Bilgi Komiserine Karşı Usuli Emir Yetkisi

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

IN THE UPPER TRIBUNAL Application No. GI/113/2021
ADMINISTRATIVE APPEALS CHAMBER

Applicants: James Killock and Michael Veale

Respondent: The Information Commissioner

By transfer from: First-Tier Tribunal (General Regulatory Chamber) (Information
Rights)

GRC Case No: QJ/2020/0303

Transfer Date: 29 November 2020

IN THE UPPER TRIBUNAL Application No. GI/1321/2020
ADMINISTRATIVE APPEALS CHAMBER

Applicant: EW
Respondent: The Information Commissioner
By transfer from: First-Tier Tribunal (General Regulatory Chamber) (Information
Rights)
GRC Case No: EA/2020/0196
Transfer Date: 19 August 2020

IN THE UPPER TRIBUNAL Appeal No. GIA/1619/2020
ADMINISTRATIVE APPEALS CHAMBER

Appellant: Eveleen Coghlan (on behalf of C)
Respondent: The Information Commissioner
On appeal from: First-Tier Tribunal (General Regulatory Chamber) (Information
Rights)
GRC Case No: QJ/2020/0206

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

Before: Mrs Justice Farbey, Chamber President
Upper Tribunal Judge West
Mr Pieter De Waal (in Killock & Veale and EW only)

Hearing date: 20-22 July 2021
Decision date: 24 November 2021

Representation:
For Mr Killock & Dr Veale: Ms Maya Lester QC, Ms Julianne Kerr Morrison, Mr Nikolaus
Grubeck (Mr Gerry Facenna QC in writing) instructed by Mr Ravi Naik, Solicitor, AWO
For EW: Mr Jacob Rabinowitz (pro bono through Advocate)
For Mrs Coghlan: Mr Daniel Black (direct access)
For Information Commissioner: Mr Julian Milford QC and Ms Harini Iyengar instructed by
Mr Richard Bailey, Solicitor, Information Commissioner’s Office

The Upper Tribunal orders that:

1. No one shall publish or reveal the name or address of the Appellant EW who is the
subject of the proceedings in Application No. GI/1321/2020 or publish or reveal any
information which would be likely to lead to the identification of the Applicant EW or of any
member of his family in connection with those proceedings.

2. No one shall publish or reveal the name of the Appellant C who is the subject of
proceedings in Appeal No. GIA/1619/2020.

REASONS FOR DECISION

Introduction

1. These three cases raise the important question of the scope of a Tribunal’s power to
make orders against the Information Commissioner (hereafter “the Commissioner) to
progress complaints made to her by data subjects. They concern the proper
interpretation of s. 165 of the Data Protection Act 2018 (“DPA”), which makes provision
for complaints by data subjects, and of s. 166 which makes provision for the Tribunal to
make orders to progress complaints. In the cases of Killock and Veale and of EW, the
Commissioner contends that the applications to the Tribunal were made out of time.

2. The cases have reached the Upper Tribunal by different routes. On 19 August 2020,
Upper Tribunal Judge O’Connor as Acting President of the First-tier Tribunal (General

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

Regulatory Chamber) (“GRC”) directed that EW’s application to the GRC be transferred
to the Upper Tribunal. Exercising her powers as Chamber President of the Administrative
Appeals Chamber, Farbey J had concurred with that course in a decision dated 17
August 2020. In EW’s case, therefore, the Upper Tribunal is exercising a first-instance
jurisdiction. On 29 November 2020, Judge O’Connor directed that Mr James Killock and
Dr Michael Veale’s application be transferred to the Upper Tribunal following Farbey J’s
earlier concurrence. In their case too, the Upper Tribunal exercises a first-instance
jurisdiction. By notice of appeal dated 19 October 2020, Mrs Eveleen Coghlan on behalf
of her son C appeals against a decision of the GRC so that, in C’s case, the Upper
Tribunal is exercising an appellate jurisdiction.

3. Given these different routes, the cases were heard one after the other over the course of
three days (20 – 22 July 2021). Mr Pieter De Waal, as a non-legal member of the
Tribunal, has taken part and contributed to the decisions in the two transferred cases but
has played no part in C’s appeal. He observed the hearing in C’s case (by video link) but
has taken no part in any deliberations. We have issued separate decision notices in each
case which convey the outcome of the case and the names of the judicial office holders
who have made the decision. We are grateful to the parties and their lawyers for their co-
operation with each other and with the Tribunal which has enabled this rather complex
procedural arrangement (made no easier by the challenges of the Covid-19 pandemic) to
work smoothly. We express particular gratitude to Mr Jacob Rabinowitz who appeared
on behalf of EW pro bono.

4. For convenience, we have decided to give the reasons for our decisions in each case in
this combined document while again emphasising that Mr De Waal stood aside in
relation to all matters relating to C. We consider the facts of each case before turning to
the legal framework and our legal conclusions.

Killock and Veale

5. Mr Killock is the Executive Director of Open Rights Group, a UK-based digital
campaigning organisation working to protect the rights to privacy and free speech online.
Dr Veale is a Lecturer in Digital Rights and Regulation at University College London.
They seek an order under s.166 DPA in relation to the decision of the Commissioner to
“cease handling” their complaint of unlawful conduct in the behavioural advertising
industry (“AdTech”) and real-time bidding (“RTB”) which affects the data of millions of
users of online services (“the Complaint”).

6. On 12 September 2018, Mr Killock and Dr Veale filed the Complaint with the
Commissioner pursuant to s.165 DPA. The Complaint raised issues regarding the
lawfulness of the industry’s use of personal data. It was supported by detailed grounds
and by a report by a subject matter expert, Dr Johnny Ryan, which explained the
concerns about how personal data is used in behavioural advertising. It is Mr Killock and
Dr Veale ’s case that those concerns related to their own personal data as users of
online services.

7. In outline, the Complaint concerned the industry’s (and in particular Google’s and the
Interactive Advertising Bureau’s) use of personal data in the context of RTB systems,
which facilitate personalised advertising on websites by auctioning an individual’s
personal data among potential advertisers. This entails sharing such data with tens or
even hundreds of companies every time an individual loads a page on a website which
uses the system. The Complaint asserted that such processing involves a number of
serious breaches of data protection law, including the DPA and data protection

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

regulations. Mr Killock and Dr Veale asked the Commissioner to take action to remedy
these breaches.

8. It is the Commissioner’s case generally that since early 2018 (at the latest) she has
considered it a priority to keep under review the use of web tracking within AdTech, of
which RTB forms one aspect. However, the exact nature of the Complaint (and the
remedies sought under it) is one of the issues in the present case. By the time of the
hearing before us, the Commissioner refused to accept that Mr Killock and Dr Veale had
made a justiciable complaint. The generality of the Complaint meant that it was upon
proper analysis an actio popularis, seeking an investigation or audit of a particular sector,
and was not a complaint about infringement of individual rights. Mr Killock and Dr Veale
had disavowed seeking any personal remedy (see for example paras 7.1 and 10 of their
letter of 30 November 2018). Instead they had asked the Commissioner to “initiate a
wider industry investigation into the data protection practices of the industry” and to
“exercise her discretion under section 129 of the DPA and seek a consensual audit of
the industry and issue appropriate codes of practice/guidance pursuant to section 128 of
the DPA”. As such, the Commissioner’s position is that neither Mr Killock nor Dr Veale
are able to invoke the jurisdiction of the Tribunal.

9. Mr Killock and Dr Veale submitted that the Commissioner’s position before us was at
odds with her previous approach. The Commissioner had treated their concern as a
complaint. She had acknowledged receipt of the Complaint, allocated it a case
reference number, and invited them to a meeting to elaborate on their concerns. In that
meeting on 23 January 2019, as well as in written submissions provided on 30
November 2018, 19 February 2019, 15 May 2019 and 18 June 2019, Mr Killock and Dr
Veale provided the Commissioner with additional information regarding their Complaint.
In a conference call with Mr Killock and Dr Veale on 20 May 2019, the Commissioner
indicated that she was planning to launch a position paper highlighting concerns
regarding the industry and RTB and that she was engaging with the key controllers
whom Mr Killock and Dr Veale had identified: Google and the Interactive Advertising
Bureau.

10. On 20 June 2019 the Commissioner published an Update Report into adtech and real
time bidding (the “Update Report”). That report corroborated the concerns raised in the
Complaint, essentially accepting that there appeared to be ongoing breaches of the
General Data Protection Regulation (“GDPR”). It concluded that there are issues of non-
compliance with data protection law on an industry-wide basis, which required regulatory
intervention. The Update Report was clear that the industry “needed to make
improvements to comply with the law.” It concluded that “the creation and sharing of
personal data profiles about people, to the scale we’ve seen, feels disproportionate,
intrusive and unfair, particularly when people are often unaware it is happening … one
visit to a website, prompting one auction among advertisers, can result in a person’s
personal data being seen by hundreds of organisations, in ways that suggest data
protection rules have not been sufficiently considered.” The Update Report committed
the Commissioner to undertaking a further review of the industry in six months’ time and
to “further consult with IAB Europe and Google.”

11. Following the publication of the Update Report, Mr Killock and Dr Veale (through their
solicitors) wrote to the Commissioner on 1 July 2019 to raise a number of issues
pertaining to the further investigation of the Complaint. The Commissioner responded to
the concerns raised on 24 July 2019 and stated:

“I can confirm that your clients’ complaint has been considered in
accordance with the relevant provisions of the GDPR and DPA 2018.

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

We continue to handle this complaint and keep your clients informed
of progress with our work. As recognised during our previous
discussions with you and your clients, RTB is a complex area, with
hundreds of individual actors involved in a single bid transaction. We
therefore need to take a considered approach and must not rush
towards actions that will not adequately address the systemic issues
identified in our recent update report on adtech and RTB.

…

The legal analysis you provided may form part of the considerations
around any future action. However, the fact that legal analysis has
been undertaken on a particular issue does not compel, require or
obligate the ICO to act on that advice. We are fully aware that
powers such as those for information notices and assessment
notices are available to the Commissioner. However, this does not
prevent the ICO from taking alternative approaches to information
gathering, while reserving the right to make use of formal powers if
organisations are not forthcoming in providing the requested
information. Please rest assured that your clients’ submission has
received considerable attention and we concur, as our recent report
on adtech highlights, that there are significant areas of concern that
require attention.

…

… I would like to reassure you that the original complaint submitted
by your clients and the additional supporting documentation received
in recent months have been central to shaping the ICO’s plans to
address the issues that exist within the RTB ecosystem. Our update
report sets out our plans for the next six months and we will continue
to keep your clients informed as our work progresses …”.

