Veri Koruma Şikayetine İlişkin Temyiz Başvurusunun Reddi

UKUT-AAC 2025 74 [2025] UKUT 74 (AAC) 0.26.21 71f1e0bc43ac99ed6d0dc00b7ed42e521a8912f7275d85f94bae9c6fa982ed46 7.1.0

Neutral Citation Number: [2025] UKUT 74 (AAC)

Appeal No. UA-2024-000830-GDPA

IN THE UPPER TRIBUNAL

ADMINISTRATIVE APPEALS CHAMBER

Between:

DR MICHAEL GUY SMITH

Appellant

- v -

INFORMATION COMMISSIONER

Respondent

Before: Upper Tribunal Judge Stout

Hearing date(s): 2 December 2024

Mode of hearing: By video

Representation:

Appellant: In person

Respondent: Eric Metcalfe (counsel)

On appeal from:

Tribunal: First-tier Tribunal (Information Rights)

Tribunal Case No: [2024] UKFTT 00266 (GRC)

Decision Date: 2 April 2024

SUMMARY OF DECISION

DATA PROTECTION (93.9)

The First-tier Tribunal (FtT) dismissed the appellant’s application for an order under section 166 of the Data Protection Act 2018 (DPA 2018) that the Information Commissioner should take further “appropriate steps” to respond to his complaint that the ICO (i.e. the Information Commissioner in his capacity as data controller) had failed to comply with the UK General Data Protection Regulation (UK GDPR). The Upper Tribunal (UT) considers in detail the effect of the case law in section 166 cases and decides to dismiss the appeal, holding:-

(1) Insofar as they differ, the approach of the Upper Tribunal in Killock and Veale v Information Commissioner [2021] UKUT 299 (AAC), [2022] AACR 4 is to be preferred to that of the High Court in R (Delo) v Information Commissioner [2023] 1 WLR 1327. This is consistent with the Court of Appeal decision in Delo [2024] 1 WLR 263 .

(2) Applying Killock and Veale , the FtT’s decision should have contained an explicit direction that it needed to consider for itself, applying an objective test, whether it was appropriate for the Commissioner to take further steps to respond to the appellant’s complaint. However, in practice that was the approach the FtT had taken and there was no material error of law.

(3) In applying that objective test, the FtT had rightly given weight to the view of the Commissioner who, as the expert regulator, is entitled to respect as to the nature and extent of the investigation (if any) that is appropriate in a particular case.

(4) In the absence of evidence of actual bias (or other improper conduct) by the Commissioner, the FtT should in principle afford the Commissioner the same respect in cases where the Commissioner is investigating his own actions as ICO as the FtT does when the Commissioner is investigating the actions of third party data controllers.

(5) The appellant’s argument that a different approach is required because the Commissioner may be ‘apparently biased’ in such cases did not succeed.

(6) The FtT had not erred in law in concluding that there had been no actual bias or improper conduct by the Commissioner in this case.

(7) It was unnecessary to decide whether the duty of candour applied to the Commissioner when responding to a section 166 application as (whether it did or not) the FtT had not erred in proceeding without ordering further disclosure or witness statements.

(8) The FtT had not erred in concluding that the appellant had been properly informed of the outcome of his complaint.

(9) There had been no material unfairness as a result of any failure to comply with the overriding objective.

(10) The FtT had provided adequate reasons for its decision.

(11) It had emerged as a result of the appeal to the UT that there were shortcomings in the Commissioner’s handling of the appellant’s complaints about the ICO, in particular that one of the appellant’s emails had been overlooked. If the appellant had put his section 166 application differently, it would have been open to the First-tier Tribunal to make an order under section 166 that the Commissioner respond to that email. However, as it was, the appellant’s application focused on the merits of the Commissioner’s decision in the appellant’s case and thus should have been pursued by way of judicial review of the Commissioner’s decision. The shortcomings identified therefore had no material impact on the outcome of the present appeal.

(12) The Upper Tribunal directed that the decision be placed before the Commissioner personally to consider the Tribunal’s observations in relation to the shortcomings identified.

Please note the Summary of Decision is included for the convenience of readers. It does not form part of the decision. The Decision and Reasons of the judge follow.

DECISION AND DIRECTION

The decision of the Upper Tribunal is to dismiss the appeal. The decision of the First-tier Tribunal did not involve an error of law.

I direct that a copy of this decision be placed before the Information Commissioner personally, perhaps following a review by an appropriate member of his senior management team, so that he may give particular consideration to the matters dealt with at paragraphs 125-136.

REASONS FOR DECISION

(As amended under Rule 42)

Introduction

This is an appeal in which the respondent Information Commissioner “wears two hats” as Judge Wikeley described it in Information Commissioner v Colenso-Dunne [2015] UKUT 471 (AAC) , [2016] AACR 9. In this decision, I refer to the Information Commissioner as “the Commissioner” when he is acting in his regulatory capacity and as “the ICO” when he is acting in his capacity as a data controller under the Data Protection Act 2018 (DPA 2018) or as a public authority for the purposes of the Freedom of Information Act 2000 (FOIA).

The appellant appeals, with the permission of the First-tier Tribunal, against a decision of the First-tier Tribunal of 2 April 2024 refusing his application under section 166 of the DPA 2018 for an order that the Commissioner take further steps to respond to two complaints he made about the ICO.

The structure of this decision is:

Introduction 3 Background 4 The proceedings before the First-tier Tribunal 10 Preliminary issues 10 The First-tier Tribunal’s decision 10 The law 13 Relevant legislative provisions in relation to section 166 of the DPA 2018 13 Case law in relation to section 166 of the DPA 2018 14 The Upper Tribunal’s jurisdiction on appeal 24 The parties’ submissions 25 The grounds of appeal: discussion and conclusions 25 Ground 2: The Tribunal erred by ruling that the Commissioner was not biased and by reaching the wrong conclusions about the Commissioner’s motives, and their consequences 25 The parties’ submissions on Ground 2 25 Analysis and conclusions: (i) the apparent bias argument 27 (ii) My concerns about the Tribunal’s self-directions as to the law 29 (iii) The approach the First-tier Tribunal should take to section 166 applications where the Commissioner has been asked to investigate a complaint against the ICO 31 (iv) The First-tier Tribunal’s decision in this case 32 Ground 3 : The Tribunal erred by failing to uphold the duty of candour 33 The parties’ submissions on Ground 3 33 Analysis and conclusions 33 Ground 4: The First-tier Tribunal erred in relation to what was the outcome of the appellant’s complaints 35 The parties’ submissions on Ground 4 35 Analysis and conclusion 35 Ground 5: The First-tier Tribunal failed to uphold the overriding objective 35 Ground 1: The First-tier Tribunal has provided inadequate reasons for its decision 37 The shortcomings in the Commissioner’s handling of the complaints and why they do not mean this appeal succeeds 38 Conclusion 42

Background

On 29 December 2022, the appellant made two complaints to the Commissioner that the ICO had breached data protection laws by failing to retain files relating to previous cases/complaints/requests/appeals that the appellant had brought to or against the ICO/Commissioner in response to requests for retention made by the appellant under Article 18(1)(c) of the UK General Data Protection Regulation (UK GDPR).

Article 18(1)(c) of the UK GDPR provides data subjects with a right to restrict processing of data by a data controller where “the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims”.

The appellant’s first request for retention under Article 18(1)(c) (“the 2020 request”) was made on 16 October 2020.

The appellant’s second request for retention under Article 18(1)(c) was made on 13 November 2022 (“the 2022 request”).

Together, the requests were for the ICO to retain data in relation to eight previous case references. The appellant explained that he considered Article 18(1)(c) applied because they were all cases that were in his view linked, and in respect of which he had either received a First-tier Tribunal judgment he was considering appealing and/or in respect of which he was considering making an application to the County Court under sections 167 or 168 of the DPA 2018. The eight previous references were:-

FS50804336

IC-76861-G6C6

IRQ0811971

IRQ0915166

IC-65359-C1C7

RFA0804334

RCC0854800

IRQ0837017

The ICO replied on 13 December 2022. This was a five-page letter in which the ICO set out in relation to each case reference why the ICO considered it was no longer necessary to retain the information in question.

10.

In summary, the ICO’s response was as follows:-

FS50804336 related to matters that had now been heard by the Upper Tribunal in case numbers EA/2019/0374 and EA/2022/0095 and so had been completed and in respect of which material was now in the appeal bundles, so material held under this case reference would now be deleted.

IC-65359-C1C7 was an information request to the ICO, in respect of which the Commissioner had issued a Decision Notice, which had been the subject of an appeal to the First-tier Tribunal in EA/2022/0095. The ICO stated this would be deleted, explaining: “while an information request is antecedent to a Decision Notice, an appeal to the Information Tribunal is an appeal against the Decision Notice issued by the Information Commissioner, not against the original response”.

IC-76861-G6C6 related to a Decision Notice that was not itself subject to an appeal and the appellant was out of time to appeal, so that would be deleted.

IRQ0811971, IRQ0915166, and IRQ0837017 related to closed cases that had been deleted in line with the ICO’s standard retention period.

RFA0804334 and RCC0854800 related to cases that the appellant asked in his 2020 request should be retained. At the time, the appellant was told by one department of ICO that this request was refused, and by another that the cases would be retained, so they were retained ‘as a matter of good service’. However, as they related to matters originally started in 2018, the ICO would now delete them as the matters were not going to be reopened and time limits for complaining or seeking judicial review had expired.

11.

The appellant complained about the ICO’s reply by further email of 14 December 2022. In this email, the appellant argued that the ICO had made a number of mistakes because (in summary):

It was Decision Notice file IC-768610-G6C6 that had been the subject of appeal to the First-tier Tribunal in appeal number EA/2022/0095, not file FS50804336 (although he said that FS50804336 was a related case so should be retained in any event);

EA/2022/0095 had in fact only been determined by the First-tier Tribunal and the appellant had made an application to appeal to the Upper Tribunal that had not yet been determined, so the ICO was wrong to say that this had been the subject of an appeal to the Upper Tribunal that had been completed;

IC-65359-C1C7 was the case reference for the underlying FOIA request to the ICO which had been the subject of the Decision Notice in IC-768610-G6C6 and thus was still the subject of the ongoing appeal in EA/2022/0095. The appellant argued the file should accordingly be retained. He explained he considered retention to be particularly important in that case because one of the issues raised in his appeal was whether the ICO had complied with the duty in section 16 of FOIA to advise and assist. The appellant was arguing that the Commissioner had not included in the First-tier Tribunal appeal bundle all relevant documentary evidence relating to the original handling of his request by the ICO under case reference IC-65359-C1C7.

12.

The appellant also added that he wanted RFA0804334 and RCC0854800 retained because it was his intention to seek to reopen those cases.

13.

By email of 21 December 2022, the ICO maintained his position in relation to his response to the appellant’s Article 18 requests but did not address (in any way) the points made in the appellant’s email of 14 December 2022. The ICO informed the appellant of his right to complain to the Commissioner.

14.

This the appellant then did, completing two online submissions on 29 December 2022 (pp 73 and 74 of the First-tier Tribunal bundle). The first concerned his request of 16 October 2020 and was numbered IC-67118-V8Y4; the second concerned his 13 November 2022 request and was numbered IC-201926-Y8M5 by the Commissioner. The appellant appended to these his emails of 13 November 2022 and 14 December 2022 (among other documents).

15.

