at 85/86

c.

Section 166 is a procedural remedy. It is not a right of appeal and does not afford the data subject the right to challenge the substance of a complaint outcome.

d.

The appropriate remedy for such a challenge is an application for judicial review in the High Court, rather than an application under section 166.

e.

The remedy provided for by section 166 is essentially forward-looking. It is concerned with remedying ongoing procedural defences that stand in the way of the timely resolution of a complaint. That said, and whilst a data subject may not “wind back the clock and try by sleight of hand to achieve a different outcome” (see Delo per Mostyn J at 131), it is not ruled out that there are “circumstances in which a complaint, having received an outcome to his or her complaint under section 165(b), may ask the Tribunal to wind back the clock and to make an order for an appropriate step to be taken in response to the complaint under section 166(2)(a)” - Killock and Veale, para 87. Two caveats follow in this Upper Tier Tribunal, the first in paragraphs 85/86 of the decision that the Tribunal has to respect the special position of the Commissioner and have a good reason to interfere with the Commissioner’ regulatory judgement and cannot simply substitute its own view. The second caveat, further to paragraph 87 of Killock & Veale, is that the Tribunal must cast a critical eye to assure itself that the complainant is not using the section 166 process to achieve a different complaint outcome.

The Tribunal went on to consider whether this was a case in which “the narrow window of circumstance anticipated in Killock and Veale in which ‘winding back the clock’ was lawful” applied in this case. It concluded that it did not.

In particular, the Tribunal at [10] explained why it did not consider that the Commissioner was “plainly a biased regulator” when dealing with complaints about the actions of the ICO. The Tribunal considered the appellant’s assertion that the Commissioner had a motive not to carry out a proper investigation where the actions he is investigating are his own. The Tribunal’s view was that the appellant’s case in this respect was “speculative and unproven”.

The Tribunal considered an email dated 7 February 2023 (“the 7 February 2023 email”) on which the appellant placed considerable weight in relation to his third ground of appeal.

This email was from the Commissioner’s caseworker who prepared the 17 February 2023 response to the appellant’s complaint (Ms Jones) and was sent to another caseworker (Ms Brewster). Forwarding an email from Ms Keith (who had previously dealt on behalf of the ICO with his underlying Article 18(1)(c) requests), Ms Jones wrote:

Just in relation to preserving cases and our conversation this morning, I think the first half of the email explains it a bit further. Might be worth putting a process in place like you said, on how to preserve a case and what happens when we do etc.

I think rather than finding the ICO in breach in this case, just to inform the DS that we have taken this case as a learning opportunity to improve our practises when it comes to preserving cases. Let me know your thoughts.

The “first half of the email” to which Ms Jones referred in that first paragraph appears to be the part of Ms Keith’s email that relates to IC-67118-V8Y4 and the ICO’s explanation that RFA0804334 and RCC0854800 (among other references) had previously been preserved by one department at the appellant’s request, even though another department thought they should not be.

The appellant’s argument before the First-tier Tribunal was that the 7 February 2023 email indicated that the Commissioner had concluded there had been a breach of Article 18 in his case, but decided not to tell him that.

The First-tier Tribunal, however, decided that the 7 February 2023 email:

…did no more than indicate that a lessons learned process should follow the outcome. It did not lead to a conclusion of fact (on the basis of being more likely than not) that there was a view internally that there had been a breach of data protection obligations on the part of the Commissioner.

Nor did it lead to a conclusion that the outcome communicated to the Applicant on 17 February 2022 was only “an” outcome and not “the” outcome (which the Applicant sought to argue from this email was that there had been a breach of data protection obligations). This finding disposed of the Applicant’s third ground of appeal, that the outcome which the Commissioner sent him in response to his complaints is incompatible with the outcome of the Commissioner’s investigation in the subject matter of his complaints. The Tribunal dismissed this ground of appeal on the basis that he had received communication of “the” outcome of his complaints on the 17 February 2022 and this was not incompatible with what the Applicant alleged was indicated in the email cited above. In light of the Tribunal’s interpretation of this email, it did not consider this showed any failure of disclosure on the part of the Commissioner.

The Tribunal went on to explain why it dismissed the appellant’s first and second grounds too. At [13], the Tribunal concluded that the Commissioner had taken adequate steps to investigate the appellant’s complaint, having reviewed the correspondence stored on the Commissioner’s case management system, engaged with the relevant team and inquired about the handling of the appellant’s requests, providing him with an outcome on 17 February 2023, further clarification on 27 February 2023 and a case review of that outcome on 25 July 2023.

The Tribunal at [14]-[15] considered submissions that the appellant had made about the Commissioner being subject to a ‘duty of candour’ and obliged to provide witness statements or disclosure of all the underlying evidence in relation to the investigation. The Tribunal concluded that it did not need to decide whether the Commissioner was subject to a duty of candour as such because it did not need either witness statements or further disclosure from the Commissioner to determine the matter before it.

At [16] the Tribunal considered the Commissioner’s argument that the appellant was trying to use the section 166 process to achieve a different outcome to his complaint, contrary to the guidance in Killock and Veale, but rejected that argument, holding that the appellant was properly inviting the First-tier Tribunal to consider procedural aspects of the investigation.