12. The Commissioner stated on 13 September 2019 that she “look[ed] forward to further
engagement”.

13. There was no further contact from the Commissioner until 17 January 2020, when she
published a blog post. This reiterated concerns relating to the industry and RTB and
again supported the view of Mr Killock and Dr Veale that there were ongoing breaches of
the GDPR. It stated that “engagement alone will not address all these issues” and that
“we anticipate it may be necessary to take formal regulatory action and will continue to
progress our work on that basis.”

14. On 4 February 2020, Mr Killock and Dr Veale wrote to the Commissioner requesting
clarification of the blog post and the engagement which the Commissioner had had with
the industry, as well as “details of what the ICO considers to be an ‘appropriate’
response to [Mr Killock and Dr Veale ’s] complaints.” They expressed concern that “the
Blog refers to a number of views and developments material to [our] complaints [but that]
despite the ICO’s obligations under s.165 DPA, [we] were not informed about these prior
to publication of the Blog and [have] not been provided with an opportunity to make any
submissions and express their views in respect of them.” They stated that the failure to
engage with them impinged on their rights as complainants and on the Commissioner’s
ability to conduct appropriate investigation and properly progress their complaints. They
requested that they be provided with an appropriate update on the Complaint.

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

15. The Commissioner responded on 20 February 2020 and again updated Mr Killock and
Dr Veale. She acknowledged her obligations under s.165 DPA “to take appropriate steps
to respond to the complaint, which includes investigating the subject matter of the
complaint to the extent appropriate and to inform the complainant of the progress of the
complaint” as well the outcome of the complaint. However, she also stated that s.165
DPA does not allow complainants to “dictate how the ICO should conduct its regulatory
activities” and that it was neither necessary nor appropriate “to provide a ‘running
commentary’ as to [her] regulatory work”.

16. In light of the Covid-19 pandemic, on 7 May 2020 the Commissioner informed Mr Killock
and Dr Veale that she had “made the decision to pause [the] investigation into real time
bidding and the Adtech industry”. She noted that “it is not our intention to put undue
pressure on any industry at this time but our concerns about Adtech remain and we aim
to restart our work in the coming months, when the time is right.” She issued a public
statement to that effect on the same day.

17. Mr Killock and Dr Veale wrote to the Commissioner on 19 May 2020, acknowledging the
problems created by the pandemic, but registering their concerns at the open-ended
nature of the “pause” in the investigation. The letter requested an update, in accordance
with the requirements of s.165 DPA. The Commissioner’s response reiterated her
understanding of the obligations imposed by s.165 and stated that “it is not accepted that
s.165 requires us to explain how long our investigation may be paused.”

18. In reply to a further request by Mr Killock and Dr Veale on 15 July 2020 for an update on
the investigation of the Complaint, the Commissioner stated that “as and when we
consider it appropriate to provide a further substantive update we shall do so”. Mr Killock
and Dr Veale responded on 29 July 2020, questioning the Commissioner’s interpretation
of the obligations imposed on her under s.165 DPA and emphasising the requirement to
provide an update every three months.

19. On 14 August 2020, the Commissioner wrote to Mr Killock and Dr Veale, stating that:

i. The Complaint had “been given significant consideration by the Commissioner,
going well beyond the level of time and resource ordinarily dedicated to
complaints dealt with via our standard case handling process”;

ii. It remained the Commissioner’s intention “to recommence our industry-wide
investigation into RTB in due course”;

iii. The Commissioner believed that “we have investigated the subject matter of your
clients’ complaint to the extent appropriate and that we have already clearly
communicated the steps we have taken and the extent to which it has informed
our wider approach”;

iv. The outcome of the Complaint, pursuant to s.165(4)(b) DPA, was:

“We are therefore in accordance with our obligations under GDPR
Article 77 and Section 165 DPA 18 informing you that we have
progressed as far as possible in our formal handling of your
clients’ complaint, with the outcome being that it has assisted and
informed the ICO’s broader regulatory approach to RTB since
September 2018. Please therefore consider this to be

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

confirmation of the outcome of your clients’ complaint in line with
s.165(4)(b) of the Data Protection Act 2018”;

v. The Commissioner had thereby “concluded our handling of [the Complaint]” and
no longer intended to provide any further specific updates;

vi. The Commissioner nonetheless intended to continue her investigation into
AdTech and “all options for future ICO regulatory intervention within the RTB
industry remain on the table”. She added:

“but, whilst we have noted your client’s previous requests for the
Commissioner to make use of specific regulatory powers, I must
reiterate that we are not obligated or compelled to follow a
particular course of regulatory action, within a desired timeframe,
at the request of complainants. As we have now concluded our
handling of your clients’ complaint, we no longer intend to provide
any further specific updates as an obligation to do so has now
concluded. Your clients are however welcome to follow the future
progress of our work in the Adtech space which we would intend
to publicise through the usual public channels, including on our
website.

Whilst we believe that you are already aware of the provisions of
s.166 of the Data Protection Act 2018 we nonetheless confirm the
position as required by s.165(4)(c). Should your clients consider
that the Commissioner has failed to handle their complaint in
accordance with her obligations under Article 77 and Section 165
to take appropriate steps to respond to them they may make
application to the First tier Tribunal, General Regulatory Chamber,
and request that the Tribunal make an order requiring the
Commissioner to take appropriate steps to respond to the
complaint. For the avoidance of doubt, as set out above, we
consider that the ICO has in fact taken appropriate steps in
response to your clients’ complaint and therefore such an
application if made would be opposed”.

20. On 17 September 2020 Mr Killock and Dr Veale challenged the Commissioner’s
assertion that the Complaint had been resolved. They stated that their “rights under the
GDPR continue to be infringed” and queried the Commissioner’s failure either to uphold
or to dismiss the Complaint. The letter stated:

“If the Commissioner's position is that the ‘outcome’ has been
reached and nothing more will be done, despite the systemic
problems you have found, our clients will challenge that decision as
inconsistent with the Commissioner’s obligations under Article 77
GDPR and s.165 DPA 2018. If, on the other hand, the
Commissioner's position is that the substance of the complaints is
going to be addressed by way of further industry-wide investigation,
then our clients have a subsisting right to be kept informed about the
progress of that further investigation.

Please therefore confirm if the position is that the “outcome” of the
complaint is that no further action will be taken to protect the rights of
our clients and other data subjects in response to the complaint and

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

to that extent the complaint is rejected/dismissed. Alternatively, if (as
seems to be the true position), the Commissioner has decided that
the case requires further investigation and action by way of
recommencing the industry-wide investigation into RTB, please
confirm that the complaint therefore properly remains open, with a
corresponding right for our clients to be kept informed of progress”.

21. In response, the Commissioner maintained her position and confirmed on 23 September
2020 that she considered her “obligations to [your clients] in respect of Article 77 and
section 165 DPA have been discharged”. She added:

“We do intend to recommence our industry wide investigation in RTB
in due course. Whilst we do not accept that there is any legal
requirement for us to continue to keep your clients updated we will,
as a matter of courtesy given their longstanding interest in this area,
advise when that takes place and provide a link to our relevant public
facing statement at that time”.

22. Mr Killock and Dr Veale lodged the present application on 21 October 2020. On 22
January 2021, the Commissioner announced that she had recommenced her industry-
wide investigation of RTB. Thus, the investigation into the substantive matters raised by
Mr Killock and Dr Veale in the Complaint remains ongoing, even though the
Commissioner maintains that their complaint has been closed.

The Commissioner’s Service Standards

23. In EW’s case, it is important to note the Commissioner’s Service Standards which, so far
as material, state:

“We want to know how organisations are doing when they are
handling information rights issues. We also want to improve the way
they deal with the personal information they are responsible for.
Reporting your concerns to us will help us to do that.

Before reporting a concern to us, we expect you to give the
organisation the opportunity to consider it first. In order for us to look
at their information rights practices we need you to provide us with
their reply.

Where appropriate, we will give you advice about how we think the
law applies to your issue or concern. We aim to reach an outcome in
90% of concerns cases within six months.

If you do want to raise concerns about an organisation then we
suggest that you do so within three months of receiving their final
response to the issues raised. Waiting longer than that can affect the
decisions that we reach. In some cases an undue delay will mean
that we will not consider the matter at all.

Our role is not to investigate or adjudicate on every individual
complaint. We are not an ombudsman. But we will consider whether

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

there is an opportunity to improve the practice of the organisations
we regulate and we will share our decisions with you.

It is up to us to decide whether or not we should take further action.
Even where we decide that further action is not required at the
moment, perhaps because the organisation has made a mistake but
is working to put things right, we will keep concerns on file. This will
help us over time to build a picture of an organisation’s information
rights practices.

We may ask organisations to explain to us what they have done in
response to issues or concerns raised. We will publish details of
improvements and give you the opportunity to sign up to our
newsletter, giving regular updates of the action we are taking.

If you are seeking personal redress or compensation for the way an
organisation has dealt with your personal information, you will need
to pursue this independently through the courts or with an industry's
own ombudsman or regulatory body”.

The facts

24. On 18 June 2018 EW filed a subject access request (“SAR”) with the relevant local
authority (“the Council”) seeking his “full health and social care file … as well as [his]
school records”. On 10 July 2018, the Council refused the SAR. The Council’s decision
letter cited a review of the SAR by “[a] social work professional” and declined to provide
the information sought “under the exemptions provided under Schedule 3 Part 3 of the
[DPA] because sharing of [EW’s] social care data is likely to cause serious harm to [his]
physical or mental health”. On 30 November 2018, he filed a second SAR with the
Council. He sought all data held by the Council about himself.

25. On 8 January 2019, the Council refused the second SAR on essentially the same basis
as in its refusal of 10 July 2018, attaching its letter of that date. On 25 May 2019, EW
wrote to the Council requesting an internal review of the Council’s refusal of the two
SARs which he had filed. On 10 June 2019, EW filed a complaint with the Commissioner
in relation to the Council’s refusal of his SARs. By way of supporting evidence, he
provided the Commissioner on 13 June 2019 with (i) the Council’s email and letter of 10
July 2018 and (ii) relevant email correspondence from 15-16 August 2018. He also
provided a further complaints form, but not his original SAR.

26. On 25 June 2019, the Commissioner declined to investigate EW’s complaint. The
Commissioner’s email stated (so far as material) as follows:

“The ICO Service Standards advise that if you wish to raise
complaints about an organisation then this must be done within three
months of receiving their final response to the issues raised.

Waiting longer than that can affect the decisions that we reach. In
some cases an undue delay will mean that we will not consider the
matter at all.

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

your concerns will be logged and kept on file as this will help us over
time to build a picture of [the] Council’s information rights practices.”