By letter of 17 February 2023, the Commissioner dismissed his complaint, finding that the ICO had complied with the UK GDPR. The Commissioner considered together IC-67118-V8Y4 and IC-201926-Y8M5 and also another (IC-186591-H9C1) which has not featured in this appeal.

16.

Regarding IC-67118-V8Y4, the Commissioner found the ICO was compliant with the UK GDPR. The Commissioner noted that in 2020 the appellant was in contact with both the Freedom of Information team and the Public Advice & Data Protection Complaints Services who had already decided that the appellant’s request should be complied with. Those dealing with the Article 18 request therefore decided that it should be complied with as a matter of good service, although there were no live proceedings ongoing, but the appellant was informed that the preservation only applied to RFA0804334, RCC0854800, and FS50804336.

17.

Regarding IC-201926-Y8M5, the Commissioner wrote as follows in the 17 February 2023 outcome letter:

The IA team came to the conclusion that none of the gateways to restrict processing were met and therefore refused to take action. The preservation status of those cases that had previously been preserved were reconsidered in light of the fact that two years had passed, and it was determined that there were no circumstances in which the ICO was obliged to continue preserving these cases.

Overall, considering the information above, I believe that the ICO has complied with their data protection obligations in this case. This is because none of the Article 18 gateways were met when considering the request and the ICO must ensure they comply with the storage limitation principle (Article 5(1)(e)).

18.

The 17 February 2023 letter again does not deal with any of the points made by the appellant in his email of 14 December 2022.

19.

The appellant was dissatisfied with the outcome and queried it, receiving a further response on 27 February 2023. By email of 17 July 2023, the appellant formally requested a case review of the 17 February 2023 outcome. He complained that, in relation to both his complaints, the Commissioner had not investigated “the subject matter of my complaint” or “whether Article 18(1)(c)) applies”. He made two particular points, specifically:

At the time of his first Article 18 request on 16 October 2020 there were live proceedings before the First-tier Tribunal in EA/2019/0374. The implication of this was that the ICO had been wrong to regard it as merely a matter of good service (rather than UK GDPR obligation) to preserve those cases;

As at time of his second Article 18 request on 13 November 2022 the case UA-2021-000680-GIA was live before the Upper Tribunal and he intended to appeal EA/2022/0095, which he did (as UA-2023-000680-GIA, which was still ongoing), so that his Article 18 request should have been complied with. (Cross-referencing this email with the appellant’s email of 14 December 2022, the implication of this point was again that at least case references IC-768610-G6C6 and IC-65359-C1C7 should not have been deleted.)

20.

The appellant asked whether it was the Commissioner’s position that those legal proceedings did not exist at the relevant time, or, if not, on what basis his retention requests had been refused. He queried the case officer’s suggestion that his requests had not met an Article 18(1)(c) “threshold”.

21.

By letter of 25 July 2023 the Commissioner responded to the case review, maintaining his previous position. The material part of the Commissioner’s reasons was as follows:-

You have mentioned you are still unclear as to why your cases have been deleted, despite you submitting a right to restrict request on the basis of Article 18(1)(c), which is when the data controller no longer needs the personal data but the individual needs them to keep it in order to establish, exercise or defend a legal claim.

Having considered the available information, I am satisfied that the ICO’s reasoning has been explained to you with an explanation as to why Article 18(1)(c) doesn’t apply. As such, I am satisfied that [the Commissioner] did not need to reiterate this information in [the 17 February 2023] outcome.

In regard to your query about a ‘threshold’, this just meant that, for example, there are no open legal proceedings, or you are out of time to initiate legal proceedings and therefore the threshold for applying Article 18(1)(c) has not been met.

Having reviewed the matter, I am satisfied that [the Commissioner] dealt with your complaint appropriately. As such this is not something that we intend to pursue further.

22.

As will be noted, this communication takes the position that the Commissioner’s reasoning for finding there was no breach of the UK GDPR has been explained to the appellant previously. Accordingly, it too does not deal with the points made in the appellant’s email of 14 December 2022.

23.

It is convenient to note here that, in his further submissions following the Upper Tribunal hearing, Mr Metcalfe (on behalf of the Commissioner) has indicated that the writer of the 25 July 2023 letter was referring to the ICO’s email of 13 December 2022 when they said that the appellant had been provided previously with reasons why Article 18(1)(c) did not apply to his 12 November 2020 request. However, the ICO’s email of 13 December 2022 understandably did not contain reasons answering the points that the appellant made for the first time the following day in his email of 14 December 2022. The appellant’s email of 14 December 2022 was complaining about what the ICO had said in his email of 13 December 2022. The appellant has thus never had a response to the points that he made in his email of 14 December 2022.

24.

As already noted, one of those points was that the ICO had failed to take into account that appeal EA/2022/0095 was ongoing as the appellant was seeking permission to appeal to the Upper Tribunal against the First-tier Tribunal’s decision in that case (in an appeal later numbered UA-2023-000680-GIA). Mr Metcalfe, on instructions, writes that the Commissioner following the Upper Tribunal hearing has consulted with the officer who drafted the 13 December 2022 email and:

The officer states that, when drafting the [13 December 2022 email], they consulted with FOI complaints about the appeal status and was told that no appeal was pending. On that basis, the officer reached their decision on the basis of the information that was provided to them. The officer accepts that the information was not, in fact, correct and states further that, had they known that the case was under appeal, they would have concluded that Art 18(1)(c) applied to IC-76861-G6C6.

25.

I also directed the Commissioner to provide further submissions following the Upper Tribunal hearing identifying where the Commissioner had set out his reasons for concluding that the ICO was not in breach of the UK GDPR when he decided not to retain the file relating to what the appellant says was FOIA request IC-65359-C1C7 which was the subject of the Decision Notice IC-76861-G6C6 that was in turn the subject of the appeal EA/2022/0095. The Commissioner’s further submissions do not specifically deal with this point, although the acknowledgment that the Commissioner relied on the ICO’s reasons in the 13 December 2022 email explains why the Commissioner has not provided reasons dealing with this issue, which was another of the points identified by the appellant in his email of 14 December 2022.

The proceedings before the First-tier Tribunal

Preliminary issues

26.

The appellant applied to the First-tier Tribunal under section 166(2) of the DPA 2018 for an order requiring the Commissioner to take appropriate steps to respond to his complaints. He put forward three grounds for his application, the first two of which were that the Commissioner had failed to take appropriate steps to respond to each of his two complaints by “failing to investigate the subject matter of my complaint, to the extent appropriate”, while the third ground was that “The outcome which the Commissioner has sent me in response to my complaints is incompatible with the outcome of the Commissioner’s investigation into the subject matter of my complaints”.

27.

The Commissioner applied to have the application struck out on the grounds that it stood no reasonable prospect of success, but this application was dismissed by Judge Buckley in an order made on the papers dated 16 November 2023.

28.

The appellant made an application for disclosure and provision of witness evidence by the Commissioner. This was refused by a Registrar and the appellant appealed to a judge of the First-tier Tribunal (Judge Neville) who rejected the application by order dated 16 February 2024. In rejecting the application, Judge Neville held that the duty of candour applied in section 166 applications and that was part of the reason why Judge Neville refused the application for disclosure.

The First-tier Tribunal’s decision

29.

The First-tier Tribunal in its decision directed itself as follows in relation to the law:

The Commissioner has a broad discretion to decide whether to investigate a complaint at all, and, if so, to what extent: R (Delo) v IC [2023] 1WLR 1327 (per Mostyn J at 57 and 62/63); R (Delo) v IC [2024] 1 WLR 263 (per Warby LJ at 80).

It is principally for the Commissioner to determine what is an “appropriate” response to a complaint: Killock & Veale v IC [2022] 1 WLR 2241 at 85/86

Section 166 is a procedural remedy. It is not a right of appeal and does not afford the data subject the right to challenge the substance of a complaint outcome.

The appropriate remedy for such a challenge is an application for judicial review in the High Court, rather than an application under section 166.

The remedy provided for by section 166 is essentially forward-looking. It is concerned with remedying ongoing procedural defences that stand in the way of the timely resolution of a complaint. That said, and whilst a data subject may not “wind back the clock and try by sleight of hand to achieve a different outcome” (see Delo per Mostyn J at 131), it is not ruled out that there are “circumstances in which a complaint, having received an outcome to his or her complaint under section 165(b), may ask the Tribunal to wind back the clock and to make an order for an appropriate step to be taken in response to the complaint under section 166(2)(a)” - Killock and Veale , para 87. Two caveats follow in this Upper Tier Tribunal, the first in paragraphs 85/86 of the decision that the Tribunal has to respect the special position of the Commissioner and have a good reason to interfere with the Commissioner’ regulatory judgement and cannot simply substitute its own view. The second caveat, further to paragraph 87 of Killock & Veale , is that the Tribunal must cast a critical eye to assure itself that the complainant is not using the section 166 process to achieve a different complaint outcome.

30.

The Tribunal went on to consider whether this was a case in which “the narrow window of circumstance anticipated in Killock and Veale in which ‘winding back the clock’ was lawful” applied in this case. It concluded that it did not.

31.

In particular, the Tribunal at [10] explained why it did not consider that the Commissioner was “plainly a biased regulator” when dealing with complaints about the actions of the ICO. The Tribunal considered the appellant’s assertion that the Commissioner had a motive not to carry out a proper investigation where the actions he is investigating are his own. The Tribunal’s view was that the appellant’s case in this respect was “speculative and unproven”.

32.

The Tribunal considered an email dated 7 February 2023 (“the 7 February 2023 email”) on which the appellant placed considerable weight in relation to his third ground of appeal.

33.

This email was from the Commissioner’s caseworker who prepared the 17 February 2023 response to the appellant’s complaint (Ms Jones) and was sent to another caseworker (Ms Brewster). Forwarding an email from Ms Keith (who had previously dealt on behalf of the ICO with his underlying Article 18(1)(c) requests), Ms Jones wrote:

Just in relation to preserving cases and our conversation this morning, I think the first half of the email explains it a bit further. Might be worth putting a process in place like you said, on how to preserve a case and what happens when we do etc.

I think rather than finding the ICO in breach in this case, just to inform the DS that we have taken this case as a learning opportunity to improve our practises when it comes to preserving cases. Let me know your thoughts.

34.

The “first half of the email” to which Ms Jones referred in that first paragraph appears to be the part of Ms Keith’s email that relates to IC-67118-V8Y4 and the ICO’s explanation that RFA0804334 and RCC0854800 (among other references) had previously been preserved by one department at the appellant’s request, even though another department thought they should not be.

35.

The appellant’s argument before the First-tier Tribunal was that the 7 February 2023 email indicated that the Commissioner had concluded there had been a breach of Article 18 in his case, but decided not to tell him that.

36.

The First-tier Tribunal, however, decided that the 7 February 2023 email:

…did no more than indicate that a lessons learned process should follow the outcome. It did not lead to a conclusion of fact (on the basis of being more likely than not) that there was a view internally that there had been a breach of data protection obligations on the part of the Commissioner.

Nor did it lead to a conclusion that the outcome communicated to the Applicant on 17 February 2022 was only “an” outcome and not “the” outcome (which the Applicant sought to argue from this email was that there had been a breach of data protection obligations). This finding disposed of the Applicant’s third ground of appeal, that the outcome which the Commissioner sent him in response to his complaints is incompatible with the outcome of the Commissioner’s investigation in the subject matter of his complaints. The Tribunal dismissed this ground of appeal on the basis that he had received communication of “the” outcome of his complaints on the 17 February 2022 and this was not incompatible with what the Applicant alleged was indicated in the email cited above. In light of the Tribunal’s interpretation of this email, it did not consider this showed any failure of disclosure on the part of the Commissioner.

