Gabriel Kanter-Webber v ICO (Dismissed) [2021] UKFTT 2020_0281 (GRC)

UKFTT
Gabriel Kanter-Webber v ICO (Dismissed)
[2021] UKFTT 2020_0281 (GRC) · 2021-06-01
[1]The Respondent’s Application to stay this matter pending determination of other cases by the Upper Tribunal is refused.[2]The Applicant’s Application for an Order under s166(2) of the Data Protection Act 2018 is also refused. REASONS Background[3]6 October 2020 the Applicant applied to the Tribunal for an Order to progress a complaint made under s. 165 of the Data Protection Act 2018 (“DPA”).[4]The Applicant complained to the Information Commissioner on 9 March 2020 about personal data that had been included in a letter sent by the London Borough of Barnet (‘Barnet’) to the Respondent, about which the Applicant became aware in the course of other Tribunal proceedings.[5]Having received no response, the Applicant contacted the Respondent again on 1 June 2020. The Respondent replied the following day and informed the Applicant that his complaint was not yet ‘at the top of the queue’.[6]On 17 July 2020 the Respondent sent the Applicant a more substantive response which explained the steps taken in response to his complaint in the following terms:
“We have considered the issues that you have raised with us and have written to the London Borough of Barnet to explain that we expect their organisation to work with you to resolve any outstanding matters Next Steps […] In this case, we expect the organisation to explain to you how they have complied with their obligations under the law as comprehensively as possible, including correcting any issues that they have identified or clarifying any areas of misunderstanding. [Having referred to the impact of the global pandemic] Although we expect the organisation to review your data protection concern as soon as possible, we note that it is possible that it may take them longer than usual…”
[7]The Respondent’s letter to Barnet, also dated 17 July 2020, included the following:
“If you feel that you have complied with data protection law in this case, you need to explain to your customer in as much detail as you can, why this is. You also need to be confident that you have done all that you can to find an appropriate resolution…. We therefore advise you to review the data protection concerns and provide a full response to Mr Kanter-Webber.”
[8]On 10 August 2020 the Applicant received a response from Barnet, which stated that the Applicant’s complaint had been investigated. The letter addressed each aspect of the Applicant’s complaint in turn and explained why it had concluded that it had complied with data protection obligations under GDPR, other than a failure to respond to his request within a month.[9]The Applicant remained unsatisfied with Barnet’s response and wrote to the Respondent again on 11 August 2020.[10]The Respondent replied on 4 September 2020 as follows: The ICO, when considering a data protection complaint, is obliged only to provide you with an outcome. One of the approaches that we take to casework is to use the ‘pushback’ approach, where we believe that the organisation could have done more to explain and resolve your complaint before you raise the matter with the ICO. This was the approach to take in this matter. I note the detailed response you have received from the London Borough of Barnet. I believe it addresses all of the points that you have raised in your complaint. While I appreciate that you may disagree with the response you have received, the ICO does not consider it necessary to pursue this matter further. If you disagree with the Council’s response, it is important that you respond to them with the appropriate evidence if you wish them to consider you complaint further.[11]The Applicant replied to the Respondent on the same day, stating that he did not consider her latest letter to be an ‘outcome’ to his complaint within the meaning of the DPA, which he said should comprise a clear statement upholding or dismissing the complaint that had been made. The Applicant further stated that the Respondent had failed to comply with her obligation under the DPA to investigate his complaint, and requested that she did so.[12]The Respondent sent the Applicant a further reply on 8 September 2020 in which she stated:
“Section 165(4) of the Data Protection Act 2018 states that when the Information Commissioner receives a data protection complaint, we must: (a) take appropriate steps to respond to the complaint (b) inform the complainant of the outcome of the complaint. We have taken both of these steps in this matter. In addition to this, section 165(5) states that we are required to investigate the matter ‘to the extent appropriate’. In this case we considered the evidence you provided and determined that the data controller should provide you with a more comprehensive response. We asked them to do this and they have done so. The view of the ICO is that this matter has already been investigated to the appropriate extent and we do not intend to take any further action in this matter. We appreciate that this may not be the outcome you were seeking…”
[13]The Respondent informed the Applicant that he could request a case review if he was unhappy with the way the ICO had handled his complaint. A review was carried out, and the result sent to the Applicant on 8 October 2020. This stated that the complaint had been dealt with appropriately and in accordance with case handling procedures, and would not be pursued further. The Respondent further stated:
“As […] explained in her emails, the Council has now provided you with a full and final response to your complaint, as we instructed them to do. As a result our view is that this matter has been investigated to the appropriate extent, and we do not therefore intend to take any further action.”