27. On the same day, EW spoke to the Commissioner’s representative on the telephone.
The Commissioner’s note of that telephone call states that:

“NOTE: call received from [data subject] to discuss my letter. Advised
[as] last correspondence from [the Council] is Aug 2018 we cannot
look into this complaint further (over 3 months). Advised [data
subject] to raise complaint with [the Council] again and if he still has
concerns when he receives response he can bring this to the ICO’s
attention.”

28. On a date between 10 June 2019 and 7 August 2019, EW filed a third SAR with the
Council. He again sought all data held by the Council about himself. On 29 August 2019,
the Council refused his third SAR on essentially the same basis as in its two earlier
refusals. On 2 April 2020, EW filed a second complaint with the Commissioner. The
complaint stated materially as follows:

“What is your complaint? The public body has not responded to my
request for an internal review, or has refused to conduct an internal
review. I disagree with the public body’s refusal to provide the
information I requested…

Please give details I have applied to [the Council] twice now; once
in 2018 and the other in 2019 for access to my records. This has
been refused and the [Council] cannot refuse to supply me with my
records as ultimately they are mine. The [Council] have provided me
with the same letter dated 10th July 2018 on both occasions and have
asserted that it was a social work Team Manager who had taken this
decision. Please also see Case [ENQ0849804]. I do not have my
Subject Access Request form but I do have the letter as
aforementioned. I requested internal review but this was ignored.”

29. By way of supporting evidence, EW provided the Commissioner with (i) his letter to the
Council of 25 May 2019 (which the Commissioner had not seen before) and (ii) a further
copy of the Council’s letter of 10 July 2018. On 9 April 2020 the Commissioner declined
to investigate EW’s second complaint. The Commissioner’s email stated (so far as
material):

“We understand that you have concerns that [the] Council have not
properly responded to your subject access request. We note that you
also raised this complaint with the ICO on 10 June 2019.

We wrote to you on 25 June 2019 to advise that the ICO Service
Standards advise that if you wish to raise complaints about an
organisation then this must be done within three months of receiving
their final response to the issues raised. In your original complaint the
latest correspondence you provided was dated 16 August 2018. We
therefore wrote to you to advise that based on the delay in bringing
your complaint to the ICO, we were unable to consider your
complaint further.

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

We note that you sent a new complaints form to the ICO on 3 April
2020 and the latest correspondence you have provided is dated 25
May 2019. Taking into account this delay we do not intend to take
any further action in relation to this matter. However, your concerns
will be logged and kept on file as this will help us over time to build a
picture of [the] Council’s information rights practices.”

30. Following those events, on 17 April 2020 EW (at this stage a litigant in person) issued an
application against the Commissioner in the GRC in connection with the Commissioner’s
decision of 9 April 2020. The application originally requested that the GRC “order [the
Council] to give [him] his records, or order the [Commissioner] to make the
recommendation to [the Council to give [him] his records”. However, the nature of the
application has been refined. In particular, EW has clarified that the remedy sought from
the Tribunal against the Commissioner is an order under s.166 DPA 2018 “ordering the
[Commissioner] to take appropriate steps to respond to the Complaint raised by me to
them against [the Council]” (submissions of 13 May 2020, para 8) and, more specifically,
an order “to require [the ICO] to investigate the … complaint against [the Council] …”
(submissions of 2 July 2020, para 11).

31. Against that background, Judge O’Connor directed that the proceedings be transferred
as proposed. The reasons for this transfer were subsequently identified by Upper
Tribunal Judge Wikeley as being:

“so that the [Upper Tribunal] might provide authoritative guidance as
to (i) the extent of the Commissioner’s obligation to investigate a
complaint made by a data subject under [DPA] sections 165 and 166;
and (ii) the rights of children and young persons under the DPA 2018
and GDPR.”

32. In the event, it has not been necessary or even desirable for the Upper Tribunal to deal
in detail with the rights of EW as a child in the proceedings before us. The Commissioner
accepts that, for the purposes of the present case, EW’s age is not relevant to his rights
under the DPA and GDPR. Before us, he has had the excellent assistance of Mr
Rabinowitz. The flexibility of tribunal proceedings and tribunal procedure rules has meant
that we have not needed to direct any particular steps (other than anonymisation) to
protect EW’s right to respect for private life or any particular steps to secure his effective
participation in the proceedings. (He has recently attained his majority.) The key legal
issue in dispute in EW’s case concerns the extent of the Commissioner’s obligation to
investigate his complaint.

Coghlan

33. Mrs Coghlan appeals on behalf of C against the decision of the GRC (Judge Moira
Macmillan) dated 31 July 2020 upholding the earlier decision of a Registrar to refuse to
extend time to make a s.166 application. In that application, Mrs Coghlan had sought an
order requiring the Commissioner to take appropriate steps to investigate her complaint
about the London Borough of Hillingdon (“LBH”).

34. C is a vulnerable young adult with Down’s Syndrome. On 10 October 2019, LBH sent a
Court of Protection application concerning C to Mrs Coghlan at her request, including a
large quantity of special category personal data. This was not sent by Egress – LBH’s
encrypted email service – nor was C’s identity anonymised. It is C’s case that the data –
which went to the core of his personhood – was thereby vulnerable to interception. On
his behalf, Mrs Coghlan says that this violated articles 5(1)(f) and 32 GDPR as read in

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

light of relevant Commissioner and other guidance, as well as LBH’s own data security
policy. Mrs Coghlan complained to LBH. In response, LBH argued that their email
systems were secure and that there was no legal obligation to password-protect or
encrypt emailed documents.

35. On 30 October 2019 Mrs Coghlan complained to the Commissioner on behalf of her son.
On 11 December 2019 the Commissioner reviewed the correspondence and declined to
investigate, adopting LBH’s position, namely that there was no legal requirement on data
controllers to encrypt data, there was no evidence to suggest that LBH’s email system
was insecure, and there was no evidence that C’s personal data had been compromised
as a result of the email. The next day Mrs Coghlan replied, contending that that analysis
was flawed.

36. On 6 February 2020 the Commissioner repeated the claim that the GDPR did not require
encryption. It was stated that the Commissioner could only investigate if there were
evidence that a third party had actually accessed the information. Mrs Coghlan disputed
that on 10 February 2020, contending the decision not to investigate was legally wrong
and that it was inconsistent with relevant guidance and the Commissioner’s previous
decisions. She noted that the Commissioner had failed to identify the judicial remedy
against its investigation and decision (as required by article 77(2) GDPR) and asked that
there be compliance with it.

37. On 18 February 2020 the Commissioner repeated her position, but added that the next
step was a case review which would “not necessarily” review the decision itself. On the
same day Mrs Coghlan informed the Commissioner that she would proceed to a judicial
remedy and requested that she be informed what this was in order to enable her to do
so. On 19 February 2020 the Commissioner stated the judicial remedy was judicial
review, but also that the ICO’s case review mechanism must be exhausted first.

38. On 19 April 2020 Mrs Coghlan sent a detailed application for a review. In particular this
drew the Commissioner’s attention to LBH’s own security policy which required
encryption when sending “very personal or large amounts of sensitive data”. On 29 May
2020 the Commissioner approved her own earlier decision not to investigate. The email
appears to contain one change from February: the Commissioner now asserted (or
appears to have asserted, in a somewhat confusing piece of prose) that no judicial
remedy existed against the decision because the outcomes of complaints were “not
legally binding, they are the Commissioner’s opinion” and therefore fell outside article
78(1) GDPR.

39. The time limit for bringing s.166 proceedings had expired by the time that C’s mother had
brought them on his behalf on 26 June 2020, seeking an order that the Commissioner
should take appropriate steps to investigate and, as appropriate, remedy LBH’s alleged
breaches of the GDPR.

40. On 1 July 2020 the application for an extension of time was refused by a Registrar of the
GRC. On 5 July 2020 Mrs Coghlan applied for a reconsideration of that decision under
Rule 4(3) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber)
Rules 2009 (“the GRC Procedure Rules”). On 31 July 2020 Judge Macmillan upheld the
Registrar’s decision. She applied the principles set out in Data Select Limited v HMRC
[2012] UKUT 187 (TCC) and held that:

i. Although the period of delay was significant, there was no requirement for an
application to the Tribunal at an earlier stage because the Commissioner was
progressing his complaint;

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

ii. C had provided an explanation for the delay: he did not make an earlier
application because the Commissioner was progressing his complaint and his
application was made within 28 days of the Commissioner’s final review; but

iii. C had “already received that which the Tribunal could Order under s.166(2). This
is because the [Commissioner] has already considered and responded to his
complaint.” There was no room for procedural review and “no Order the Tribunal
can make” where an applicant had received a response to his complaint. The
matter was accordingly closed. In light of the ruling in Scranage v Information
Commissioner [2020] UKUT 196 (AAC), s.166 could not be read more widely to
include substantive review.

41. Judge Macmillan granted permission to appeal in respect of ground two of the grounds
of appeal before her, namely the compatibility of the Tribunal’s interpretation of s.166
with other GDPR principles. Permission for ground one (equating the Commissioner’s
response to the complaint with a procedurally adequate response) was granted on 15
December 2020 by Upper Tribunal Judge Wikeley.

UK General Data Protection Regulations (“UK GDPR”)

42. It was not in dispute before us that, for present purposes, there is no material difference
between the EU General Data Protection Regulation (Regulation (EU) 2016/679 of 27
April 2016) and the UK GDPR which has had effect since 31 December 2020. We shall
therefore focus on the latter while recognising that retained EU law applies.

43. Recital 141 of the UK GDPR (so far as material) states:

“Every data subject should have the right to lodge a complaint with a
single supervisory authority, in particular in the Member State of his
or her habitual residence, and the right to an effective judicial remedy
in accordance with Article 47 of the Charter if the data subject
considers that his or her rights under this Regulation are infringed or
where the supervisory authority does not act on a complaint, partially
or wholly rejects or dismisses a complaint or does not act where such
action is necessary to protect the rights of the data subject. The
investigation following a complaint should be carried out, subject to
judicial review, to the extent that is appropriate in the specific case.
The supervisory authority should inform the data subject of the
progress and the outcome of the complaint within a reasonable
period…”

44. By Recital 143 (so far as material) it is provided that

“…each natural or legal person should have an effective judicial
remedy before the competent national court against a decision of a
supervisory authority which produces legal effects concerning that
person. Such a decision concerns in particular the exercise of
investigative, corrective and authorisation powers by the supervisory
authority or the dismissal or rejection of complaints … Proceedings
against a supervisory authority should be brought before the courts
of the Member State where the supervisory authority is established
and should be conducted in accordance with the Member State’s
procedural law. Those courts should exercise full jurisdiction, which

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

should include jurisdiction to examine all questions of fact and law
relevant to the dispute before them…”

45. Article 57 states (so far as material) that the Commissioner must

“(f) handle complaints lodged by a data subject … and investigate, to
the extent appropriate, the subject matter of the complaint and inform
the complainant of the progress and the outcome of the investigation
within a reasonable period, in particular if further investigation or
coordination with a foreign designated authority is necessary.”