37.

The Tribunal went on to explain why it dismissed the appellant’s first and second grounds too. At [13], the Tribunal concluded that the Commissioner had taken adequate steps to investigate the appellant’s complaint, having reviewed the correspondence stored on the Commissioner’s case management system, engaged with the relevant team and inquired about the handling of the appellant’s requests, providing him with an outcome on 17 February 2023, further clarification on 27 February 2023 and a case review of that outcome on 25 July 2023.

38.

The Tribunal at [14]-[15] considered submissions that the appellant had made about the Commissioner being subject to a ‘duty of candour’ and obliged to provide witness statements or disclosure of all the underlying evidence in relation to the investigation. The Tribunal concluded that it did not need to decide whether the Commissioner was subject to a duty of candour as such because it did not need either witness statements or further disclosure from the Commissioner to determine the matter before it.

39.

At [16] the Tribunal considered the Commissioner’s argument that the appellant was trying to use the section 166 process to achieve a different outcome to his complaint, contrary to the guidance in Killock and Veale , but rejected that argument, holding that the appellant was properly inviting the First-tier Tribunal to consider procedural aspects of the investigation.

The law

Relevant legislative provisions in relation to section 166 of the DPA 2018

40.

Article 57.1(f) of the UK GDPR requires state supervisory authorities to “handle complaints lodged by a data subject … and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary”. This obligation is then given further effect by sections 165 and 166 of the DPA 2018 which provide as follows:

165 Complaints by data subjects

(1)

Articles 57(1)(f) and (2) and 77 of the [UK GDPR] (data subject's right to lodge a complaint) confer rights on data subjects to complain to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the [UK GDPR].

(2)

A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act .

(3)

The Commissioner must facilitate the making of complaints under subsection (2) by taking steps such as providing a complaint form which can be completed electronically and by other means.

(4)

If the Commissioner receives a complaint under subsection (2), the Commissioner must—

(a)

take appropriate steps to respond to the complaint,

(b)

inform the complainant of the outcome of the complaint,

(c)

inform the complainant of the rights under section 166, and

(d)

if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.

(5)

The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—

(a)

investigating the subject matter of the complaint, to the extent appropriate, and

(b)

informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with foreign designated authority is necessary.

(7)

In this section—

“foreign designated authority” means an authority designated for the

purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Convention;

166 Orders to progress complaints

(1)

This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner—

(a)

fails to take appropriate steps to respond to the complaint,

(b)

fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or

(c)

if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.

(2)

The Tribunal may, on an application by the data subject, make an order requiring the Commissioner—

(a)

to take appropriate steps to respond to the complaint, or

(b)

to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.

(3)

An order under subsection (2)(a) may require the Commissioner—

(a)

to take steps specified in the order;

(b)

to conclude an investigation, or take a specified step, within a period specified in the order.

(4)

Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).

Case law in relation to section 166 of the DPA 2018

41.

In Killock and Veale v Information Commissioner [2021] UKUT 299 (AAC) , [2022] AACR 4 an Upper Tribunal panel consisting of the then Chamber President Farbey J, Upper Tribunal Judge West and Tribunal Member Pieter De Waal considered three joined cases. Having reviewed the case law up to that date, the Upper Tribunal held as follows regarding the scope and effect of section 166:

74 The remedy in section 166 is limited to the mischiefs identified in section 166(1) . We agree with Upper Tribunal Judge Wikeley’s conclusion in Leighton (No 2) [2020] UKUT 23 (AAC) that those are all procedural failings. They are (in broad summary) the failure to respond appropriately to a complaint, the failure to provide timely information in relation to a complaint and the failure to provide a timely complaint outcome. We do not need to go further by characterising section 166 as a ‘remedy for inaction’ which we regard as an unnecessary gloss on the statutory provision. It is plain from the statutory words that, on an application under section 166 , the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the section 166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a tribunal from the procedural failings listed in section 166 towards a decision on the merits of the complaint must be firmly resisted by tribunals.

75 We do not accept that the limits of section 166 mean that the rights

of data subjects are not protected to the extent required by the GDPR or by the CFR. Infringement of rights under data protection legislation is remediable in the courts (sections 167—169 of the DPA). In addition, if a data subject decides to complain to the Commissioner, section 166 provides procedural protections in order to ensure that the complaint receives appropriate, timely and transparent consideration. The Tribunal, as a judicial body, has expertise in procedural matters. It is therefore apt for a tribunal to provide a remedy against procedural failings in complaints handling.

76 The Tribunal does not have the same expertise in determining the

appropriate outcome of complaints. The Commissioner is the expert

regulator. She is in the best position to consider the merits of a complaint and to reach a conclusion as to its outcome. In so far as the Commissioners regulatory judgments would not and cannot be matched by expertise in the Tribunal, it is readily comprehensible that Parliament has not provided a remedy in the Tribunal in relation to the merits of complaints.

77 This does not leave data subjects unprotected. If the Commissioner

goes outside her statutory powers or makes any other error of law, the High Court will correct her on ordinary public law principles in judicial review proceedings. The combination of a statutory remedy in the Tribunal in relation to procedures and to the supervision of the High Court in relation to substance provides appropriate and effective protection to individuals. It does not require us to strain the language of section 166 to rectify any lack of protection or to correct any defect in Parliament’s enactment of the Uks obligations to protect an individual’s data.

42.

At [77]-[82], the Upper Tribunal then considered whether its interpretation of section 166 would be compliant with the EU principles of equivalence and affording an effective remedy and concluded that it was because judicial review provided the effective remedy in relation to the substance of the Commissioner’s decision on a complaint.

43.

The Upper Tribunal then went on to give further guidance as to how the Tribunal should approach an application under section 166 , and the question of whether ‘appropriate steps’ have been taken by the Commissioner or should be ordered by the Tribunal. The Upper Tribunal concluded that the task of the Tribunal is not merely to review the decision of the Commissioner, applying judicial review principles, but to decide for itself, applying an objective test, whether appropriate steps have been taken, albeit giving weight to the views of the Commissioner as an expert regulator on any matter on which the Commissioner has exercised regulatory judgment. The key passage from Killock and Veale is as follows:

84 There is nothing in the statutory language to suggest that the question of what amounts to an appropriate step is determined by the

opinion of Commissioner. As Mr Black submitted, the language of section 165 and section 166 is objective, in that it does not suggest that an investigative step in response to a complaint is appropriate because the Commissioner thinks that it is appropriate: her view will not be decisive. Nor has Parliament stated that the Tribunal should apply the principles of judicial review which would have limited the Tribunal to considering whether the Commissioners approach to appropriateness was reasonable and correct in law. In determining whether a step is appropriate, the Tribunal will decide the question of appropriateness for itself.

85 However, in considering appropriateness the Tribunal will be bound to take into consideration, and give weight to, the views of the Commissioner as an expert regulator. The GRC is a specialist tribunal and may deploy (as in Platts ) its non-legal members appointed to the Tribunal for their expertise. It is nevertheless our view that, in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations. As Mr Milford emphasised, her decisions about these matters will be informed not only by the nature of the complaint itself but also by a range of other factors, such as her own regulatory priorities, other investigations in the same subject area and her judgment on how to deploy her limited resources most effectively. Any decision of a tribunal which fails to recognise the wider regulatory context of a complaint and to demonstrate respect for the special position of the Commissioner may be susceptible to appeal in this chamber.

86 We do not mean to suggest that the Tribunal must regard all matters before it as matters of regulatory judgment: the Tribunal may be in as good a position as the Commissioner to decide (to take Mr Milford’s example) whether a complainant should receive a response to a complaint in Braille. Nor need the Tribunal in all cases tamely accept the Commissioner’s judgment which would derogate from the judicial duty to scrutinise a party’s case. However, where it is established that the Commissioner has exercised a regulatory judgment, the Tribunal will need good reason to interfere (which may, in turn, depend on the degree of regulatory judgment involved) and cannot simply substitute its own view.

87 Moreover, section 166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the

timely resolution of a complaint. The Tribunal is tasked with specifying

appropriate ‘steps to respond’ and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question. We do not rule out circumstances in which a complainant, having received an outcome to his or her complaint under section 165(4)(b), may ask the Tribunal to wind back the clock and to make an order for an appropriate step to be taken in response to the complaint, under section 166(2) (a). However, should that happen, the Tribunal will cast a critical eye to assure itself that the complainant is not using the section 166 process to achieve a different complaint outcome.

88 The same reasoning applies to orders under section 166(2) (b) requiring the Commissioner to inform the complainant of progress on the complaint or of the outcome of the complaint within a specified period. These are procedural matters (giving information) and should not be used to achieve a substantive regulatory outcome.

44.

In Killock and Veale itself, the Upper Tribunal went on to dismiss the section 166 application. In that case, the Commissioner had considered a complaint and undertaken some investigation, but then decided to take the complaint itself no further (although a related but separate investigation continued). The Upper Tribunal treated this discontinuance as the outcome of the complaint and held that the request for further steps to be taken to investigate the subject matter of the complaint was an impermissible attempt to ‘wind back the clock’ and achieve a different complaint outcome (see [105]).

45.

In the joined case of EW v IC , by contrast, the Commissioner had misapplied his own policy and declined to engage at all with the data subject’s complaint. There had been no investigation. The Upper Tribunal ordered the Commissioner to take further appropriate steps to investigate and to respond to the complaint within a specific timescale (see [118]).

46.

Killock and Veale was considered further in R (Delo) v Information Commissioner [2024] 1 WLR 263 . In Delo the claimant had made a subject access request to a financial services company and then complained to the Information Commissioner about the company’s response. Having received and reviewed the complaint, the Commissioner decided to take no further action, finding that the scope of the complaint was too widely drawn and that the company was likely to be exempt from giving the disclosure sought. That decision was maintained on a reconsideration. The claimant brought a claim for judicial review, contending that the Commissioner’s decision to take no further action was unlawful. The High Court (Mostyn J) dismissed the claim and the Court of Appeal dismissed the claimant’s appeal.

47.

The Court of Appeal (Warby LJ giving the leading judgment) upheld Mostyn J’s judgment that the Commissioner was not required to determine every complaint on its merits (see [62]), but only “to address and deal with every complaint by arriving at and informing the complainant of some form of ‘outcome’, having first investigated the subject matter ‘to the extent appropriate’ in the circumstances of the case” ([63]). The Court of Appeal also noted that “there are also second tier obligations, to inform the complainant of the progress of the investigation and of the complaint”. The Court of Appeal further held that an “outcome” in this context could include a decision not to investigate further, not just a merits assessment ([64]). At [80] Warby LJ concluded as follows:-

“80.

For the reasons I have given I would uphold the conclusion of the

judge at [85] that the legislative scheme requires the Commissioner to

receive and consider a complaint and then provides the Commissioner

with a broad discretion as to whether to conduct a further investigation

and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint.”

48.

The Court of Appeal went on to hold (at [90]) that Mostyn J had been right to find that the Commissioner had acted lawfully in that case in declining to investigate the complaint further.

49.