[14]The review letter explained that part of the ICO’s process when investigating a complaint was to consider whether further regulatory action is necessary or appropriate. “If we think an organisation has not complied with its obligations we can give them advice and ask them to solve the problem. Our main aim is to improve the information rights practices of organisations”. The Respondent drew the Applicant’s attention to the fact that he was able to bring court proceedings under the data protection legislation in his own right.[15]I note that the Applicant applied to the Tribunal for an Order two days before he received the review outcome letter from the Respondent.[16]The Applicant’s grounds in support of his application may be summarised as follows:(a) that the Respondent has not informed him of the outcome of his complaint in accordance with s165(4)(b) DPA; and(b) that the Respondent has not carried out any sort of investigation, in breach of s165(4)(a) read with 5(a). Stay Application[17]On 26 November 2020 the Tribunal refused an application by the Respondent to strike out this matter under rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009, on the basis that neither party had provided an authority on the issue of what constitutes an outcome for the purposes of s. 166(1).[18]On 17 December 2020 the Respondent provided further submissions as directed, and further requested that this application be stayed pending the outcome of 2 appeals to the Upper Tribunal relating to s. 166: Killick & Veale v Information Commissioner (QJ/2020/0303/GDPR) and EW v Information Commissioner (GI/1321/2020). When doing so the Respondent described both cases as raising ‘ very similar issues under section 166 DPA (including the meaning of “outcome” and “appropriate steps”).[19]The Applicant’s submissions in response to the stay application are, in essence, that the Respondent has refused to provide him with any details about these cases such that he is unable to make any meaningful representations on the issue. There is some force in his point.[20]Having reviewed the issues raised in Killick and Veale , and in EW , I conclude that it would not be appropriate to stay this application pending the outcome of those proceedings. This is because I am not persuaded that the issues raised by the Applicant in this case are sufficiently similar to the issues due to be considered by the Upper Tribunal. As the Respondent will be aware, the question of whether an applicant has received an ‘outcome’ pursuant to s. 165(4)(b) is frequently raised in s. 166 applications, and these continue to be determined on a case by case basis. Law Data Protection Act 2018[21]Section 165 creates a right of complaint to the Respondent by a data subject: Complaints by data subjects(1) Articles 57(1)(f) and (2) and 77 of the UK GDPR (data subject's right to lodge a complaint) confer rights on data subjects to complain to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the UK GDPR .(2) A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of Part 3 or 4 of this Act.(3) The Commissioner must facilitate the making of complaints under subsection (2) by taking steps such as providing a complaint form which can be completed electronically and by other means.(4) If the Commissioner receives a complaint under subsection (2), the Commissioner must— (a) take appropriate steps to respond to the complaint, (b) inform the complainant of the outcome of the complaint, (c) inform the complainant of the rights under section 166, and (d) if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.(5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes— (a) investigating the subject matter of the complaint, to the extent appropriate, and (b) informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with [a] foreign designated authority is necessary.[22]S.166 creates a right of application to the Tribunal: Orders to progress complaints This section has no associated Explanatory Notes[23](1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the GDPR, the Commissioner— (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner— (a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.(3) An order under subsection (2)(a) may require the Commissioner— (a) to take steps specified in the order; (b) to conclude an investigation, or take a specified step, within a period specified in the order.(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).[24]The reference in s. 166(4) to s. 165(5) means that the “appropriate steps” which must be taken by the Respondent includes investigating the subject matter of the complaint “to the extent appropriate” and keeping the complainant updated as to the progress of inquiries. The extent to which it is appropriate to investigate any complaint is a matter for the Respondent, as regulator, to determine.[25]Articles 77 & 88 of the GDPR read as follows: Article 77 Right to lodge a complaint with a supervisory authority 1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation. 2. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78. Article 78 Right to an effective judicial remedy against a supervisory authority 1. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. 2. Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to a an effective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77.[26]The limited nature of the Tribunals jurisdiction in this context has been confirmed by the Upper Tribunal, including in Scranage v Information Commissioner [2020] UKUT 196 (AAC) in which Upper Tribunal Judge Wikeley observed: [4] The Data Protection Act (DPA) 2018, which received Royal Assent on 23 May 2018, updated data protection legislation, especially in the light of the EU’s General Data Protection Regulation (GDPR). In particular, section 165 of the DPA 2018 sets out a data subject’s right to make a complaint to the Information Commissioner about an infringement of the data protection legislation in relation to his or her personal data (reflecting Articles 57 and 77 of the GDPR). Section 166 then enables a data subject to apply for an order from the Tribunal if the Commissioner does not take certain actions in relation to the data subject’s complaint. This provision, which had no equivalent in the DPA 1998, reflects the right set out in Article 78(2) of the GDPR: [5] [Article 78(2)…] [6] .. there is a widespread misunderstanding about the reach of section 166. Contrary to many data subjects’ expectations, it does not provide a right of appeal against the substantive outcome of the Information Commissioner’s investigation on its merits. Thus, section 166(1), which sets out the circumstances in which an application can be made to the Tribunal, is procedural rather than substantive in its focus. This is consistent with the terms of Article 78(2) of the GDPR (see above). The prescribed circumstances are where the Commissioner fails to take appropriate steps to respond to a complaint, or fails to update the data subject on progress with the complaint or the outcome of the complaint within three months after the submission of the complaint, or any subsequent three month period in which the Commissioner is still considering the complaint.”[27]Therefore s.166, when read together with s. 165, requires the Respondent to(i) investigate a complaint once made, and(ii) provide the person who made the complaint with an outcome, both within 3 months. Thereafter, if the Respondent has not sent a final response to the complainant, she must update them on the progress of her consideration of their complaint at least every 3 months thereafter.[28]This requirement is reflected in the Orders available to the Tribunal under s. 166(2). The Tribunal can make an Order requiring the Respondent to investigate or conclude an investigation of a complaint if she has not already done so (the ‘appropriate steps’ referred to in s. 166(2)(a)), or to provide the complainant with an update (s. 166(2)(b)).[29]The powers set out in s. 166(2) are the only ones available to the Tribunal in this context. When exercising them, the Tribunal must consider whether an Order is required at the date it determines the application. At that stage, if there continues to be a failure of the type set out in s. 166 (1) (a), (b) or (c) in relation to a complaint made under s. 165, the Tribunal has jurisdiction to make an Order. Submissions[30]The Applicant’s grounds in support of his application are set out in his initial application, and are developed in his reply to the Respondent’s further written submissions.[31]The Applicant’s position throughout has been that the Respondent has failed to provide him with an ‘outcome’. He submits that the Respondent’s letter of 17 July 2020 did not involve any consideration of the merits of his complaint and that, although the 4 September 2020 letter was more comprehensive, the Respondent’s focus remained on whether Barnet had addressed all of the points raised in his complaint, rather than whether it had complied with its obligations under GDPR.[32]The Applicant contends that in relation to each complaint received the Respondent is obliged to consider whether there has been an infringement of GDPR and must then answer that question. He submits that this is the ‘outcome’ envisaged by s. 165(4)(b).[33]The Applicant relies on the language of recital 141 of the GDPR in support of this contention. This states:
“ Every data subject should have the right to lodge a complaint with a single supervisory authority, […], and the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights under this Regulation are infringed or where the supervisory authority does not act on a complaint, partially or wholly rejects or dismisses a complaint or does not act where such action is necessary to protect the rights of the data subject. The investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case. The supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period. If the case requires further investigation or coordination with another supervisory authority, intermediate information should be given to the data subject. In order to facilitate the submission of complaints, each supervisory can also be completed electronically, without excluding other means of communication.”