46. The effect of article 57 is that the Commissioner must handle complaints from data
subjects “with all due diligence” (Data Protection Commissioner v Facebook Ireland Ltd
[2021] 1 WLR 751, para 109, Court of Justice of the European Union).

47. Article 77 provides the right to lodge a complaint with the Commissioner:

“1. Without prejudice to any other administrative or judicial remedy,
every data subject shall have the right to lodge a complaint with a
supervisory authority, in particular in the Member State of his or her
habitual residence, place of work or place of the alleged infringement
if the data subject considers that the processing of personal data
relating to him or her infringes this Regulation.

2. The Commissioner shall inform the complainant on the progress
and the outcome of the complaint including the possibility of a judicial
remedy pursuant to Article 78.”

48. Article 78 provides the right to an effective judicial remedy against the Commissioner:

“1. Without prejudice to any other administrative or non-judicial
remedy, each natural or legal person shall have the right to an
effective judicial remedy against a legally binding decision of the
Commissioner concerning them.

2. Without prejudice to any other administrative or non-judicial
remedy, each data subject shall have the right to an effective judicial
remedy where the Commissioner does not handle a complaint or
does not inform the data subject within 3 months on the progress or
outcome of the complaint lodged pursuant to Article 77.”

49. Article 79 provides the right to an effective judicial remedy against a data controller or
processor

“1. Without prejudice to any available administrative or non-judicial
remedy, including the right to lodge a complaint with the
Commissioner pursuant to Article 77, each data subject shall have
the right to an effective judicial remedy where he or she considers
that his or her rights under this Regulation have been infringed as a
result of the processing of his or her personal data in non-compliance
with this Regulation.”

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

Charter of Fundamental Rights

50. Mrs Coghlan relied on article 8 of the Charter of Fundamental Rights (“CFR”) which
provides (so far as material):

“Protection of personal data

1. Everyone has the right to the protection of personal data
concerning him or her.

2. Such data must be processed fairly for specified purposes and on
the basis of the consent of the person concerned or some other
legitimate basis laid down by law. Everyone has the right of access to
data which has been collected concerning him or her, and the right to
have it rectified.

3. Compliance with these rules shall be subject to control by an
independent Authority.”

51. The Commissioner has pointed out that the CFR is no longer part of English law under
s.5 of the European Union Withdrawal Act 2018. We shall return to its effect below but
observe here that it raises no real or discrete dispute.

Data Protection Act 2018

52. S. 165 DPA provides, so far as material:

“165 Complaints by data subjects

(1) Articles 57(1)(f) and (2) and 77 of the GDPR (data subject's right
to lodge a complaint) confer rights on data subjects to complain to
the Commissioner if the data subject considers that, in connection
with personal data relating to him or her, there is an infringement of
the GDPR.

(2) A data subject may make a complaint to the Commissioner if the
data subject considers that, in connection with personal data relating
to him or her, there is an infringement of Part 3 or 4 of this Act.

…

(4) If the Commissioner receives a complaint under subsection (2),
the Commissioner must—

(a) take appropriate steps to respond to the complaint,

(b) inform the complainant of the outcome of the complaint,

(d) if asked to do so by the complainant, provide the complainant with
further information about how to pursue the complaint.

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

(5) The reference in subsection (4)(a) to taking appropriate steps in
response to a complaint includes—

(a) investigating the subject matter of the complaint, to the extent
appropriate, and

(b) informing the complainant about progress on the complaint,
including about whether further investigation or co-ordination with
another supervisory authority or foreign designated authority is
necessary.”

53. S. 166 provides:

“166 Orders to progress complaints

(1) This section applies where, after a data subject makes a
complaint under section 165 or Article 77 of the GDPR, the
Commissioner—

(a) fails to take appropriate steps to respond to the complaint,

(b) fails to provide the complainant with information about progress
on the complaint, or of the outcome of the complaint, before the end
of the period of 3 months beginning when the Commissioner
received the complaint, or

(c) if the Commissioner's consideration of the complaint is not
concluded during that period, fails to provide the complainant with
such information during a subsequent period of 3 months.

(2) The Tribunal may, on an application by the data subject, make an
order requiring the Commissioner—

(a) to take appropriate steps to respond to the complaint, or

(b) to inform the complainant of progress on the complaint, or of the
outcome of the complaint, within a period specified in the order.

(3) An order under subsection (2)(a) may require the
Commissioner—

(a) to take steps specified in the order;

(b) to conclude an investigation, or take a specified step, within a
period specified in the order.

(4) Section 165(5) applies for the purposes of subsections (1)(a) and
(2)(a) as it applies for the purposes of section 165(4)(a).”

54. S. 167 of the DPA provides a remedy for infringement of a data subject’s substantive
rights in the form of a compliance order:

“167 Compliance orders

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

(1) This section applies if, on an application by a data subject, a court
is satisfied that there has been an infringement of the data subject's
rights under the data protection legislation in contravention of that
legislation.

(2) A court may make an order for the purposes of securing
compliance with the data protection legislation which requires the
controller in respect of the processing, or a processor acting on
behalf of that controller—

(a) to take steps specified in the order, or

(b) to refrain from taking steps specified in the order.

(3) The order may, in relation to each step, specify the time at which,
or the period within which, it must be taken.

(4) In subsection (1)—

(a) the reference to an application by a data subject includes an
application made in exercise of the right under Article 79(1) of the
GDPR (right to an effective remedy against a controller or processor)
…”

55. Ss.168 and 169 DPA provide rights to compensation for contravention of the GDPR and
other data protection legislation. The schemes for compliance orders and for
compensation are separate from the scheme for orders to progress complaints. By
express statutory wording, compliance orders and compensation are a matter for courts
and not tribunals.

56. As regards the case law, the First-tier Tribunal considered the meaning of s.166 for the
first time in Platts v Information Commissioner EA/2018/0211/GDPR. The applicant had
complained to the GRC that the Commissioner had not fully completed her assessment
and had failed to provide him with information about the availability of an order to
progress his complaint. The GRC dismissed the application for an order under s.166
because it concluded that the Commissioner had taken appropriate steps to respond to
the complaint in a timely manner, and had addressed the matters set out in s.166(1)(a),
(b) and (c) (para 12). The GRC stated at para 13:

“… we agree with the Commissioner that s.166 DPA 2018 does not
provide a right of appeal against the substantive outcome of an
investigation into a complaint under s.165 DPA 2018.”

57. The Upper Tribunal first considered s.166 in Leighton v Information Commissioner (No.2)
GIA/1399/2019. Mr Leighton was dissatisfied with the Commissioner’s decision that
North Yorkshire Police had complied with its obligations to him under the DPA. He
applied to the First-tier Tribunal for an order under s.166. The Commissioner sought a
strike out, which the Registrar and then the Judge, on reconsideration, granted. The
Upper Tribunal refused permission to appeal with detailed reasons.

58. Judge Wikeley held:

“[22] Thus, if the Commissioner fails in any of the ways identified in
section 166(1), the data subject has the statutory right to apply to the

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

FTT under section 166(2) for an order requiring the Commissioner to
act as set out there. However, sections 165 and 166 (which fall under
the general cross-heading of ‘Complaints’) cannot be read in isolation
from the rest of Part 6 (Enforcement) of the DPA 2018. In particular,
the immediately following three sections (ss.167-169) appear
beneath the cross-heading ‘Remedies in the court’. Those are
compliance orders (s.167), compensation for breach of the GDPR
(s.168) and compensation for breach of other data protection
legislation (s.169). Thus, if ‘a court is satisfied that there has been an
infringement of the data subject's rights under the data protection
legislation in contravention of that legislation’ (s.167(1)) then the
court may make a compliance order. Notably, this is a power vested
in ‘a court’ and not ‘the Tribunal’ – the jurisdiction to make such
compliance orders is exercisable not by the FTT but by either the
High Court or the county court (in England & Wales, at least): see
DPA 2018 section 180(1) and (2)(d).The same is true as regard
orders under sections 168 and 169 (see DPA 2018 section
180(2)(e)).

…

[27] … GDPR Article 77 gives data subjects the right to lodge a
complaint with the national supervisory authority (here the ICO), a
right given effect in domestic law by DPA 2018 section 165. GDPR
Article 78.2 then gives data subjects the right to an ‘effective judicial
remedy’ where that supervisory authority either does not handle a
complaint or inform the data subject of the progress or outcome of
the complaint within 3 months, a right given effect in domestic law by
DPA 2018 section 166. It is true that Article 78.1 also gives personal
a right to an effective judicial remedy ‘against a legally binding
decision of a supervisory authority concerning them’, but that does
not give Mr Leighton a freestanding right to challenge the underlying
substantive merits of the Information Commissioner’s decision on his
complaint (given the courts’ jurisdiction to provide remedies under
section 167-169 and the fall-back availability of judicial review
against the Commissioner in the absence of any other avenue of
challenge).”

59. Judge Wikeley considered that the First-tier Tribunal had been “right as a matter of legal
analysis” in Platts:

“[31] I note that in Platts…the FTT accepted a submission made on
behalf of the Commissioner that ‘s.166 DPA 2018 does not provide a
right of appeal against the substantive outcome of an investigation
into a complaint under s.165 DPA 2018’ (at paragraph [13]).Whilst
that is a not a precedent setting decision, I consider that it is right as
a matter of legal analysis. Section 166 is directed towards providing a
tribunal-based remedy where the Commissioner fails to address a
section 165 complaint in a procedurally proper fashion. Thus, the
mischiefs identified by section 166(1) are all procedural failings.
‘Appropriate steps’ must mean that, and not an ‘appropriate
outcome’. Likewise, the FTT’s powers include making an order that
the Commissioner ‘take appropriate steps to respond to the
complaint’, and not to ‘take appropriate steps to resolve the

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

complaint’, least of all to resolve the matter to the satisfaction of the
complainant. Furthermore, if the FTT had the jurisdiction to
determine the substantive merits of the outcome of the
Commissioner’s investigation, the consequence would be
jurisdictional confusion, given the data subject’s rights to bring a civil
claim in the courts under sections 167-169 (see further DPA 2018 s.
180).”