In reaching its judgment in that case, the Court of Appeal specifically considered the decision of the Court of Justice in Data Protection Comr v Facebook Ireland Ltd ( Case C-311/18 ) [2021] 1 WLR 751 , in which (among other things) the Court of Justice emphasised that “the supervisory authority is … required to execute its responsibility for ensuring that the GDPR is fully enforced with all due diligence”. At [68]-[71] Warby LJ explained why these dicta of the Court of Justice added nothing to its analysis of the legislation: it remained the case that the Commissioner enjoys a discretion, the exercise of which was challengeable on judicial review on the usual judicial review principles.

50.

In the course of its judgment, the Court of Appeal also considered the question of alternative remedies, as the High Court will not normally permit a claimant to proceed by way of judicial review if they have an adequate alternative remedy available to them.

51.

At [72]-[80], the Court of Appeal concluded that the fact that a data subject could also choose to pursue a claim against the data controller (under Article 77 GDPR) did not prevent the data subject judicially reviewing the Commissioner in respect of his handling of a complaint; these remedies were not in the Court’s view mutually exclusive and may be pursued concurrently.

52.

Earlier in the judgment, at [41]ff, the Court of Appeal also addressed the Commissioner’s argument that the availability of a right to apply to the First-tier Tribunal under section 166 was an alternative remedy that should have resulted in permission being refused in the judicial review or the judicial review claim being dismissed.

53.

This argument had been run (albeit not in quite the same form) before Mostyn J. Mostyn J had firmly rejected the Commissioner’s attempt to persuade him that section 166 presented an adequate alternative remedy for the claimant in that case. He held ( [2023] 1 WLR 1327 at [128]) that section 166 did not provide an adequate alternative remedy to a judicial review claim because it “applies only where the claim is pending and has not reached the outcome stage” and “only to alleged deficiencies in procedural steps along the way and clearly does not apply to a merits-based outcome decision”. In his judgment, Mostyn J also made further observations, building on what had been said by the Upper Tribunal in Killock and Veale , about the possibility of using section 166 to ‘wind back the clock’ after the Commissioner has ostensibly provided an ‘outcome’ to a complaint. At [131] Mostyn J held, with respect to the Commissioner’s argument that the claimant was in reality ‘merely’ seeking an order requiring the Commissioner to take appropriate steps in relation to the complaint so that section 166 provided an appropriate alternative remedy:

“131.

For my part, if an outcome has been pronounced, I would rule out any attempt by the data subject to wind back the clock and to try by sleight of hand to achieve a different outcome by asking for an order specifying an appropriate responsive step which in fact has that effect. The Upper Tribunal rightly identified in [77] that if an outcome was pronounced which the complainant considered was unlawful or irrational then they can seek judicial review in the High Court. ...”

133 In my judgment this [the Commissioner’s argument] is precisely the sort of sleight of hand with which I disagree. The commissioner’s argument seeks to clothe a merits-based outcome decision with garments of procedural failings. The substantive relief sought by the claimant was disclosure of the documents. The commissioner’s argument is that the tribunal could have made a mandatory procedural order specifying as a responsive step the disclosure of those very documents.

54.

On appeal, the Court of Appeal declined to decide whether Mostyn J was right about what he had said in these passages or not, but recorded the Commissioner’s submissions as to why Mostyn J was wrong, noting in the following passage that the Commissioner’s argument was an important one and thus indicating that it was one that might fall to be determined in future:

46 The Commissioner submits that the judge was wrong to hold that section 166 applies only where a complaint is ‘pending’ and has not reached an ‘outcome’. A data subject is always entitled to complain to the First-tier Tribunal of any failure by the Commissioner to ‘handle’ a complaint or to ‘take appropriate steps’ to respond to it (such as to investigate ‘to the extent appropriate’. These rights are not taken away just because the Commissioner complies with his duty to provide an ‘outcome’. So, a data subject who complains that the Commissioner has provided an ‘outcome’ without first ‘handling’ the complaint or taking ‘appropriate steps’ to respond or investigate it can rely on section 166 . In such a case, the FtT has jurisdiction. Judicial review is not necessary or appropriate.

47 All the more so, says the Commissioner, when section 167 creates the potential for a claim to enforce the provision of subject access by the data controller. That, it is submitted, is a direct means of providing what claimant such as Mr Delo is ultimately after when he seeks to enforce his rights against the Commissioner via an application to the FtT or a claim for judicial review. All of this is said to apply equally if, as Mr Delo contends the obligation to provide the data subject with an ‘outcome’ means that the Commissioner must determine the merits of the complaint.

48 I can see the logic of the argument about the scope of section 166 . And it may be that in a case where section 166 does not avail the claimant because his grievance is about the ‘outcome’ of a complaint to the Commissioner) a private law claim against the data controller under section 167 could be considered an adequate alternative to judicial review I am not convinced that refusal of judicial review on that basis would necessarily be at odds with the CJEU’s reasoning in BE . But I do not think this is the right case in which to decide these points.

49 The Commissioner’s argument about the effect of section 166 is an important one but it is subtle and it was raised belatedly. He evidently failed to make it clear in the court below. We do not have the benefit of the lower court’s assessment of that contention. Nor, as it happens, do we have the lower court’s view on the section 167 argument. Whatever their merits those arguments would provide no answer to Mr Delo’s Ground 3, so judicial review claim was the only means of pursuing that aspect of the claim. And for reasons I have already given, the public interest favours decision from this court on all the substantive issues raised by the appeal.

55.

The parties in the present appeal have also referred me to two permission decisions of Judge Wikeley. The first, Lawton v Information Commissioner (UA-2021-000457-GIA and UA-2022-000676-GIA), was decided after Killock and Veale and the High Court decision in Delo , but before the Court of Appeal decision in Delo . The second, Cortes (UA-2023-001298-GDPA), was decided after the Court of Appeal decision in Delo .

56.

For the moment, I only need to refer to Lawton for what Judge Wikeley says at [21]-[29] about the doctrine of precedent and how it applies in relation to the decision of the panel of two judges and one specialist member who decided two out of the three cases in Killock and Veale and also the decision of Mostyn J in Delo . In short, Judge Wikeley concludes that neither are strictly speaking binding on a single judge of the Upper Tribunal, but that as a matter of comity a single judge should generally follow such a decision unless convinced the decisions are wrong. I agree with Judge Wikeley and in this case I have found no reason to disagree with the Upper Tribunal’s decision in Killock and Veale . As to Mostyn J’s decision in Delo , as I have noted, aspects of his decision were called into question by the Court of Appeal’s judgment in that case and, insofar as he went further than the Upper Tribunal in Killock and Veale in narrowing the scope of section 166 , I decline to follow his judgment. I explain why below in the context of considering Judge Wikeley’s decision in Cortes .

57.

Judge Wikeley’s decision in Cortes contains an analysis of the substance of the decisions in Killock and Veale and Delo . At [31]ff, Judge Wikeley summarised the law as it appeared to him to be in the light of Killock and Veale and Delo as follows:-

31.

I am satisfied that I am bound by both Killock and Veale and R (on the application of Delo) . The thrust of the case law and its direction of travel is very clear, and cannot be derailed by the fact there is a pending reference to the CJEU in AB v Land Hesse ( Case C-64/22 ). The domestic decisions demonstrate beyond any doubt that the nature of section 166 is that of a limited procedural provision. Professor Engelman argues, however, that section 166 in effect enables Mr Cortes to challenge whether the Commissioner has investigated the subject matter of the complaint to the extent appropriate and thus as a potential failure to take appropriate steps to respond to the complaint

(see DPA 2018 s.166(1) (a), (2)(a) and (4)). But this is just another example of the “sleight of hand” identified by Mostyn J in R (on the application of Delo) ; it is an attempt to clothe a merits-based outcome decision with the garments of procedural failings. If the FTT were to order the Commissioner under section 166 to take further alternative steps, in the absence of quite exceptional circumstances such as those in EW v IC , then the outcome of the complaint would necessarily be subject to an impermissible collateral challenge – a challenge that the case law confirms beyond any doubt could only be launched by way of a judicial review.

32.

In sum, Article 77.2 provides for an effective judicial remedy where “the Commissioner does not handle a complaint”. Mostyn J ruled that ‘handling’ a complaint includes not acting on a complaint as well as rejecting it (at [68]). Further, Mostyn J acknowledged the very wide scope of the Commissioner’s discretion to handle complaints under section 166 as he thinks best. Indeed, it extended as far as permitting the Commissioner to take no further action on even a non-spurious complaint, a finding echoed by the Court of Appeal. However, in this instance the Commissioner plainly handled Mr Cortes’ complaint, albeit he handled it in a manner and to an end which left Mr Cortes dissatisfied. But the purpose of section 166 is also evident from its heading – it provides for “Orders to progress complaints”, not for “Orders to re-open or re-investigate complaints”.

33.

The short answer to Mr Cortes’ case is that his complaint had been progressed to an outcome, and so there was no longer any scope for a section 166 order to bite. As Mostyn J held, section 166 “by its terms applies only where the claim is pending and has not reached the outcome stage” (at [128]; presumably in that passage the word ‘claim’ must be a typo for ‘complaint’). In the same vein, the Upper Tribunal ruled in Killock and Veale that “ s.166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court). It will do so in the context of securing the progress of the complaint in question” ( Killock and Veale , paragraph 87). As such, the fallacy in the Applicant’s central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation, and thereby launch a collateral attack on the outcome itself with the aim of the complaint decision being re-made with a different outcome. Such a scenario would be inconsistent with the purport of Article 78.2, the heading and text of section 166 and the thrust of the decisions and reasoning in both Killock and Veale and R (on the application of Delo) . It would also make a nonsense of the jurisdictional demarcation line between the FTT under section 166 and the High Court on an application for judicial review.

58.

It will be noted that Judge Wikeley in that case mentions the then pending reference to the Court of Justice in Land Hessen Case C-768/21 . The Court of Justice’s judgment in that case was promulgated on 26 September 2024, although neither party in this case has referred to it. I note that it places considerable emphasis on the principle from the Facebook case as to the obligation of the supervisory authority to deal with all complaints “with all due diligence”, and holds that the discretion the supervisory authority enjoys as to the manner in which it decides to remedy any shortcoming found on an investigation is “limited by the need to ensure a consistent and high level of protection of personal data through strong enforcement of the rules”([37]). However, the principle from the Facebook case was considered by the Court of Appeal in Delo as I have noted and found by the Court of Appeal to make no difference to its analysis in that case. The Facebook case was also considered by the Upper Tribunal at [46]-[49] of Killock and Veale . As such, it seems to me that it is not capable of having any bearing on the proper interpretation and application of section 166 which Killock and Veale and Delo have held to be a matter of domestic law interpretation. What the Court of Justice says in Land Hessen may have some bearing on the approach that the High Court might take in future to judicial reviews of decisions of the Commissioner in relation to GDPR compliance.

59.

That said, I do not wholly share Judge Wikeley’s view as to the narrowness of the scope of the remedy available under section 166 . Judge Wikeley’s decision in Cortes is a permission decision, reached after an oral hearing attended only by the appellant and at which Judge Wikeley did not therefore have the benefit of full argument. The decision in Cortes proceeds on the basis that the Court of Appeal in Delo wholly endorsed Mostyn J’s judgment. However, as noted above, the parties’ arguments in the present case have brought to my attention that this is not so as far as concerns what Mostyn J said about section 166 applying only where a complaint is “pending” and has not reached an “outcome”; the Court of Appeal’s judgment leaves a question mark over that aspect of Mostyn J’s judgment. It also seems to me that what Mostyn J said in Delo in this respect may go further than what the Upper Tribunal said in Killock and Veale and, if and insofar as it does, I decline to follow Mostyn J and prefer the analysis in Killock and Veale , which it seems to me is unaffected by the question mark left over Mostyn J’s judgment by the Court of Appeal in Delo .