[34]The Applicant submits that this gives rise to three circumstances in which an Applicant may seek a judicial remedy in relation to the supervisory authority’s handling of a complaint:a. Where no action is taken;b. Where a complaint is partially or wholly rejected or dismissed; andc. Where no action is taken in circumstances where action is necessary in order to protect the rights of the data subject.[35]The Applicant’s case is that circumstance (b) above gives rise to an inference that that the Respondent has an obligation to either uphold, reject or dismiss his complaint, or provide a valid reason for not considering the complaint at all. He contends that, in his case, the Respondent has failed to determine his complaint in any of these ways, and that he is therefore without an outcome.[36]The Applicant further submits that the Respondent has failed to investigate his complaint in any depth and therefore cannot be said to have dealt with it, or to have taken appropriate steps.[37]The Respondent submits in reply that an application to the Tribunal under s. 166 is available to a complainant only where they have made a complaint under s. 165 or Article 77 GDPR and are dissatisfied with the procedure adopted by the Respondent. She does not contest that she has an obligation under the DPA and GDPR to provide such a complainant with an ‘outcome; but submits that she has a wide margin of discretion as to how she investigates and responds to each complaint.[38]The Respondent rejects the submission that she is required to respond to every complaint by reaching a determination as to whether the complainant’s rights have been breached. She relies in part on an earlier decision by Upper Tribunal Judge Wikeley in an application for permission to appeal, Leighton v Information Commissioner (No.2) [2020] UKUT 23 (AAC (emphasis added by the Respondent ) :
“31. I note that in Platts v Information Commissioner (EA/2018/0211/GDPR ) the FTT accepted a submission made on behalf of the Commissioner that “s.166 DPA 2018 does not provide a right of appeal against the substantive outcome of an investigation into a complaint under s.165 DPA 2018”
(at paragraph [13]). Whilst that is a not a precedent setting decision, I consider that it is right as a matter of legal analysis. Section 166 is directed towards providing a tribunal-based remedy where the Commissioner fails to address a section 165 complaint in a procedurally proper fashion . Thus, the mischiefs identified by section 166(1) are all procedural failings. “Appropriate steps” mean just that, and not an “appropriate outcome”. Likewise, the FTT’s powers include making an order that the Commissioner “take appropriate steps to respond to the complaint”, and not to “take appropriate steps to resolve the complaint ”, least of all to resolve the matter to the satisfaction of the complainant. Furthermore, if the FTT had the jurisdiction to determine the substantive merits of the outcome of the Commissioner’s investigation, the consequence would be jurisdictional confusion, given the data subject’s rights to bring a civil claim in the courts under sections 167-169 (see further DPA 2018 s.180).”[39]The Respondent submits that the ‘outcome’ of a complaint in this context may take the form of decision by her not to take [further] regulatory action, or a finding that the data controller has addressed the complainant’s concerns, both of which would meet the requirement set out in s. 165(4)(a) and s.166(1)(a) that she “ take [s] appropriate steps to respond to a complaint ”. She further submits that this is reflected in the Upper Tribunal’s language in Leighton , which makes a distinction between ‘responding to’ and complaint and ‘resolving’ a complaint.[40]The Respondent relies on the language of Article 57(1)(f) of GDPR which requires a supervisory authority to “ handle” a complaint rather than reach a determination on breach.[41]The Respondent submits in addition that the rights described in Recital 141 are reflected in both Article 78(1) & (2), and the right to a judicial remedy in circumstances where the supervisory authority partially or wholly rejects or dismisses a complaint (the Applicant’s option ‘(b)’) are met though Article 78(1), which provides a right to a judicial remedy against a legally binding decision.[42]The Respondent contends that the application of the Applicant’s definition of an ‘outcome’ would result in two overlapping routes to redress under the DPA, because a complainant would be able to both seek a determination on breach by the Respondent pursuant to ss. 165 & 166 whilst also seeking the same determination from a court under ss. 167- 170. The Respondent submits that this would result in the ‘jurisdictional confusion’ described by the Upper Tribunal in Leighton .[43]The Respondent submits in addition that the creation of a 2 tier scheme of this nature, where an identical determination on breach could be sought from the Respondent and the courts, but the former without incurring costs, would lead to the Respondent being overwhelmed with complaints.