60. Judge Wikeley considered s.166 again in Scranage v Information Commissioner [2020]
UT 196 (AAC). He observed at para 6:

“In my experience – both in the present appeal and in many other
cases – there is a widespread misunderstanding about the reach of
section 166. Contrary to many data subjects’ expectations, it does
not provide a right of appeal against the substantive outcome of the
Information Commissioner’s investigation on its merits. Thus, section
166(1), which sets out the circumstances in which an application can
be made to the Tribunal is procedural rather than substantive in its
focus. This is consistent with the term of Article 78(2) of the GDPR
(see above). The prescribed circumstances are where the
Commissioner fails to take appropriate steps to respond to a
complaint, or fails to update the data subject on progress with the
complaint or the outcome of the complaint within three months after
the submission of the complaint, or any subsequent three month
period in which the Commissioner is still considering the complaint.”

GRC Procedure Rules

61. By virtue of Rule 22(1) of the GRC Procedure Rules, an appellant must start proceedings
before the Tribunal by sending or delivering to the Tribunal a notice of appeal. Rule
22(6)(f) provides the time limit for applications to the First-tier Tribunal under s.166:

“(6) The time for providing the notice of appeal…is as follows …

(f) in the case of an application under section 166(2) of the Data
Protection Act 2018 (orders to progress complaints), within 28 days
of the expiry of six months from the date on which the Commissioner
received the complaint.”

The parties’ submissions

62. On behalf of Mr Killock and Dr Veale, Ms Maya Lester QC with Ms Julianne Kerr
Morrison and Mr Nikolaus Grubeck (and with Mr Gerry Facenna QC in writing) submitted
that the object and purpose of articles 77 and 78 GDPR – and therefore of ss.165 and
166 DPA – was to provide data subjects with specific and concrete rights which permit
them to hold supervisory authorities (such as the Commissioner) to account for any
failure to act appropriately in response to their complaints. Recital 141 expressly
provides that complainants are entitled to an effective remedy where the Commissioner
“does not act on a complaint” and envisages updates extending to substantive matters
such as “further investigation”. Article 78 provides specifically a judicial remedy obliging
the supervisory authority to act on a complaint both by dealing with the complaint and by
keeping the data subject informed of its progress. In making these submissions, Ms
Lester relied on the legislative history of Article 78 which built on rights to an effective

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

remedy under Article 28 of the Directive which it replaced. We do not need to set out that
history because, so far, we do not discern any material dispute between the parties.

63. Ms Lester submitted that the duty of the Tribunal to provide an effective remedy in
relation to the handling of complaints (as opposed to their substantive outcome) should
not be reduced to a formalistic remedy but should provide an effective remedy –
compelling the Commissioner to act appropriately in response to a complaint - where the
Commissioner has failed to comply with her obligations. The wording of s.165 of the
2018 Act imposes what Ms Lester called “substantive obligations on the ICO”. S.165(4)
requires the Commissioner to “take appropriate steps to respond to the complaint”.
S.165(5) confirms that the obligation to take appropriate steps includes “(a) investigating
the subject matter of the complaint to the extent appropriate”. The Tribunal in turn is
empowered to provide a substantive remedy by ordering the Commissioner to take
appropriate steps to respond to the complaint as well as to inform the complainant of
progress or of the outcome of the complaint.

64. On behalf of Mrs Coghlan, Mr Daniel Black emphasised the wording of the statutory
provisions. On their literal meaning, ss.165 and 166 provide a remedy where the
Commissioner fails to “take appropriate steps” or investigate “to the extent appropriate”.
That is objective language. The Tribunal is required to assess the Commissioner’s
investigation to an objective legal standard. The objective standard is reflected in Judge
Wikeley’s interpretation of s.166 as encompassing a failure by the Commissioner to
address a complaint “in a procedurally proper fashion” (Leighton (No 2), para 31).

65. Mr Black submitted that that literal interpretation aligns with three features of the broader
statutory regime. First, the remedy corresponds verbatim to the Commissioner’s
statutory obligation to investigate complaints (“shall”) by reference to an objective
standard (“appropriate”): article 57(1)(f) GDPR. Second, the effective remedy required by
article 78 GDPR is not limited to cases of (on the one hand) complete inaction within
three months or (on the other hand) the substantive outcome. The conduct of the
investigation itself must be the subject of an effective remedy. This is clear from Recital
141, which states that an investigation following a complaint should be carried out,
subject to judicial review, “to the extent that is appropriate in the specific case”. Third,
the Commissioner may refuse to act on a request or to charge a reasonable fee where it
is “manifestly unfounded or excessive”: article 57(4) GDPR and s.135 DPA. This would
be otiose if the Commissioner enjoyed an unfettered discretion to consider that no or
very limited steps were appropriate. In reality, the statutory scheme prescribes and limits
the Commissioner’s – already residual – discretion to refuse to act on a request.

66. Mr Black relied also on an argument based on the fundamental rights of data subjects to
control by the supervisory authority (article 8(3) CFR) and to an effective judicial remedy
(article 47 CFR). Those rights would become theoretical and illusory if the main question
– the objective appropriateness of the steps the Commissioner has taken to respond to a
complaint – were carved out from this judicial remedy. Clear words would be needed to
erode this rights-based edifice and s.166 does not have them.

67. On behalf of EW, Mr Rabinowitz emphasised that the provisions of s.165 do not impose
a duty on the Commissioner to investigate to the extent that she considers appropriate
but rather impose a duty to investigate “to the extent appropriate”. Naturally interpreted,
a requirement to do what is “appropriate” is a requirement to do what is objectively
reasonable in all the circumstances. The statutory scheme in ss.165 and 166 envisages
that the Tribunal is entitled to and capable of determining the objective question of what
is appropriate in a given case.

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

68. More particularly, Mr Rabinowitz submitted that the jurisdiction of the Tribunal to make
an order under s.166 will frequently depend on its assessment of whether the
Commissioner has investigated a complaint to the extent appropriate. The Tribunal is
empowered to make an order under s.166 where the Commissioner “fails to take
appropriate steps to respond to the complaint” (s.166(1)(a)), which includes a failure to
“investigat[e] the subject matter of the complaint, to the extent appropriate” (ss. 166(4)
and 165(5)). The Tribunal must be entitled to determine for itself whether the
Commissioner’s conduct is such as to trigger that jurisdiction. The particular remedies
which the Tribunal is entitled to grant under s.166 assume that it is capable of
determining what would be “appropriate” in a given case. The Tribunal is empowered to
require the Commissioner to take “appropriate steps to respond to the complaint”
(s.166(2)(a)), which steps the Tribunal is entitled to specify in the order” (s.166(3)(a)).

69. On behalf of the Commissioner, Mr Julian Milford QC and Ms Harini Iyengar submitted
that article 78 UK GDPR lays down substantive (article 78(1)) and procedural rights
(article 78(2)). As the Explanatory Notes to the DPA state at para 40, s.166 “is a new
provision and had no equivalent in the 1998 Act. It reflects the rights set out in Article
78(2) of the GDPR.” S.166 is intended to implement in domestic law the rights conferred
by article 78(2) to an effective judicial remedy, where the competent supervisory
authority “does not handle a complaint or does not inform the data subject promptly on
the progress or outcome of the complaint lodged pursuant to Article 77”.

70. Mr Milford submitted that article 78(2) is a remedy for inaction. In terms, it provides
redress where a complaint has not been “handled”, or the complainant has not been
informed of the outcome. It is not intended to impose a requirement that domestic courts
should second-guess the regulatory choices of supervisory authorities as to how they
choose to investigate complaints. Still less does it provide a right of appeal against the
complaint outcome. Rather, any challenge to the outcome of the complaint falls within
article 78(1). Where a supervisory authority has acted promptly, has concluded it has
sufficient information to determine a complaint, and has done so, article 78(2) has no
purchase.

71. On well-established principles, s.166 DPA should be interpreted in light of the wording
and purpose of the EU law provision which it implements. There is no difficulty in reading
s.166 conformably with article 78(2). The language of s.166 is clearly directed at
providing a remedy for failure to progress complaints, or to keep complainants informed,
rather than a remedy against the complaint outcome, or indeed an allegedly inadequate
investigative process.

72. Mr Milford submitted that Platts, Leighton and Scranage are correct, for the reasons they
give. The language of s.166 is clear. Any right of appeal against the outcome of a
complaint would lead to the “jurisdictional confusion” to which Leighton (at para 31)
refers, in circumstances where ss.167-169 DPA provide a complainant who considers
that his or her data protection rights have been contravened with a right to bring a civil
claim before the courts.

73. If the Tribunal itself were to decide what an “appropriate” investigation should comprise,
that would seriously undermine the Commissioner’s regulatory discretion. As the expert
regulator, the Commissioner is in the best position to decide what investigations she
should undertake into any particular issue, and how she should conduct those
investigations. Such decisions will be informed not only by the nature of a complaint
itself, but also by a range of other factors of which the Tribunal will have no or only
second-hand knowledge, including, for example, (i) the Commissioner’s regulatory
priorities; (ii) other investigations that the Commissioner may have undertaken in the

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

same subject area; (iii) the Commissioner’s judgment on how to deploy her limited
resources most efficiently and effectively. The effect of the other parties’ submissions
would be that the Tribunal would trespass upon the Commissioner’s complex
judgements about how best to balance the respective rights and interests of data
subjects, controllers and processors in a wide variety of different circumstances.

Analysis and discussion

74. The remedy in s.166 is limited to the mischiefs identified in s.166(1). We agree with
Judge Wikeley’s conclusion in Leighton (No 2) that those are all procedural failings.
They are (in broad summary) the failure to respond appropriately to a complaint, the
failure to provide timely information in relation to a complaint and the failure to provide a
timely complaint outcome. We do not need to go further by characterising s.166 as a
“remedy for inaction” which we regard as an unnecessary gloss on the statutory
provision. It is plain from the statutory words that, on an application under s.166, the
Tribunal will not be concerned and has no power to deal with the merits of the complaint
or its outcome. We reach this conclusion on the plain and ordinary meaning of the
statutory language but it is supported by the Explanatory Notes to the Act which regard
the s.166 remedy as reflecting the provisions of article 78(2) which are procedural. Any
attempt by a party to divert a Tribunal from the procedural failings listed in s.166 towards
a decision on the merits of the complaint must be firmly resisted by Tribunals.

75. We do not accept that the limits of s.166 mean that the rights of data subjects are not
protected to the extent required by the GDPR or by the CFR. Infringement of rights under
data protection legislation is remediable in the courts (ss.167-169 DPA). In addition, if a
data subject decides to complain to the Commissioner, s.166 provides procedural
protections in order to ensure that the complaint receives appropriate, timely and
transparent consideration. The Tribunal as a judicial body has expertise in procedural
matters. It is therefore apt for a Tribunal to provide a remedy against procedural failings
in complaints handling.