60.

I do not, though, consider that there is any real doubt about the legal principles applicable in this case. The difference between what Mostyn J said at [130]-[131] of his judgment and the argument that the Commissioner sought to run in the Court of Appeal is really one of emphasis rather than principle. I do not read Mostyn J’s judgment at [130]-[131] as saying that, just because the Commissioner has provided an ‘outcome’, there is no scope at all for an application to the First-tier Tribunal under section 166 . Rather, he is making the same point that the Upper Tribunal made in Killock and Veale , i.e. that the scope for finding that an “appropriate step” has been omitted once an ‘outcome’ has been produced is limited. This is the effect of all the authorities, it seems to me. They all hold that, on an application under section 166 , it is for the Tribunal to decide, applying an objective test, if an “appropriate step” has been omitted, but observe that, in practice, that is unlikely to be the case where an ‘outcome’ has been produced. That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an “appropriate” step has been omitted is limited.

61.

However, the authorities do not preclude an order being made for an appropriate step to be taken even where an outcome has already been provided. One ready example where that is likely to be appropriate is (it seems to me) where the Commissioner’s outcome only deals with part of a complaint and fails to deal with another part of the complaint as a result of oversight or other mistake. In other words, a case where effectively a single complaint is dealt with in part as the Commissioner dealt with the complaint in the Killock and Veale case itself, while the other part is treated like the complaint in the EW v IC case that was considered by the Upper Tribunal at the same time.

The Upper Tribunal’s jurisdiction on appeal

62.

The Upper Tribunal’s jurisdiction under sections 11 and 12 of the Tribunals, Courts and Enforcement Act 2007 ( TCEA 2007 ) is to consider whether the First-tier Tribunal’s decision involved the making of an error on any point of law.

63.

Errors of law include misunderstanding or misapplying the law, taking into account irrelevant factors or failing to take into account relevant factors. An error of fact is not an error of law unless the First-tier Tribunal’s conclusion on the facts is perverse. That is a high threshold: it means that the conclusion must be irrational or wholly unsupported by the evidence. An appeal to the Upper Tribunal is not an opportunity to re-argue the case on its merits. These principles are set out in many cases, including R (Iran) v SSHD [2005] EWCA Civ 982 at [9]-[13], per Brooke LJ.

64.

A failure to give adequate reasons for a decision is itself an error of law. A Tribunal does not need to set out every step in their reasoning or even to deal with every point raised by the parties, but reasons will not be adequate if they do not deal with the substantial points in the case or are insufficient to enable the parties to understand why they have won or lost and any appellate tribunal to see there has been no error of law: see, eg. R (Jones) v First-tier Tribunal (Social Entitlement Chamber) [2013] UKSC 19 , [2013] 2 AC 48 per Lord Hope at [25] and R (Iran) v SSHD ibid at [13]-[16]). It must also be remembered that, in some cases, reasons may be adequate even if implicit rather than explicit. As Lord Lane CJ put it in R v Immigration Appeal Tribunal, ex parte Khan [1983] QB 790 at 794, “in some cases it may be perfectly obvious [what the Tribunal is addressing its mind to] without any express reference to it by the Tribunal”.

65.

I also bear in mind the observations of the EAT (Elias J presiding) in ASLEF v Brady [2006] IRLR 576 at [55] that an appellate tribunal must respect the factual findings of a first-tier tribunal “and should not strain to identify an error merely because it is unhappy with any factual conclusions; it should not ‘use a fine toothcomb’ to subject the reasons of the [first-tier tribunal] to unrealistically detailed scrutiny so as to find artificial defects; it is not necessary for the Tribunal to make findings on all matters of dispute before them nor to recount all the evidence, so that it cannot be assumed that the [appellate tribunal] sees all the evidence; and infelicities or even legal inaccuracies in particular sentences in the decision will not render the decision itself defective if the Tribunal has essentially properly directed itself on the relevant law.” 

The parties’ submissions

66.

In advance of the oral hearing, the appellant had set out his grounds of appeal in in his application for permission to appeal. The Commissioner provided a response to the appeal on 8 August 2024, to which the appellant provided a reply on 9 September 2024 and an amended reply on 7 October 2024. At the hearing, the parties made oral submissions, with the appellant also making oral submissions in reply. During the course of the hearing, I identified two matters relating to what I have now identified in my judgment above as being the Commissioner’s apparent failure to explain why he considered the ICO had complied with the UK GDPR despite the points made in the appellant’s email of 14 December 2022. The parties provided further submissions in response to my directions following the hearing. I have taken full account of all their submissions, although in my discussion and conclusions below I only set out such of their submissions as it has been necessary to address in order to determine the appeal.

The grounds of appeal: discussion and conclusions

67.

There are five grounds of appeal. Ground 1 is a reasons challenge. It is convenient to deal with that ground last.

Ground 2: The Tribunal erred by ruling that the Commissioner was not biased and by reaching the wrong conclusions about the Commissioner’s motives, and their consequences

The parties’ submissions on Ground 2

68.

This ground relates to [10] of the First-tier Tribunal’s decision. The appellant complains that the Tribunal should have treated the Commissioner as “a biased regulator” in this case because it involved the Commissioner in his regulatory capacity investigating himself in his capacity of ICO data controller. The appellant argues that the Commissioner therefore had a motive not to follow a procedurally proper investigation because of his prior dealings with the appellant. The appellant submits that this is an error of law because the Commissioner is as a matter of law biased when investigating complaints against himself. The appellant submits that this is a material error because it led the Tribunal to fail to apply an objective test as to whether the Commissioner had carried out a proper investigation and taken appropriate steps in this case. The appellant argues that as the Commissioner is biased in this case, the Tribunal should not have afforded any respect for his expertise as regulator, as the Upper Tribunal at [76] and [85] in Killock and Veale held a Tribunal must do in all cases.

69.

In the course of oral submissions, the appellant clarified that he was not arguing that the Commissioner was disqualified from determining his complaints about the ICO on bias grounds. That is important, because normally if an allegation of bias is made out, the biased person is disqualified from taking the decision in question (unless the parties waive their right to object in a particular case). That is not, however, how the appellant deploys his bias argument in this case. Pragmatically, the appellant accepts that there is nothing that can be done about the fact that the Commissioner needs to investigate himself if a complaint is made about the ICO’s compliance with his obligations as a data controller under the UK GDPR.

70.

The appellant’s argument in this case is instead one about the Tribunal’s approach to the evidence and to the question of what is ‘appropriate’ for the purposes of his section 166 application. His point (as I understand it in substance) is that the Commissioner is, when investigating a complaint against himself, inevitably apparently biased because he is being what is termed ‘a judge in his own cause’ and that breaches the fundamental principle of nemo iudex in causa sua (Latin meaning ‘no one may be a judge in their own cause’). That is normally a ground for automatic disqualification of a decision-maker: see R (CPRE Somerset) v South Somerset District Council [2022] EWHC 2817 (Admin) at [21] per Chamberlain J. However, the appellant, accepting that it is inevitable under the legislation that the Commissioner must decide complaints about himself, argues that this fact of apparent bias should lead a Tribunal in such cases not to afford any respect to the views of the Commissioner as the expert regulator and to approach the Commissioner’s case with scepticism.

71.

The Commissioner in response argues that the Commissioner was neither apparently nor actually biased in this case and the Tribunal was right to give the appellant’s argument short shrift. The Commissioner contends that there is nothing in the appellant’s case that comes close to meeting the test in Porter v Magill [2002] 2 AC 357 that “the fair minded and informed observer, having considered the facts, would conclude that there was a real possibility that the [decision-maker] was biased”. The Commissioner emphasises that the Commissioner is the statutory regulator with institutional competence conferred by Parliament and has a staff of more than 500 individuals undertaking different regulatory functions. The Commissioner submits the fair-minded and informed observer would not consider that the complaints-handling officers were apparently biased when dealing with complaints about other departments. He refers to Runa Begum v Tower Hamlets London Borough Council [2003] UKHL 5 , [2003] 2 AC 430 , concerning the lawfulness of the scheme under the Housing Act 1996 whereby the right to a review of the local authority’s decision on a person’s eligibility for housing lies internally to another local authority officer.

72.

In Runa Begum the Supreme Court held that the scheme was not incompatible with Article 6 of the European Convention on Human Rights because these were administrative functions, and the exercise of administrative functions did not require a direct right of appeal to an independent and impartial tribunal. Article 6 was satisfied by dint of the availability of a right to review of that administrative decision by a court with full jurisdiction of fact and law. At [46] the Supreme Court specifically considered and rejected the suggestion that an appearance of bias by the internal reviewing officer might be avoided by contracting out the review function.

73.

Mr Metcalfe also refers to Field v London Borough of Barnet [2004] EWCA Civ 1307 , which concerns the same scheme and in which the argument was whether, notwithstanding the Supreme Court’s decision in Runa Begum , the decision of the internal reviewing officer was vitiated by apparent bias, whether generally because the reviewing officer was another reviewing officer or, in Barnet’s case, because it was the same officer who took the first decision (Barnet only employing one reviewing officer). The Court of Appeal in that case held that there was no apparent bias as a result of a review being carried out ‘in house’ or even by the same decision-maker. The Court of Appeal alluded to its own practice of allowing the judge who had refused permission on the papers also to sit on the hearing of a renewed oral application for permission. See [44].

74.

The Commissioner further submits, in reliance on R (Hussain) v Sandwell Metropolitan Borough Council [2018] PTSR 142 at [154] that “proof of actual bias may be exceedingly difficult to establish” and requires “drawing a causal connection between the biased state of mind and the decision”. The Commissioner submits there was no such evidence in this case and the Tribunal was right so to conclude.

Analysis and conclusions: (i) the apparent bias argument

75.

I have some sympathy with the appellant’s frustration with the Tribunal for failing to acknowledge that the Commissioner investigating a complaint against himself is, at least on the face of it, in breach of the nemo iudex in causa sua principle. On the face of it, the Commissioner is indeed acting as a judge in his own cause. The Commissioner’s position is, it seems to me, different to that of the local authorities in the Begum and Field cases to which the Commissioner has referred. Those cases were concerned with internal reviews of administrative functions of the local authority. The internal reviewer under the Housing Act 1996 has no ‘outward facing’ role as the Commissioner does, and no responsibility for investigating the actions of other local authorities. The internal reviewer at the local authority is not a public regulatory body.

76.

The Commissioner, in contrast, is primarily responsible for regulating other data controllers and public authorities and only occasionally has to fulfil the same role while investigating complaints against himself as ICO. When doing so, he does so after he has, in his ICO capacity, already made one decision on the case and often (as happened in this case) also carried out an ‘internal’ review of the sort that other public authorities must carry out in FOIA cases before someone can complain to the Commissioner (which ‘internal’ review is probably closest to the review role under consideration in the Begum and Field cases).

77.

I can understand why the appellant feels that these features put the Commissioner in a different position when he is investigating complaints against himself to that of the local authorities in Begum and Field and why he argues that there is an appearance of bias.

78.