[44]The Respondent further submits that application of the Applicant’s definition would curtail her discretion to decide the extent to which any complaint should be investigated, since every complaint would have to be investigated to the extent required in order to establish a breach of data protection rights.[45]In relation to the current application, the Respondent submits that both the 4 & 8 September 2020 letters provided the Applicant with an ‘outcome’ to his complaint, in that both make clear that, Barnet having responded to the Applicant’s complaint, no further action would be taken. The Respondent contrasts this with a situation in which a complainant is left unclear as to whether an investigation of a complaint is ongoing.[46]The Applicant submits in reply that a response to a complaint must engage with the subject matter of the complaint, and that a response which is simply a reply must be inadequate. He relies on Article 63 of the EU Regulation 2018/1725, a provision relating to complaints by data subjects made to the European Data Protection Supervisor, as a relevant comparable framework, under which a failure to respond or inform a complainant of an outcome within three months is deemed ‘ a negative decision’ .[47]The Applicant rejects the Respondent’s submission that some of the rights set out in Recital 141 are met through Article 78(1). He does so on the basis that this provision contains no reference to ‘complaints’ and because there is no authority for such a proposition. The Applicant submits that the application of Recital 141 to the DPA must lead to a conclusion that the purpose of ss. 165 & 166 is to create an alternative route for determination of breach, to that available in the courts pursuant to ss. 167-170. He contends that Parliament must have intended to create two routes when drafting the DPA, thereby enabling complainant to seek a determination from the Respondent without incurring cost. Conclusion[48]There is no dispute between the Parties as to whether the Respondent is required to provide an outcome in response to a complaint made under s. 165 or Article 77. The issue is whether the outcome provided must always “ either uphold, reject or dismiss [the] complaint, or provide a valid reason for not considering the complaint at all ”, including by reaching a determination relating to a breach of a complainant’s rights.[49]When considering this issue the Tribunal must give effect to the statutory language in context, having regard to the relevant statutory purpose, and is bound by any relevant decisions taken by the Upper Tribunal.[50]In context, the language of ss. 165 & 166 is open to misinterpretation, as evidenced by some previous applications to the Tribunal and as acknowledged by the Upper Tribunal in Scranage . It may therefore be helpful to summarise the principles relating to s. 166 confirmed by the Upper Tribunal to date:a. The purpose of s.166 is to give effect the rights set out in Article 78(2) ( Leighton and Scranage ).b. It does not provide a right of appeal against the substantive outcome of the Information Commissioner’s investigation on its merits ( Scranage ). The Tribunal understands the ‘substantive outcome’ of a complaint in this context to be the Respondent’s final decision in relation to it.c. “Section 166 is directed towards providing a tribunal-based remedy where the Commissioner fails to address a section 165 complaint in a procedurally proper fashion” ( Leighton ).d. This Tribunal’s powers “ include making an order that the Commissioner “take appropriate steps to respond to the complaint”, and not to “take appropriate steps to resolve the complaint”, least of all to resolve the matter to the satisfaction of the complainant” ( Leighton ).[51]The Tribunal has no jurisdiction to make an Order requiring the Commissioner to take action in relation to a complaint once an outcome has been provided to the complainant. Neither does it have jurisdiction to consider the merits of that outcome. As stated above, the Orders available under s.166(2) are purely procedural.[52]The Applicant accepts the limited nature of the Tribunal’s jurisdiction but submits that the Respondent is procedurally required to provide an outcome that upholds, rejects or dismisses his complaint, based on the language of Recital 141.[53]I am not persuaded by the Applicant’s arguments for the following reasons: i. The Applicant submits that Recital 141 gives rise to three circumstances in which there is a right to a judicial remedy in relation to the handling of a complaint:a. Where no action is taken;b. Where a complaint is partially or wholly rejected or dismissed; andc. Where no action is taken in circumstances where action is necessary in order to protect the rights of the data subject. ii. The Applicant rejects the Respondent’s submission that the right summarised at (b) refers only to decisions made under Article 78(1), relying on the fact that only Article 78(2) refers to “complaints”. However, there is nothing in the language of Article 78(2) that reflects the Applicant’s right (c), which appears to describe enforcement