76. The Tribunal does not have the same expertise in determining the appropriate outcome
of complaints. The Commissioner is the expert regulator. She is in the best position to
consider the merits of a complaint and to reach a conclusion as to its outcome. In so far
as the Commissioner’s regulatory judgments would not and cannot be matched by
expertise in the Tribunal, it is readily comprehensible that Parliament has not provided a
remedy in the Tribunal in relation to the merits of complaints.

77. This does not leave data subjects unprotected. If the Commissioner goes outside her
statutory powers or makes any other error of law, the High Court will correct her on
ordinary public law principles in judicial review proceedings. The combination of a
statutory remedy in the Tribunal in relation to procedures and to the supervision of the
High Court in relation to substance provides appropriate and effective protection to
individuals. It does not require us to strain the language of s.166 to rectify any lack of
protection or to correct any defect in Parliament’s enactment of the UK’s obligations to
protect an individual’s data.

78. Mr Black submitted that the interpretation of s.166 as a purely procedural provision
would breach the principles of equivalence and effectiveness in EU law from which the
rights in s.166 are derived. As to equivalence, almost all remedies against the
Commissioner’s decisions in respect of information law were before the specialist
Tribunal system. All parties’ remedies against a Commissioner’s decision notice (s.57 of

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

the Freedom of Information Act 2000), which were equivalent within the meaning of EU
law, were among those remedies. By contrast, judicial review proceedings were clearly
less favourable than Tribunal proceedings given their cost, costs risk and representation
rules. A narrow interpretation would thus violate equivalence. Higher fees, the costs
burden and the procedural complexity of judicial review proceedings constitute a
restriction on the right to an effective remedy under article 47 CFR. Excluding a Tribunal
remedy for substantive wrongs would constitute a disproportionate interference with the
right to an effective remedy and (in Mr Black’s words) “render it excessively difficult and
so breach effectiveness.”

79. We disagree. As Mr Milford expressed the point in his skeleton argument, the principle of
equivalence requires that procedure and remedies for claims derived from EU law should
be no less favourable than those which apply to similar actions of a domestic nature. If
there is no true comparator, the principle of equivalence has no operation (Totel Ltd v
Revenue and Customs Commissioners [2018] UKSC 44, [2018] 1 WLR 4053, para 7).
The question whether a proposed domestic claim is a true comparator with an EU claim
is context-specific and the domestic court must consider the purpose and essential
characteristics of allegedly similar domestic actions (Totel, paras 8-10). The purpose and
essential characteristics of an appeal under s.57 FOIA are obviously different from those
of a challenge to a complaint outcome under article 77. An appeal is brought under s.57
against a decision notice under s.50 FOIA. A decision notice is a statutory notice which
declares the legal rights of the parties and might order the public authority receiving it to
take steps to communicate specified information. By contrast, a complaint outcome itself
has no compulsive force and does not order anyone to do anything. To the extent that
the Commissioner decides to use her enforcement powers as a result of a complaint,
that would be through the use of orders against which statutory rights of appeal lie.

80. We do not accept that higher fees render access to justice in the High Court ineffective
and no evidence to that effect was provided to us. Nor do we accept that effectiveness
requires the Tribunal to be treated as the resort of those who seek to avoid adverse
costs awards in the courts. In the contemporary era, judicial review proceedings are not
necessarily more complex than Tribunal proceedings with their detailed procedure rules.

81. The EU-derived context does not mean that judicial review is not an effective remedy. It
is well-established that national authorities exercising EU law functions enjoy a wide
margin of discretion in the exercise of complex assessments (Upjohn Ltd v Licensing
Authority Established Under Medicines Act 1968 [1999] 1 WLR 927, paras 33-37 and
para 39). In our view, that wide margin is applicable in the present context.

82. Mr Black invoked the context of fundamental rights, relying on the inclusion of data rights
as fundamental rights within the EU’s legal order (see article 8 CFR above) and on
article 47 CFR which ensures the right to an effective remedy for violations of the rights
and freedoms guaranteed by EU law. In R (XH) v Secretary of State for the Home
Department [2017] EWCA Civ 41, [2018] QB 355, para 136, the Court confirmed that
article 47 CFR corresponds to article 6 of the European Convention on Human Rights
(“the Convention”). In determining whether the principles of judicial review meet the
requirements of article 47 CFR in any particular case, it was appropriate to have regard
to the relevant jurisprudence in relation to article 6. The Court reiterated at para 147 the
settled principle (both in the case law of the European Court of Human Rights and in
domestic law) that, in determining what standard of review is required by article 6, it is
necessary to assess the nature of the administrative decision and the nature of the
exercise which the reviewing Court or Tribunal is called upon to perform in each
particular case. Judicial review proceedings have been held to bestow full jurisdiction (in
the sense of sufficient jurisdiction) and to satisfy article 47 CFR and article 6 of the

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

Convention where the decision under scrutiny relates to a specialised area of law and
entails the exercise of judgment and expertise (XH, paras 145 and 147). In our view, the
Commissioner’s multifactorial decisions as to the outcome of complaints in the context of
the specialist regulatory area of data protection fall within this category. In relation to the
substance of complaints, judicial review is an effective remedy.

83. We agree however with Ms Lester’s submission that a s.166 order should not be
reduced to a formalistic remedy and that the various elements of s.166(2) have real
content in the sense of ensuring the progress of complaints. Parliament has empowered
the Tribunal to make an order requiring the Commissioner to take appropriate steps to
respond to a complaint (s.166(2)(a)). Any such steps will be specified in the order
(s.166(3)(a)). Appropriate steps include “investigating the subject matter of the
complaint, to the extent appropriate” (s.165(5)(a)).

84. There is nothing in the statutory language to suggest that the question of what amounts
to an appropriate step is determined by the opinion of Commissioner. As Mr Black
submitted, the language of s.165 and s.166 is objective in that it does not suggest that
an investigative step in response to a complaint is appropriate because the
Commissioner thinks that it is appropriate: her view will not be decisive. Nor has
Parliament stated that the Tribunal should apply the principles of judicial review which
would have limited the Tribunal to considering whether the Commissioner’s approach to
appropriateness was reasonable and correct in law. In determining whether a step is
appropriate, the Tribunal will decide the question of appropriateness for itself.

85. However, in considering appropriateness, the Tribunal will be bound to take into
consideration and give weight to the views of the Commissioner as an expert regulator.
The GRC is a specialist tribunal and may deploy (as in Platts) its non-legal members
appointed to the Tribunal for their expertise. It is nevertheless our view that, in the
sphere of complaints, the Commissioner has the institutional competence and is in the
best position to decide what investigations she should undertake into any particular
issue, and how she should conduct those investigations. As Mr Milford emphasised, her
decisions about these matters will be informed not only by the nature of the complaint
itself but also by a range of other factors such as her own regulatory priorities, other
investigations in the same subject area and her judgment on how to deploy her limited
resources most effectively. Any decision of a Tribunal which fails to recognise the wider
regulatory context of a complaint and to demonstrate respect for the special position of
the Commissioner may be susceptible to appeal in this Chamber.

86. We do not mean to suggest that the Tribunal must regard all matters before it as matters
of regulatory judgment: the Tribunal may be in as good a position as the Commissioner
to decide (to take Mr Milford’s example) whether a complainant should receive a
response to a complaint in Braille. Nor need the Tribunal in all cases tamely accept the
Commissioner’s judgment which would derogate from the judicial duty to scrutinise a
party’s case. However, where it is established that the Commissioner has exercised a
regulatory judgment, the Tribunal will need good reason to interfere (which may in turn
depend on the degree of regulatory judgment involved) and cannot simply substitute its
own view.

87. Moreover, s.166 is a forward-looking provision, concerned with remedying ongoing
procedural defects that stand in the way of the timely resolution of a complaint. The
Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing
the appropriateness of a response that has already been given (which would raise
substantial regulatory questions susceptible only to the supervision of the High Court). It
will do so in the context of securing the progress of the complaint in question. We do not

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

rule out circumstances in which a complainant, having received an outcome to his or her
complaint under s.165(b), may ask the Tribunal to wind back the clock and to make an
order for an appropriate step to be taken in response to the complaint under s.166(2)(a).
However, should that happen, the Tribunal will cast a critical eye to assure itself that the
complainant is not using the s.166 process to achieve a different complaint outcome.

88. The same reasoning applies to orders under s.166(2)(b) requiring the Commissioner to
inform the complainant of progress on the complaint or of the outcome of the complaint
within a specified period. These are procedural matters (giving information) and should
not be used to achieve a substantive regulatory outcome.

89. We are fortified in our conclusions by the fact that the GRC appears to date to have had
no difficulty in applying s.166 so as to achieve an effective complaints procedure while
recognising the expertise of the Commissioner. In Milne v Information Commissioner
QJ/2020/0296/GDPR/V (2 December 2020), the GRC decided that it was not clear
whether a particular letter sent by the Commissioner to the applicant was an outcome
letter. Judge O’Connor ordered that the Commissioner should inform the applicant as to
whether the letter constituted the outcome of the complaint. He ordered that, if the letter
did not represent the outcome of the complaint, the Commissioner should inform the
applicant of the progress of the complaint no less frequently than every 28 days until an
outcome was reached.

90. In Blaylock v Information Commissioner QJ/2020/0314/GDPR (20 December 2020),
Judge O’Connor noted that, as at the date of the hearing before the GRC, more than 5
months had passed since the applicant’s first complaint and nearly 4 months had passed
since a subsequent complaint. Despite this delay, the applicant had not been informed
as to whether any action (by way of investigation or otherwise) was to be taken by the
Commissioner in relation to the complaints. Judge O’Connor concluded that the
Commissioner had not taken appropriate steps to respond to the complaints. He
ordered that the Commissioner should within 21 days inform the applicant as to whether
she was going to investigate the complaints and that she must inform the applicant of the
progress of any investigation no less frequently than every 21 days.

91. In these two short and focused decisions, we do not discern any overreaching by the
GRC; nor did Mr Milford raise or direct us to any difficulties with Judge O’Connor’s
approach. We regard these cases as good examples of the GRC ensuring the effective
progress of complaints without stepping into the arena as to whether or not the
complaints had merit.

Our consideration of Mr Killock and Dr Veale’s application

92. We agree with Ms Lester that Mr Killock and Dr Veale made individual and therefore
justiciable complaints. The Complaint Form was submitted on behalf of two named
individuals (the applicants) and made clear that the Complaint was about “the way an
organisation is handling/processing my personal information”, including by “making
automated decisions or profiling me” and using “my personal information in a way I didn’t
expect”. The applicants’ core concerns related to the way in which personal data was
used in the context of RTB systems but included concerns about the lack of protection of
their own personal data. We agree that their professional expertise in raising wider
industry practices does not mean that they could not raise concerns in a personal
context.