However, I also understand why the appellant takes what he presents as the pragmatic approach of not arguing that the Commissioner is disqualified on bias grounds from investigating complaints against the ICO. This is because it is difficult to see how the role of information commissioner could have been set up without this feature: even if the handling of complaints about the ICO’s activities as data controller was allotted to an alternative public body, the result would be that the alternative public body was then itself a data controller, and a further public body would be needed to investigate the activities of the first alternative public body, and so on ad infinitum (to use more Latin, meaning ‘to infinity’). The only obvious way to avoid that would be for there to be a direct right of appeal to a court or tribunal in place of a complaint to the Commissioner in cases concerning the ICO’s compliance. However, Parliament has not seen fit to take that approach. I have not in this case been provided with any Parliamentary materials explaining this decision, but it strikes me that a direct right of appeal to the First-tier Tribunal in cases where someone complains that the ICO has failed to comply with the UK GDPR would appear to be redundant, given that a person who considers the ICO has failed to comply may pursue a civil claim to the County Court or seek judicial review in the High Court.

79.

Against that background, it seems to me that, although the appellant presents his position in this appeal as being one of pragmatism, the fact that the appellant stops short of arguing that the Commissioner is disqualified from investigating himself is significant. It could be said that this is an implicit acknowledgment by him that the fair-minded and informed observer would not conclude that there was real possibility of bias merely because the Commissioner, in the exercise of his regulatory functions, sometimes has to investigate his own actions.

80.

The Commissioner in response to the grant of permission in this appeal pointed out that the Commissioner “is the statutory regulator in this sphere, with institutional competence conferred by Parliament, and with a staff of more than 500 individuals undertaking different regulatory functions”. These factors, together with the observations of the Court of Appeal in Field at [44]-[48] about the circumstances in which an appearance of bias will not arise merely because a public authority is tasked by Parliament with reviewing the lawfulness of its own decisions, should in my judgment be sufficient to satisfy the fair-minded, and not unduly sensitive or suspicious observer, that there is no appearance of bias where the Commissioner investigates himself.

81.

If I had to decide in the present case, on the basis of the material before me, whether the Commissioner is disqualified from investigating the actions of the ICO as a result of an appearance of bias, I would therefore reject that argument.

82.

However, there are three reasons why it seems to me that it is unnecessary and/or inappropriate for me to make a final determination of that question in these proceedings. First, because the appellant stops short of contending that the Commissioner was disqualified from carrying out that role in this case so the issue is not in truth squarely before me, despite the importance that the point has for the appellant. Secondly, because (as the Commissioner submits) this is a section 166 application which is, as the authorities discussed above make clear, essentially a procedural remedy which should not be expanded to achieve ‘by the back door’ what ought properly to be the subject of a judicial review challenge in the High Court. A challenge to the lawfulness of the statutory scheme that has left the Commissioner responsible for investigating himself is quintessentially the sort of challenge that would be better considered in the High Court. Thirdly, and relatedly, as a result of the way the argument has been raised by the appellant, I do not have before me the evidence or submissions that would be needed fully to consider an apparent bias challenge: I would need before me all the material that would be available to the well-informed observer, which would include evidence from the Commissioner as to how the Commissioner arranges his staff and functions and what steps are taken to ensure impartiality when the Commissioner investigates the ICO. Further evidence as to the government’s or Parliament’s intentions or thinking in setting up the statutory scheme would likely also be useful.

83.

What I do have to decide in this case, it seems to me, is whether there is enough in the appellant’s bias argument to mean that the Tribunal should take a different approach to section 166 cases where the Commissioner is asked to investigate the ICO, than in other cases. For the reasons I set out below, I have ultimately decided that I do not accept the appellant’s argument in this respect as a matter of principle, although I do have some concerns about the way that the Tribunal has expressed its decision in this case which bear on this argument and which I need to address.

(ii)

My concerns about the Tribunal’s self-directions as to the law

84.

My first concern is this: the Tribunal in the present case at [10] and [11] directed itself that it had to consider whether it had “a good reason to interfere with the Commissioner’s regulatory judgment”. However, what the Upper Tribunal in Killock and Veale decided is the task for the Tribunal on a section 166 application is that the Tribunal must decide for itself, applying an objective test, what is “appropriate” by way of investigation: see [84]. The Upper Tribunal made clear that the Tribunal is not merely to review the Commissioner’s decision as the High Court would on an application for judicial review.

85.

It would have been better if the Tribunal in the present case had given itself an explicit direction to that effect. As it is, the phrase “a good reason to interfere with the Commissioner’s regulatory judgment” has been taken by the Tribunal out of context from [86] of Killock and Veale . What the Upper Tribunal in Killock and Veale said at [85]-[86] was that, in deciding for itself whether a step is “appropriate”, the Tribunal must take account of, and give weight to, the view of the Commissioner as an expert regulator on any matter “where it is established that the Commissioner has exercised a regulatory judgment”.

86.

The danger in the Tribunal’s self-direction only to consider whether there is “good reason to interfere with the Commissioner’s regulatory judgment” is that it makes it look at first blush as if the Tribunal is applying a judicial review approach of reviewing the Commissioner’s decision rather than an objective test as the Upper Tribunal in Killock and Veale held was required.

87.

My second concern is that the Tribunal has also at [9] quoted from [76] of the Upper Tribunal’s judgment in Killock and Veale , which is not actually the part of the judgment that was relevant in this case. Paragraph [76] of Killock and Veale is in the part of the judgment discussing the dividing line between the High Court’s role on judicial review and the remedy available under section 166 . The Upper Tribunal was there referring to the Commissioner being in the best position as the expert regulator to consider the merits of the complaint by way of explanation as to why the Tribunal’s jurisdiction under section 166 does not extend to the merits of the complaint at all. The relevant paragraphs of Killock and Veale for the Tribunal’s purposes in section 166 cases are [85] and [86]. At [85] the Upper Tribunal sets out what the relevant expertise of the Commissioner is so far as concerns the procedural aspects of complaints handling with which the Tribunal is concerned under section 166 . By way of reminder, what the Upper Tribunal said in that paragraph was:

… in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations. As Mr Milford emphasised, her decisions about these matters will be informed not only by the nature of the complaint itself but also by a range of other factors, such as her own regulatory priorities, other investigations in the same subject area and her judgment on how to deploy her limited resources most effectively.

88.

At [85], the Upper Tribunal thus holds that the Tribunal must, when deciding objectively whether any (further) appropriate step needs to be taken by the Commissioner, take into account and give weight to the views of the Commissioner as an expert regulator. At [86] the Upper Tribunal explains that it does not mean that the Tribunal must regard all matters before it as matters of regulatory judgment – it is those matters identified in the passage I have just quoted which constitute matters of regulatory judgment so far as the investigative process is concerned (i.e. regulatory priorities, other investigations in the same subject area and deployment of resources). The Upper Tribunal explains at [86] that it is only in respect of those matters where it is established that the Commissioner has exercised a regulatory judgment that the Tribunal will need “good reason to interfere” and “cannot simply substitute its own view”. The Upper Tribunal added that the extent of respect due to the Commissioner’s view “may in turn depend on the degree of regulatory judgment involved”.

89.

Although I have those concerns about the Tribunal’s decision in this case, there is in fact no ground of appeal that argues that the Tribunal has erred in law in the respects I have identified as troubling. And I am satisfied that, when the decision is read as a whole, it is apparent that the Tribunal has in fact properly taken an objective approach in this case and made up its own mind about appropriateness. Thus at [12], it applied its own mind to the question of the 7 February 2023 email and considered for itself what it meant and in [13] it expresses itself to be satisfied that the Commissioner has taken adequate steps to investigate in terms that indicate it has considered that for itself rather than merely reviewing the Commissioner’s approach. Further, although the Tribunal has failed to consider explicitly which aspects of the Commissioner’s approach in this case constitute the exercise of regulatory judgment and which do not, it has in practice properly taken the approach of regarding the Commissioner’s decisions about how much investigation to do as being part of the Commissioner’s regulatory competence about deployment of resources, with which it should not interfere unless there is “good reason” to do so.

(iii)

The approach the First-tier Tribunal should take to section 166 applications where the Commissioner has been asked to investigate a complaint against the ICO

90.

However, all that still leaves the question of the appellant’s argument on this appeal that, as a “biased regulator” the Tribunal should not have afforded the Commissioner’s views any respect in this case. I disagree.

91.

As noted above, if I had had to decide in this case whether the Commissioner is apparently biased when investigating the ICO, I would have concluded that he was not. Nor do I consider that there is enough in the appellant’s apparent bias argument to justify or require the Tribunal to take any generally different approach to section 166 cases like this. Apparent bias is about appearances, not actuality. If there is an appearance of bias, that needs to be addressed by changing the role of the Commissioner in the statutory scheme, not by altering the legal principles that the Tribunal applies when considering a section 166 application. The factors that make the Commissioner an expert regulator will in general apply equally in cases where the Commissioner is investigating himself. The Commissioner remains the expert regulator, both in terms of assessing the merits of a complaint (in respect of which his decisions may only be challenged by way of judicial review) and as to the procedural matters with which section 166 is concerned, including whether any steps should be taken to investigate a complaint at all and, if so, what resources to deploy on that investigation. In the ordinary course of events, and as a matter of principle, the team at the Commissioner responsible for dealing with such complaints can therefore be expected to approach the exercise with the same expertise and in the same way as they would complaints about a third party data controller - and so should the Tribunal.

92.

That said, the weight that the Tribunal gives to the Commissioner’s views in any particular case will inevitably vary depending on the nature of the case and the view that the Tribunal forms as to the quality of the decision-making on the part of the Commissioner in the particular case. It will generally be a relevant factor for the Tribunal to take into account in such cases that the Commissioner is investigating himself. However, the relevance of the identity of the data controller under investigation is really no more or less important in such cases than it is in other cases. Depending on the circumstances, the identity of the data controller (their profile, size, resources, whether or not they are a public authority, etc) may lead the Commissioner and (in turn) the Tribunal to take a different approach in a particular case.

93.

In all cases, the Tribunal must be astute on a section 166 application to consider whether there has been any actual bias or other improper conduct by the Commissioner in relation to the investigation, whether as a result of the identity of the data controller or otherwise. If there has been any actual bias or other improper conduct, the Tribunal will need to take these matters into account when deciding what weight to give to the views of the Commissioner in a particular case and whether to make any order for an appropriate step to be taken under section 166 .

(iv)

The First-tier Tribunal’s decision in this case

94.

In this case, though, the Tribunal has in my judgment done in substance exactly what was required of it. That is because it did, fully and properly, consider the evidence that the appellant relied on in this case as indicating that there may have been improper conduct or a desire by the Commissioner to ‘cover up’ a breach of the UK GDPR by the ICO. The evidence the appellant relied on in that respect was the 7 February 2023 email. The Tribunal addressed this at [12] and gave what are in my judgment adequate reasons for concluding that this email was not ‘the smoking gun’ that the appellant thought it was because, as the Tribunal understood that email, it “did no more than indicate that a lessons learned process should follow the outcome”. That was in my judgment a factual conclusion that was open to the Tribunal in this case. It is not perverse and it is not a conclusion with which it would be appropriate for me to interfere on appeal.

95.