proceedings and in any event goes significantly beyond informing a complainant of an ‘outcome’. I therefore conclude that Article 78(2) cannot be intended to capture and reflect all of the rights described in Recital 141 in relation to the handling of complaints. When reaching this conclusion I note, in passing, that the purpose of s.166 is to give effect to the rights set out in Article 78(2), rather than those described in Recital 141. iii. As to whether the Applicant’s summarised right (b) is intended to be captured and reflected by Article 78(2), I note that this right arises in circumstances where a complaint has been wholly or partially dismissed. It is difficult to understand how the exercise of a right to a judicial remedy in such a circumstance where a complaint has been partially dismissed could be properly characterised as a procedural issue, as opposed to an appeal against a substantive outcome. Therefore, irrespective of the applicable Article(s) of the GDPR, I am bound to conclude that the appropriate judicial remedy available under domestic law in the Applicant’s summarised right (b) must be found somewhere other than in s.166, possibly by way of judicial review. iv. Although the Respondent submits that summarised right (b) is captured by Article 78(1), I note that this provision only applies to legally binding decisions by the supervisory authority. As there is nothing before me to suggest that the Respondent’s determination of a complaint is in any way legally binding, I am not convinced by the Respondent’s suggestion, but have not had the benefit of detailed submission on this issue. Alternative explanations are that summarised right (b) is captured by a wholly different Article, or that that the right is captured by Article 78(2) but the effective judicial remedy is made available under domestic law by a provision other than s.166. Again, this might be by way of judicial review, but this is not a matter I need to determine. v. The other basis upon which the Applicant seeks to argue that an outcome must encompass a determination of the complaint is by reference to Article 63 of the EU Regulation 2018/1725. However, there is no similar default presumption contained in the GDPR and no reference in any relevant GDPR Recital or Article relating to a supervisory authority having an obligation to determine every complaint. The requirement is that the complaint is investigated to the extent appropriate. vi. I therefore conclude that there is no requirement that an outcome provided under s. 165(4)(b) must include a determination of whether a complainant’s rights under the DPA or GDPR have been breached. vii. The absence of such a requirement is reflected in the Upper Tribunal decision in Leighton , which makes a clear distinction between responding to a complaint and resolving it. The Applicant’s submission that ‘resolve’ in this context should be understood as referring to taking action or enforcement proceedings is misconceived. The resolution of a complaint does not always require enforcement. I am satisfied that the distinction made by the Upper Tribunal in Leighton is between an order requiring the Respondent to take action in response to a complaint, which is a procedural matter within the Tribunal’s jurisdiction, and an order requiring the respondent to resolve a complaint by determining it, which is not. viii. This is because such an order would to interfere with the discretion afforded to the Respondent in Recital 141 and s.165, to determine the extent to which it is appropriate to investigate any complaint. This wide margin of discretion must be incompatible with an obligation to determine in each case whether a complainant’s rights have been breached. This is also why the Applicant’s second ground in support of his application, relating to the extent to which his complaint has been investigated, also fails to succeed. It is clear from correspondence that the Respondent has considered the Applicant’s complaint and has investigated it to the extent to which she considers it appropriate, in this case through application of her ‘pushback’ policy.[54]Having reached these conclusions, I have then considered whether the Applicant has received an ‘outcome’ in relation to his complaint as at the date of this decision, by considering whether he has been informed of the Respondent’s ‘final decision’. I have concluded that he has received such an outcome. Although the language used in the Respondent’s July letter was suboptimal, since it left the Applicant without a clear understanding of the extent to which his complaint remained under consideration, I am satisfied that the language of the 4 and 8 September letters, and the 8 October review letter, left the Applicant in no doubt as to the Respondent’s final decision in respect of his complaint.[55]Accordingly, I conclude that there is no longer a basis for making an Order under s. 166(2) DPA on the facts of this case. The Application is therefore dismissed.. (Signed) JUDGE MOIRA MACMILLAN DATE: 1 June 2021 (Amended under the slip rule - 19 October 2021)