93. Mr Milford submitted that Mr Killock and Dr Veale’s application to the Tribunal is out of
time. He acknowledged that they could not reasonably have complied with the time limits

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

in Rule 22(6)(f) of the GRC Procedure Rules in circumstances where their application
concerns the outcome of an investigation which lasted for well over six months.
Nevertheless, he submitted that the length of any appropriate extension of time would at
the very most be 28 days from the date of the outcome letter - by parity with the 28 day
period in Rule 22(6)(f). The applicants had not explained why they had waited until 21
October 2020 to apply to the Tribunal save to assert that it was only clear to them that
they would need to apply when they received the Commissioner’s letter of 23
September.

94. Ms Lester submitted that it would make no sense for complainants to be required to
submit an appeal before the investigation is said to be completed. Rule 22(6)(f) does not
govern applications made under s.166 where the investigation has not been completed
within the six month period. There is no applicable time limit to extend. Instead there is a
lacuna in the GRC Procedure Rules.

95. In our view, the language of Rule 22(6)(f) is apt to cover any application under s.166(2)
of the Data Protection Act 2018 irrespective of whether an outcome is reached within six
months. There is no lacuna. The Rule means what it says: time starts to run from the
date on which the Commissioner received the complaint and ends six months and 28
days thereafter. If the drafter of the Rules had intended a moving target – depending on
some other stage of the procedure or the date of the outcome – he or she could and
would have said so. The underlying legal policy is clear: the Commissioner may be
expected to deal with a complaint within six months of receiving it. This six-month period
reflects the two three-month staging posts in s.166(1)(b) and (c). If the Commissioner
does not initiate and complete an appropriate procedure by that time, she is at risk of a
judicial order. A person has 28 days from that six-month date to seek such an order. The
proposition that the Tribunal may select for itself some other date and then add 28 days
would be an illegitimate gloss on the statutory language.

96. There is no injustice in this approach which ensures clarity, certainty and finality for
litigants rather than a roving appeal right. As we have said, it reflects the overall
timescale envisaged by the primary legislation (s.166). It provides a complainant with a
concern about delay with a proper opportunity to seek a judicial decision. There is a
discretion to extend time if justice requires it. By the time of her submissions in reply to
Mr Milford, Ms Lester was inclined to agree that there is one time limit under the Rules
which may then be extended at the discretion of the Tribunal. We think that that is the
correct analysis.

97. The application to the Tribunal was therefore out of time and we agree with Mr Milford
that Mr Killock and Dr Veale would need an extension. In their Reply to the
Commissioner’s Response to the proceedings, it is asserted that the timing of the August
letter caused delay because it was received during the summer holidays. It was at that
stage still not known what if any steps the Commissioner had taken to investigate and
respond to the Complaint. There had been a need to seek clarification from the
Commissioner. We are not sympathetic to the point about holidays and do not consider
that the legally represented applicants needed the Commissioner’s assistance before
lodging proceedings.

98. We have some sympathy with the submission that there was undue and unexplained
delay by Mr Killock and Dr Veale in commencing proceedings in the Tribunal after the
August 2020 outcome letter. However, we do not think it is necessary to decide the
question of whether to grant an extension of time because in our view the application
itself lacks merit. We would prefer to reach a final conclusion as to the test to be applied
for extending time in a case in which it would make a difference to the outcome. Not

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

least, as we set out below in relation to C’s appeal, there is some divergence of
approach in the case law of the Upper Tribunal as to the test for an extension of time
generally. We do not regard the present proceedings as an appropriate vehicle to
resolve those divergences. For present purposes only, therefore, we are prepared to
proceed on the basis that timeliness does not present a bar to our consideration of the
application.

99. In her skeleton argument, Ms Lester characterised the application to the Tribunal as an
appeal against the decision of the Commissioner to “cease handling” the Complaint. She
submitted that the Commissioner’s investigation into the Complaint had not yet reached
an outcome in any meaningful sense or in the sense intended by article 77 UK GDPR or
s.165. The Commissioner’s assertion that the Complaint had “assisted and informed the
ICO’s broader regulatory approach” may be accurate but could not amount to an
outcome. It did not tell the applicants whether the Commissioner had concluded that
there had been an infringement of their data protection rights, nor what action was to be
taken in response to any unlawful processing the Commissioner had identified. Having
failed to reach an outcome, the Commissioner was in breach of her duty to inform the
applicants about progress on the Complaint under s.165(5)(d).

100. We agree with Mr Milford that the outcome of the Complaint was contained in the
Commissioner’s letter of 20 August 2020. The outcome was to cease handling the
Complaint but to continue with the wider industry investigation which had been informed
and assisted by the Complaint. In accordance with her duty under s.165, the
Commissioner informed the applicants of the outcome. The quality, adequacy or merits
of the Complaints outcome fall outside the scope of s.166 and outside the jurisdiction of
the Tribunal.

101. The applicants – both in correspondence with the Commissioner and before us –
have at times suggested that the Commissioner’s investigation of the AdTech industry
and her investigation of the Complaint should progress together: the continuing
investigation into AdTech amounts to a continuing investigation into the Complaint which
has therefore not reached an outcome. The most egregious example of this approach
relates to the blog post which we have mentioned above. In their letter dated 4 February
2020, the applicants’ solicitors criticised the Commissioner for publishing the blog post
without notice to or engagement with the applicants. But the blog post had nothing to do
with the handling of the Complaint. In her letter dated 20 February 2020, the
Commissioner stated:

“You complain that your clients were not informed about the issue of
a blog prior to it being published and that they were not provided with
an opportunity to make submissions and express their views. With
respect neither s.165 nor any other applicable legal provision
requires our clients to consult with and take account of your clients’
views before taking any such step. As an independent regulator it
would be entirely inappropriate for us to act in such a manner and to
prefer and prioritise the views of a small number of individuals over
and above those of anyone else. To do so would be to act unfairly
and to improperly fetter our discretion”.

102. In our view, the Commissioner’s approach was impeccable. The Commissioner was
under no duty to inform the applicants of the blog post or to consult them about it. It
cannot possibly be maintained that engagement with the applicants about the blog post
would have been an appropriate step in response to the Complaint. On the contrary, it
would have been inappropriate (and against the public interest) for the applicants to

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

interfere with the work of the Commissioner and to require her to account to them in this
way.

103. A further example is the applicants’ contention that the Commissioner could not
rationally provide an outcome letter in circumstances where investigation into AdTech
continues and where the Commissioner has reached no final decision as to any
regulatory action needed. An overlap between what the applicants were saying in their
Complaint and the Commissioner’s wider regulatory work does not mean that the one is
absorbed into the other. To treat the Complaint as co-extensive with the Commissioner’s
work on overlapping subject matter would be to fetter the Commissioner’s regulatory
discretion.

104. After receiving the Complaint, the Commissioner was in regular contact with Mr
Killock and Dr Veale to seek information and provided regular updates on her progress.
As we have already mentioned:

i. She held a meeting with them on 23 January 2019;

ii. She invited them to a stakeholder meeting on 6 March 2019 at which she
provided updates on the progress of her investigation;

iii. She held a conference call with them on 20 May 2019 at which she again
provided updates on progress;

iv. She wrote again to explain the progress of her investigation on 24 July 2019
and then again on 13 September 2019;

v. She invited them to an AdTech fact-finding forum on 19 November 2019, at
which she again provided updates on the progress of her investigation;

vi. By letters dated 20 February, 27 May and 21 July 2020, she summarised her
position;

vii. By letter date 20 August 2020, she informed them of the outcome of the
Complaint, confirming her position by letter dated 23 September 2020.

105. In our view, the Commissioner’s response to the Complaint met all statutory
conditions. She took appropriate steps to respond to the Complaint; she investigated the
subject matter of the complaint to the extent appropriate; she informed Mr Killock and Dr
Veale about progress; she reached an outcome and informed them of it. She was not
obliged to treat her investigation of the Complaint and her industry-wide investigation as
co-extensive: to the extent that Mr Killock and Dr Veale are dissatisfied with the outcome
of the Complaint, they raise matters that are (i) an actio popularis and (ii) outside the
scope of s.166. Should the applicants have considered that the outcome was inadequate
or unlawful, they ought to have invoked the supervisory jurisdiction of the High Court.
The Tribunal does not have jurisdiction to deal with such matters and we therefore
decline to do so. Although Ms Lester focused her submissions on the complaint
outcome, we should add that the criticism made in the grounds of appeal that the
Commissioner did not respond to the Complaint appropriately or keep Mr Killock and Dr
Veale informed about progress is in our view an attempt to wind back the clock so as to
seek a preferred outcome which would be beyond the Tribunal’s jurisdiction.

106. For these reasons, we refuse to make any order against the Commissioner.

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

Our consideration of EW’s application

107. EW’s case, as Mr Rabinowitz submitted to us, was materially different from the
others before us in that his complaints to the Commissioner were not investigated at all
and he was not even offered the review of correspondence which was offered in
Coghlan. A wide-ranging investigation akin to that in Killock and Veale would not have
been required given the relatively narrow ambit of his individual SARs seeking his “full
health and social care file … as well as [his] school records” and later all data held by the
Council about himself.

108. Instead what happened was that the ICO declined to investigate his complaints at all,
stating that:

(1) “The ICO Service Standards advise that if you wish to raise
complaints about an organisation then this must be done within three
months of receiving their final response to the issues raised.

Waiting longer than that can affect the decisions that we reach. In
some cases an undue delay will mean that we will not consider the
matter at all.

In this case the copy of the latest correspondence you provided is
dated 16 August 2018. Taking into account this delay we do not
intend to take any further action in relation to this matter. However,
your concerns will be logged and kept on file as this will help us over
time to build a picture of [the] Council’s information rights practices”
(25 June 2019)

and

(2) “We wrote to you on 25 June 2019 to advise that the ICO Service
Standards advise that if you wish to raise complaints about an
organisation then this must be done within three months of receiving
their final response to the issues raised. In your original complaint the
latest correspondence you provided was dated 16 August 2018. We
therefore wrote to you to advise that based on the delay in bringing
your complaint to the ICO, we were unable to consider your
complaint further.

109. We have set out the material parts of the Commissioner’s Service Standards above.
In her well-articulated submissions, Ms Iyengar submitted that the Commissioner’s
decision was in accordance with her Service Standards. EW had upon analysis simply
been pushing for disclosure of his local authority records which was a substantive matter
outside the scope of s.166 and had shown no good reason for the delay in bringing
proceedings in relation to old matters.