As it happens, I agree with the Tribunal’s interpretation of the email because Ms Jones’ suggestion that the ICO should not be found in breach is presented as relating to the “first half” of Ms Keith’s email which was the part dealing with IC-67118-V8Y4 and the ICO’s explanation that RFA0804334 and RCC0854800 (among other references) had previously been preserved by one department at the appellant’s request, even though another department thought they should not be. In other words, Ms Jones appears to be referring to what was essentially the administrative issue of one department not knowing what the other was doing. It was clearly not a reference to any of the points that have been of principal concern to the appellant on this appeal about what he says was the failure by the Commissioner properly to investigate the subject matter of his complaint. Nor does it have anything to do with the now admitted error by the ICO/Commissioner that the ICO had wrongly regarded appeal EA/2022/0095 as concluded when it was not.

96.

As such, although it would have been better if the Tribunal had given itself fuller directions as to the law, and expressed its judgment less succinctly, I am satisfied that the appellant’s Ground 2 exposes no material error of law in the Tribunal’s decision.

97.

I therefore dismiss Ground 2.

Ground 3 : The Tribunal erred by failing to uphold the duty of candour

The parties’ submissions on Ground 3

98.

The appellant argues that the First-tier Tribunal erred in not specifically concluding that the Commissioner was subject to a duty of candour in section 166 applications when Judge Neville at an earlier case management stage had stated that the duty of candour did apply when refusing an application by the appellant for specific disclosure. The appellant further contends that the First-tier Tribunal treated the Commissioner as not being subject to the duty of candour because at [13] of the decision, the Tribunal took the Commissioner ‘at his word’ regarding what investigative steps had been carried out. The appellant considers that the duty of candour ought to have been applied and the Commissioner/ICO required to provide full disclosure and witness statements detailing his investigation and putting the 7 February 2023 email in context.

99.

The Commissioner in response submits that he is not subject to a duty of candour in relation to section 166 applications because there is no authority to this effect and it would be inappropriate to imply such a duty given the procedural nature of the application.

Analysis and conclusions

100.

The appellant’s submissions seem to me to misunderstand the duty of candour. It applies in judicial review proceedings because the duty of standard disclosure does not apply in such proceedings. Where the duty applies, the public authority is under a duty to co-operate with the court, to put ‘cards on the table’ so that the court is apprised of all matters relevant to the issue before the court, whether they help or harm the public authority’s case: see, eg, R v Lancashire County Council, ex p Huddleston [1986] 2 All ER 941 at 945. It is up to the public authority in the first instance to comply with that duty, whether by providing witness statements and/or disclosure. Although the court will make an order if what is provided is judged insufficient fairly to dispose of the proceedings, the onus is on the public authority in the first instance to decide what material is relevant and the duty may be complied with by disclosing documents and not providing a witness statement, or (conversely) by providing a witness statement but no documents: cf R (Sustainable Development Capital LLP) v SSBEIS [2017] EWHC 771 (Admin) at [80]. As such, the appellant’s assumption that he would have been provided with more documents or explanations if the duty of candour applied than if it did not, is not necessarily correct.

101.

The substance of the appellant’s complaint under this ground appears to be in part that he considers his prior application for disclosure should have been granted by Judge Neville at the case management stage. However, he did not appeal that decision and so that issue is not before me.

102.

Beyond that, the appellant’s complaint is that the Tribunal at the final hearing did not order further disclosure or production of a witness statement by the Commissioner. However, the Tribunal has properly directed itself in relation to the appellant’s requests in those respects at [14] and [15] and has asked itself whether it was necessary to the fair disposal of the appeal to order further disclosure or production of witness statements. That was the proper approach regardless of whether the duty of candour applied or not. The Tribunal concluded that it was not necessary to the fair disposal of the appeal to make further orders.

103.

There is accordingly no material error of law in the Tribunal’s approach and its case management decision to refuse further disclosure or statements was in my judgment one that was open to it to take in this case for the reasons it gave. Given that the duty of candour requires only that the public authority put before the court what is necessary for the fair disposal of the appeal, and the court does not normally question the public authority’s judgment in that regard without good cause, the First-tier Tribunal’s decision is in substance confirmation that if the duty of candour did apply, it had been complied with.

104.

I add this: in general, in section 166 cases, given their limited scope, all that will be necessary for the fair disposal of the application is for the Commissioner to put before the Tribunal the documentary trail demonstrating the steps taken in dealing with any complaint or, if that does not tell the story, a short witness statement from the officer who dealt with the complaint may be appropriate. Since the Tribunal is not concerned with the merits of the complaint, what is required by way of disclosure or witness statement will in most cases be neither extensive or elaborate, and there is certainly no requirement for the Commissioner to put in evidence justifying or explaining the merits of the decision he took on the complaint.

105.

In the light of those conclusions, I do not need to decide whether the Commissioner is subject to a duty of candour in relation to an application under section 166 as it can make no difference in this case. I do, however, observe that the duty of candour is not confined to judicial review proceedings. The duty of candour (whether in substance or in name) has been held to apply to other situations where a public body’s decisions are subject to challenge before a court or tribunal where the duty of standard disclosure does not apply. It is a duty that arises out of the public body’s duty to co-operate with the court or tribunal to achieve the right result in a case rather than seeking to ‘win at all costs’. See, for example, LS v Oxfordshire CC [2013] UKUT 135 (AAC) , [2013] ELR 429 at [50]-[51] and Nottingham Forest FC v HMRC [2024] UKUT 145 (TCC) at [53]. It is therefore difficult to see what principled objection there could be to the duty of candour applying in section 166 applications.

106.

Ground 3 is therefore dismissed.

Ground 4: The First-tier Tribunal erred in relation to what was the outcome of the appellant’s complaints

The parties’ submissions on Ground 4

107.

The appellant argues that, even if the Tribunal was right to interpret the 7 February 2023 email as doing no more than communicating that a “lessons learned” process should follow the outcome, the outcome he received from the Commissioner was “incompatible” with this because it just said that the ICO was compliant and made no mention of a lessons learned process.

108.

The Commissioner submits that there is no error of law in the Tribunal’s decision. It was open to the Tribunal to find that the email was not referring to a view that there had been a breach of UK GDPR, merely to a “lessons learned” process, and thus that the email was consistent with the outcome the appellant received. The Commissioner further submits that his obligations under the statutory regime are to take appropriate steps to respond to the complaint and to inform the complainant of the outcome. The Commissioner was not required to inform the appellant of an internal learning opportunity.

Analysis and conclusion

109.

I prefer the submissions of the Commissioner for the reasons he gives. I add that the mere fact that the 7 February 2023 email suggests that the “lessons learned” could be communicated to the appellant does not mean that the Commissioner was required to do so, or that it would have been appropriate for the Tribunal to order him to do so as the outcome to a section 166 application.

110.

Ground 4 is therefore dismissed.

Ground 5: The First-tier Tribunal failed to uphold the overriding objective

111.

I can also take this ground very shortly. The appellant contends that the First-tier Tribunal failed to uphold the overriding objective in three respects:

By failing to follow the observation of the judge at the case management stage that the duty of candour applies;

By handling his third ground of appeal before the Tribunal unfairly; and,

By failing to consider the appellant’s complaints that the Commissioner was not adhering to the overriding objective.

112.

The difficulty for the appellant with this ground of challenge is that a failure to comply with the overriding objective of the sort of which he complains can only amount to a material error of law on appeal if it results in material unfairness: see R (Iran) , ibid, at [9]-[10]. An error of this sort will not be material unless it could have affected the outcome of the appeal.

113.

As is apparent from what I have said above in relation to Ground 3, it made no difference in this case whether the duty of candour formally applied or not. I doubt that what Judge Neville said at the case management stage about the duty of candour did constitute a binding determination of that point because the res judicata principle only applies to matters that are necessary to a decision. However, as a matter of judicial comity, the Tribunal at the final hearing ought to have respected Judge Neville’s view and not departed from it without giving reasons. There is no material error of law here, though, becase even if the res judicata principle did apply so that the Tribunal at the final hearing should have agreed with Judge Neville that the duty of candour applied, it made no difference to the outcome in the appellant’s case for the reasons explained above in Ground 3.

114.

As to the First-tier Tribunal’s handling of the appellant’s third ground of appeal, the heart of the appellant’s complaint is that the First-tier Tribunal did not give him an opportunity to comment on its interpretation of the email of the 7 February 2023 at the hearing and that it decided this ground as preliminary issue at the hearing, albeit without giving reasons orally. It is sometimes the case that material unfairness will arise as a result of a Tribunal failing to give a party an opportunity to comment on its thinking, but in my judgment this is not one of those cases. The appellant had an opportunity to make submissions to the Tribunal about his interpretation of the email. Having considered those submissions, the Tribunal was entitled to reach its own view without specifically putting to him what it was thinking. This was just an issue in the appeal where, like most issues, the Tribunal was entitled to reach a judgment after hearing submissions without having to issue a ’provisional decision’ for further comment by the parties. Moreover, what the appellant says he would have said if given the opportunity was what he has now advanced as his ground 4 on this appeal. I have dismissed that ground and I cannot see how what he says there would have made any difference to the Tribunal’s view of the email.

115.

As to the appellant’s complaints that the Commissioner was not adhering to the overriding objective, there is nothing in those complaints that materially affected the fairness of the hearing or the issues that the Tribunal had to decide. The appellant is just advancing a catalogue of complaints about process and procedure, but none of these matters in the end prevented him from presenting his case to the First-tier Tribunal. The only aspect that was capable of materially affecting the hearing was the Commissioner’s possible failure to disclose all the documents the appellant wanted and/or the First-tier Tribunal’s refusal to order that, but, as already noted when dealing with Ground 3. that decision was actually taken by Judge Neville in a prior case management order that the appellant did not appeal and there was no error of law in the Tribunal not re-visiting that at the final hearing.

116.

The appellant also complains under this ground about the Tribunal’s decision to consider again a point that Judge Buckley addressed when considering the Commissioner’s strike-out application as to whether the appellant’s application was in substance a complaint about the merits of the Commissioner’s decision that should have been brought by way of judicial review rather than a section 166 application. However, there is no material error in relation to that either: (a) Judge Buckley was merely considering whether the appellant’s application should be struck out as standing no reasonable prospects of success; that did not mean the argument was fully determined – it was open to the First-tier Tribunal at the final hearing to consider the argument afresh applying the balance of probabilities standard that applies at final hearing stage; and (b) the appellant ‘won’ on this point so he cannot appeal it. There has, though, been argument on this issue before me because the Commissioner raised it as an additional ground for upholding the appeal. I deal with the arguments in this respect below in the section dealing with the Commissioner’s now admitted error in handling the appellant’s complaint.

117.

Ground 5 is therefore dismissed.

Ground 1: The First-tier Tribunal has provided inadequate reasons for its decision

118.

I deal with Ground 1 last because it treads much of the same territory as Grounds 1 to 4, but purely as a ‘reasons challenge’.

119.

The appellant argues, first, that the First-tier Tribunal has provided no reason for concluding that the Commissioner is not a biased regulator. I disagree. As I have explained above when dealing with Ground 2, as the appellant was not advancing a case that the Commissioner was disqualified from dealing with his complaint on grounds of apparent bias, the Tribunal did not need to deal with his bias argument as if that was his contention. Saying the argument was “speculative and unproven” was a sufficient way of articulating that the appellant had not done enough to make out either apparent or actual bias. The Tribunal properly focused on the evidence he presented that potentially went to ‘actual bias’ in this case, i.e. the 7 February 2023 and provided adequate reasons for rejecting that argument.

120.