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

110. We can see no objection to the Commissioner having and publishing such Service
Standards as guidelines and we see no conflict between those Service Standards and
the Commissioner’s statutory duty to investigate complaints to the extent appropriate. To
that extent we do not accept Mr Rabinowitz’s submission (in paragraph 33.1 of his
skeleton argument) that we should not take notice of the Service Standards.

111. However, if the Commissioner does have such Service Standards she must act in
accordance with them, not inconsistently with them. What the Service Standards say is
that (with emphasis added)

“If you do want to raise concerns about an organisation then we
suggest that you do so within three months of receiving their final
response to the issues raised. Waiting longer than that can affect the
decisions that we reach. In some cases an undue delay will mean
that we will not consider the matter at all”.

112. The Service Standards do not say, contrary to what the ICO said on 25 June 2019
and 9 April 2020 (again with emphasis added),

“if you wish to raise complaints about an organisation then this must
be done within three months of receiving their final response to the
issues raised”.

113. It is apparent that this erroneous interpretation of what is only a suggestion in the
Service Standards being transformed into an absolute and imperative time limit of 3
months did influence the Commissioner in reaching her earlier decision since the
Commissioner’s note of the telephone call with EW on the day of that decision states
(with emphasis added) that:

“ … Advised [as] last correspondence from [the Council] is Aug 2018
we cannot look into this complaint further (over 3 months) ...”.

114. There is nothing to suggest that the Commissioner had corrected her erroneous
interpretation of her own Service Standards by 9 April 2020. Indeed the response of that
date demonstrates that she had not.

115. We therefore accept Mr Rabinowitz’s submission that the Commissioner has not
properly applied the Service Standards in this case. It is not therefore correct to assert,
as the Commissioner did in paragraph 88 of her skeleton argument, that she had applied
the Service Standards or that she applied the Service Standards fairly and consistently.

116. As we have explained above, s.166 is a procedural, not a substantive, remedy which
provides for a right of appeal to the Tribunal on process, where the Commissioner fails to
address a complaint under s.165 DPA 2018 in a procedurally proper fashion. However,
as we have concluded above, the appropriateness of the investigative steps taken by the
Commissioner is an objective matter which is within the jurisdiction of the Tribunal and is
not something solely within the remit of the Commissioner to determine for herself. In our
judgment, by misconstruing and misapplying her own Service Standards, and thereby
simply declining to investigate the complaints at all, the Commissioner did not take such
steps as were appropriate to respond to the complaints.

117. In those circumstances, where the Commissioner has failed to take appropriate steps
to investigate the subject matter of EW’s complaints, the Tribunal may make an order

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

under s.166(2)(a) DPA 2018. We propose in the exercise of our discretion to make such
an order in EW’s case because of (i) the seriousness of the subject matter underlying the
complaint (namely, EW’s local authority records which touch on his right to respect for
private life); and (ii) EW’s young age which makes him (at least to some degree)
vulnerable and thus less able to undertake the sort of administrative processes which
correspondence with the Commissioner requires. For the avoidance of doubt, we make it
plain that we are not expressing any view on whether EW should see his records: that is
not our task.

118. The order which this Tribunal proposes to make is that the Commissioner:

i. Must take appropriate steps to respond to EW’s complaints by (i) within 14
days of the date of the promulgation of this decision, initiating
correspondence with the relevant officials at the Council with a view to
determining the basis on which EW’s SARs were refused and (ii) having
considered any responses provided by the Council, assessing whether or
not those refusals (or any of them) were lawful

ii. Must conclude the investigation of EW’s complaints within 2 months of the
date of the promulgation of this decision and, having concluded such
investigation, inform him by the end of that time of the outcome of his
complaints.

119. We shall direct that the parties in EW’s appeal shall file and serve any objections to
these proposed directions within 14 days of the issue of our decision failing which we
shall make an order in the terms above.

Our consideration of C’s appeal

120. Mrs Coghlan’s application to the Tribunal was out of time because it was not made
within 28 days of the expiry of six months from the date on which the Commissioner
received the complaint (see Rule 22(6)(f) above). We have considered whether to
extend the time for bringing the application under Rule 5(3). Both parties asked us to
consider the s.165 complaint and agreed that Mrs Coghlan’s appeal to us would stand or
fall on the basis of our conclusions about the scope of the s.166 remedy. If the GRC
was correct to say that Mrs Coghlan could not obtain a s.166 order, the matter would end
there.

121. Unlike in the case of Mr Killock and Dr Veale, the Commissioner provided a
complaint outcome to Mrs Coghlan well within 6 months. Mrs Coghlan’s Notice of Appeal
emphasises that the Commissioner directed her towards the ICO’s review process which
led to the 29 May decision. Mrs Coghlan submitted that it would be unjust to exclude an
appeal where the Commissioner had effectively insisted on a review process that would
render the GRC application out of time. Nor would it be lawful: it would render
excessively difficult or impossible the exercise of these EU-law derived rights. The
application to the GRC was lodged within 28 days of the Commissioner’s review which
was sufficient.

122. We reject the submission that our interpretation of the GRC Procedures Rules
violates the principle of effectiveness in EU law. That submission was made briefly in the
Notice of Appeal but was not developed in Mr Black’s skeleton argument or indeed in his
oral submissions. We were directed to no principle of EU law to suggest that domestic
Courts and Tribunals may not impose time limits. We agree with Judge Wikeley’s view in
Scranage (para 8) that the time limit is “more generous” than in the generality of GRC

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

appeals which have a 28-day time limit from the date of notice of the act or decision
under challenge (see Rule 22(1)(b) of the GRC Procedure Rules).

123. In any event, the GRC had power to extend the time limit in order to enable the
effective exercise of C’s rights. Rule 5(3)(a) of the GRC Procedure Rules provides a
power for the First-tier Tribunal to extend the time for complying with any rule, practice
direction or direction. In our view, the question of whether to extend time depends on all
the circumstances and not on the mechanistic addition of 28 days to the final step of the
complaints process.

124. The grounds of appeal contend that Judge Macmillan erred in law by applying the
approach of Morgan J sitting as a Judge of the Upper Tribunal (Tax and Chancery
Chamber) in Data Select, which imported the criteria for relief from sanctions from the
Civil Procedure Rules (CPR 3.9) as opposed to the (perhaps) broader and less
structured approach of this Chamber in PS v Information Commissioner [2011] UKUT 94
(AAC) and AW v Information Commissioner [2013] UKUT 48 (AAC), which treated the
issue of whether to allow a late appeal as a question of unfettered discretion, subject
only to the overriding objective. We note that Judge Wikeley regarded Data Select as
the applicable test in Scranage at para 15. We ourselves would be inclined to agree with
Judge Wikeley’s approach which reflects BPP Holdings Ltd v HMRC [2017] 1 WLR 2945,
paras 26-34 per Lord Neuberger.

125. There is however no need for us to decide the point as we would refuse to extend
time under either approach. In Mrs Coghlan’s case, there was no barrier to an appeal
within the stipulated time limit. The Commissioner’s view was that judicial review
proceedings should not be commenced prior to the exhaustion of other remedies,
namely the review process. Mrs Coghlan did not lodge judicial review proceedings
(which raise discrete consideration of the exhaustion of alternative remedies) but chose
to seek an order from the GRC. She should have complied with the time limit and there
is in our view no reason or cause to extend time on any of the tests suggested to us.

126. In any event, Mrs Coghlan’s application for a s.166 order lacked merit. There is no
merit in the submission that the Commissioner failed to deal with the complaint other
than in accordance with her statutory duties. On 11 December 2019, the Commissioner
informed Mrs Coghlan that the relevant correspondence had been reviewed. The
Commissioner had sought and received confirmation from LBH that its email network
was sufficiently secure to send unencrypted information. The Commissioner confirmed to
Mrs Coghlan her view that there was no obligation on an organisation to encrypt emails
and that there was no evidence to suggest that LBH’s email network was not secure. In
our view, the Commissioner plainly responded to the complaint and plainly took
appropriate steps to respond to it. She informed the complainant of the outcome of the
complaint process within the statutory three-month period.

127. The Commissioner in her letters dated 6 February and 18 February 2020 refused to
change her mind. She was entitled and in our view correct to adhere to her previous
position. In these circumstances, the Commissioner responded appropriately to the
complaint and informed Mrs Coghlan of the outcome within the statutory time period. We
agree with Judge Macmillan that, by the time of her appeal to the GRC, she had received
that which the Tribunal could order under s.166(2). We have no hesitation in concluding
that Mrs Coghlan is seeking to use C’s application to the Tribunal as a mechanism for
ventilating her dissatisfaction with the outcome of the complaint and her underlying
dissatisfaction with LBH’s email system. Such a course is not open to her.

James Killock and Michael Veale v ICO, EW v ICO, Eveleen Coghlan (on behalf of C) v. ICO
[2021] UKUT 299 (AAC)

128. For these reasons, we do not accept that the GRC failed properly to apply the law
(ground 1) or that s.166 enables the Tribunal to determine if a decision was correct in
substance (ground 2). C’s appeal is dismissed.

Conclusion

129. Accordingly:

i. The application of Mr Killock and Dr Veale is refused.
ii. The application of EW is allowed.
iii. The appeal of C is dismissed.

Postscript

130. With regard to future potential law reform, Judge Wikeley in Scranage observed at
para 34: “There is a wider jurisdictional issue in play here. Plainly the GDPR requires
that data subjects have an ‘effective judicial remedy’ against both a ‘supervisory
authority’ (here, the Commissioner) and a data controller or processor (see GDPR
Articles 78 and 79 respectively). Domestic legislation provides that procedural redress
against the Commissioner under Article 78(2) is sought from the Tribunal whereas
substantive redress under Article 79 must be pursued in the courts (being the county
court or the High Court). The policy reason for this jurisdictional disconnect, which is
hardly helpful for litigants in person, or for developing a coherent system of precedent, is
not immediately apparent. A comprehensive strategic review of the various appellate
mechanisms for rights exercisable under the DPA is arguably long overdue. This might
include consideration of whether the section 166(2) procedure is working as anticipated.
Anecdotally at least, the experience of both the First-tier Tribunal and the Upper Tribunal
is that a significant proportion of these applications have little merit yet consume a
considerable and disproportionate amount of judicial and administrative resources.”

131. We would endorse those observations.

The Hon Mrs Justice Farbey
Chamber President

Mark West
Judge of the Upper Tribunal

In Killock & Veale and in EW:
Pieter De Waal
Member of the Upper Tribunal

24 November 2021

Bilgi Komiserine Karşı Usuli Emir Yetkisi

Türkçe özet

Hukuki mesele

Sonuç

Karar metni