The appellant of course also argues that the Tribunal provided no reason for rejecting his interpretation of the 7 February 2023 email, but in my judgment the Tribunal did provide adequate reasons: it stated that the email “did no more than indicate that a lesson learned process should follow the outcome” and that “it did not lead to a conclusion of fact … that there was a view internally that there had been a breach of data protection obligations on the part of the Commissioner” . The Tribunal is not obliged to provide “reasons for reasons”, and there is in reality little that can be said about why a short email like this is read one way rather than another. I was able to say more above when dealing with Ground 2 because that was necessary to deal with the arguments raised on appeal, but the Tribunal’s reasons were adequate to deal with the appeal as it was presented at first instance.

121.

The appellant complains that at [13] the First-tier Tribunal failed to provide adequate reasons for its conclusion that “there was nothing before it that gave rise to any indication that the Commissioner had not carried out an adequate investigation” . It goes on to explain the reasons for that conclusion as being that “the Commissioner … had considered the Applicant’s complaint, reviewed the correspondence stored on the Commissioner’s case management system, engaged with the IA team and inquired about the handling of the Applicant’s requests” and provided the appellant “with an outcome on 17 February 2023, further clarification on 27 February 2023 and a case review of that outcome on 25 July 2023” . The Tribunal has thus given appropriate reasons for its conclusion. The appellant’s complaint is that the Tribunal has not gone in detail through his submissions as to the additional steps that the Commissioner could have taken, but a Tribunal does not err in law if it does not deal with every item of evidence or the detail of every argument raised by a party. Given the starting point (discussed under Ground 2 above) that the Tribunal, when deciding for itself whether appropriate steps have been taken, should generally afford respect to the Commissioner’s views as to the extent to which his resources should be deployed in responding to that particular complaint, the reasons the Tribunal gives for its conclusion are adequate.

122.

The appellant complains that the First-tier Tribunal failed to give adequate reasons for concluding that the duty of candour did not apply. However, I have when dealing with Ground 2 explained how it is the appellant who has misunderstood the nature of the duty of candour. If the decision is read with a proper understanding of that duty, it becomes clear both why the Tribunal did not consider it needed to deal with the legal issue as to whether it applied in this case, and why the Tribunal concluded that it did not require further witness statements or underlying documentary evidence in order to deal with the appellant’s section 166 application.

123.

Finally, the appellant complains that the Tribunal did not provide adequate reasons for rejecting his arguments about breach of the overriding objective. However, the Tribunal was not required to deal with these arguments. The Tribunal’s task was to deal with the section 166 application in accordance with the overriding objective. Breach of the overriding objective is not a free-standing ground on which a person may bring a complaint to the First-tier Tribunal, and on appeal to the Upper Tribunal, it is only an argument that can succeed if the alleged breach was material to the decision. For the reasons I have given under Ground 5, there was no such breach in this case.

124.

Ground 1 is therefore dismissed.

The shortcomings in the Commissioner’s handling of the complaints and why they do not mean this appeal succeeds

125.

For the reasons set out above, I have dismissed each of the appellant’s grounds of appeal in this case and it is therefore unnecessary for me to deal with the Commissioner’s submissions as to the additional reasons why the First-tier Tribunal’s decision should be upheld. However, I now need to address the shortcomings in the Commissioner’s handling of the appellant’s complaint that have become apparent in the course of this appeal.

126.

As set out in the Background section (above), there was an oversight in the ICO’s response to the appellant’s Article 18 requests and a consequent omission in the Commissioner’s investigation of the appellant’s complaints in that the appellant’s email of 14 December 2022 was overlooked. As a result, the Commissioner has never provided the appellant with the reasons as to why he concluded that the ICO had complied with the UK GDPR in relation to his Article 18 requests despite the points that the appellant made in that email about (in particular): (i) the ICO’s mistake in thinking that appeal number EA/2022/0095 had concluded when that was not the case; and (ii) the ICO’s decision to delete a file relating to a FOIA request even though the appellant’s appeal against the Decision Notice issued by the Commissioner in respect of the ICO’s handling of that FOIA request was still ongoing.

127.

As a result of questions that I asked at the hearing of this appeal (in a quest to understand the background to the appeal as it had not become clear to me from the documents or the parties’ submissions), it is now accepted by the Commissioner that the ICO made a mistake about appeal number EA/2022/0095. It follows that at least IC-768610-G6C6 should have been retained in response to the appellant’s request in order to comply with Article 18(1)(c). The explanation for this mistake that the Commissioner has given is that the officer who drafted the 13 December 2022 email was told by “FOI complaints” that no appeal was pending in appeal number EA/2022/0095.

128.

There is no reason to disbelieve the Commissioner’s account in this respect as the content of the 13 December 2022 email reflects it and there is nothing to suggest that anyone at any point prior to me asking the question at this hearing realised that the appellant’s 14 December 2022 email had been overlooked. This is understandable because the appellant has never articulated his complaint about the actions of the ICO/Commissioner in that way, but has focused on other issues and taken what can fairly be described as a myriad of quite technical points. It has taken me a great deal more work on the documents than ought to have been necessary at this appeal stage for it to become apparent that there was in fact an error by the ICO/Commissioner in this case.

129.

The question is now: what, if any, significance does this admitted error have for the appellant’s appeal? In Mr Metcalfe’s written submissions following the hearing, the Commissioner submits: “this error was not material because, unbeknownst to the case officer, the case had already been marked for preservation by a different team”. I share the appellant’s surprise at that assertion because there has been no mention previously of IC-76861-G6C6 having been preserved. (The case references that were known at the time to have been preserved by a different team were RFA0804334 and RCC0854800.) However, that does not mean that the Commissioner is not correct now in stating that IC-76861-G6C6 was preserved by a different team; maybe it was, maybe it was not. Without reverting to the parties for further submissions/evidence, I will not know.

130.

There is also the question of the second issue about which I asked the Commissioner at the hearing, which was whether the Commissioner could identify where the Commissioner had set out his reasons for concluding that the ICO had complied with Article 18 when he decided to delete the file in relation to his handling of a FOIA request notwithstanding that the appellant’s appeal against the Commissioner’s Decision Notice in respect of that FOIA request was still ongoing. The Commissioner has not responded to that point, so I do not know whether what happened in this case with IC-65359-C1C7 reflects the ICO’s/Commissioner’s policy generally or not. On the face of it, it would be surprising and concerning if the ICO did normally delete files relating to FOIA requests before any appeal against any decision notice issued by the Commissioner in relation to that FOIA request had been concluded. While in practice the ICO may in fact pass the whole of such a file onto the Commissioner so that all relevant material truly is on the file relating to the Decision Notice, it seems to me to be important as a matter of principle that the ICO, like any third party public authority, should retain the original FOIA request file even where the Commissioner has issued a Decision Notice in that case and there is an appeal to the First-tier Tribunal. In many cases, it would be the third party public authority who would be defending that Decision Notice before the First-tier Tribunal and so would need to retain its files for that purpose. The ICO’s position should in principle be no different.

131.

These shortcomings in the Commissioner’s handling of the appellant’s case are matters of concern in general terms, and I have directed that a copy of this decision be placed before the Commissioner personally so that he may consider if there are any matters arising from my observations in this case that need to be addressed. However, the question for me on this appeal is whether the First-tier Tribunal materially erred in law in dealing with the appellant’s section 166 application.

132.

I do not consider that it did. This is a case where, if the appellant had advanced his case to the First-tier Tribunal on the straightforward basis that he had never received a response to his 14 December 2022 email, it would in principle have been open to the Tribunal to have ordered the Commissioner to take the appropriate step of responding to that email. If the appellant’s section 166 application had been put on that basis, the Tribunal could legitimately have viewed this as a case akin to EW v IC where a complaint (or part of one) had not been dealt with as a result of oversight or mistake by the Commissioner.

133.

However, the appellant did not advance his case to the Tribunal on that basis, and nor has he advanced his appeal on the basis that the Tribunal failed to recognise that that was his case. The appellant is acting in person. I bear in mind the inquisitorial nature of the Upper Tribunal’s jurisdiction and the overriding objective which requires me to avoid unnecessary formality and seek flexibility in the proceedings and to ensure, so far as practicable, that the parties are able to participate fully in the proceedings, which includes ‘levelling the playing field’ for litigants in person. However, it does not follow that it is appropriate for the Upper Tribunal to rewrite a party’s case in the way that would be necessary to fashion the shortcomings now discovered in the Commissioner’s investigation into successful grounds of appeal for the appellant.

134.

The overriding objective also requires that a case is dealt with in a way that is fair and just to both parties, proportionate to the importance of the case and avoids delay, so far as compatible with the proper consideration of the issues. Rewriting the appellant’s appeal at this stage would not be fair or just because the Commissioner and the First-tier Tribunal properly (respectively) responded to and dealt with the appeal that the appellant brought. Rewriting that now would give him a ‘second bite of the cherry’. Justice does not require that in this case, given that the appellant is a competent and experienced litigant and the case itself is concerned with a request for the retention of the sort of data that would in the context of an ordinary disclosure application be labelled as a “fishing expedition”, i.e. material that a party to legal proceedings has judged irrelevant or unnecessary to those proceedings, but which the other party wishes to obtain in the speculative hope that it might turn up something of use. The legal proceedings to which the retention requests relate are also now historic.

135.

Dealing with the shortcomings in the Commissioner’s investigation at this stage would also involve (further) delay as I am not in a position even now to make any final determination about what has happened with files IC-768610-G6C6 and IC-65359-C1C7. There are still matters that are not clear and on which further submissions would be required if I was to try to get to the bottom of what has happened in this case. It would not be in accordance with the overriding objective of dealing with cases in ways that are proportionate to the issues to go down that route in the present appeal.

136.

Yet further, the reality is that the heart of the appellant’s section 166 application, as he advanced it, was that he considered the outcome of his complaint was wrong/perverse as a result of the mistakes that he considered the Commissioner made and/or that the Commissioner had failed to give adequate reasons for the outcome. Those are all public law errors that could form the basis of a claim for judicial review of the Commissioner’s decision: see R (Iran) v SSHD [2005] EWCA Civ 982 at [9]-[13]. It is clear from Killock and Veale and Delo that challenges to the legal merits of the outcome of a complaint (and challenges to the adequacy of the Commissioner’s reasons for his decision are also challenges to the legal merits) should be taken to the High Court on judicial review. They should not be ‘dressed up’ as procedural errors and brought as section 166 applications to the First-tier Tribunal. The shortcomings in the Commissioner’s handling of the appellant’s complaints that have emerged on this appeal could and should have formed the basis for a judicial review challenge if they were to be pursued. Save to the extent that they could have been put before the First-tier Tribunal as a simple application that the Commissioner should take the appropriate step of responding to the appellant’s 14 December 2022 email that had been overlooked, the appellant’s complaints are in reality challenges to the merits of the Commissioner’s outcome decision and, as such, they belonged in the High Court and not in the First-tier Tribunal.

Conclusion

137.

For all these reasons, I conclude that the decision of the First-tier Tribunal does not involve any material error of law. I dismiss the appeal.

Holly Stout

Judge of the Upper Tribunal

Authorised by the Judge for issue on 28 February 2025

Amended decision approved for re-issue on 23 April 2025 under Rule 42,

with minor amendments to paragraphs 10c., 33, 41, 76, 104 and 125

Veri Koruma Şikayetine İlişkin Temyiz Başvurusunun Reddi

Türkçe özet

Hukuki mesele

Sonuç

Karar metni