John Evans v Information Commissioner [2025] UKFTT 1057 (GRC)

[2025] UKFTT 01057 (GRC)Case Reference: FT/EA/2024/0341/GDPR
First-tier Tribunal
General Regulatory Chamber
Hearing Hearing date: 18 August 2025Date 09 September 2025
Information Rights
Before
Judge scherbel-balltribunal member palmer-dunkTribunal member saunders
Between
john evansApplicantINFORMATION COMMISSIONERRespondentDecision:The application for an order under s.166(2) of the Data Protection Act 2018 is dismissed.REASONS

Introduction

[1]This is an application made by Mr Evans under s.166(2) of the Data Protection Act 2018 (the “DPA 2018”) for an order requiring the Commissioner to take appropriate steps to respond to a complaint made by Mr Evans in respect of the processing of his personal data by a data controller (the “Complaint”). In this case, the data controller about whom Mr Evans complained to the Commissioner was the Financial Conduct Authority (the “FCA”).[2]The application was considered at an oral hearing which took place by CVP link on 18 August 2025. Mr Evans, the applicant, attended in person. The Commissioner was represented by Samuel Willis of Counsel. Both Mr Evans and the Commissioner filed skeleton arguments before the hearing. The Tribunal was satisfied that all parties had an ample opportunity to advance their case at the hearing and that it was appropriate to conduct the hearing by CVP link. The Tribunal was grateful for the careful, concise and helpful way in which both Mr Evans and Mr Willis advanced their respective arguments at the hearing.

Background to the Application

[3]This application arises out of the Commissioner’s handling of the Complaint. The Complaint was made by Mr Evans to the Commissioner on 26 October 2023. The Complaint concerned Mr Evans’ assertion that the FCA had inadequately responded to a subject access request he had made of the FCA for his personal data. In his application, Mr Evans says the relief which he seeks is for “the Tribunal to find that the ICO incorrectly dismissed my request for an investigation into the FCA’s refusal (by silence) to supply requested personal documents, and to advise the ICO to treat my request properly.”[4]By 12 December 2023, the Commissioner had not allocated the Complaint to a Case Officer. However, a Case Officer at the Information Commissioner’s Office (the “ICO”) was subsequently appointed by the Commissioner. On 26 January 2024, the Case Officer responded to Mr Evans in relation to the Complaint (the “Response”). In the Response, the Commissioner explained that it deals with complaints such as that from Mr Evans:
“under s.165 of the [DPA 2018] which requires us to take steps to respond to complaints including investigations to the extent that we feel is appropriate. It also requires us to inform the complainant of the outcome of their complaint.”
The Commissioner informed Mr Evans that “at this stage we do not appear to hold clear evidence of an infringement of the legislation that we oversee in your case….As we do not appear to hold any clear evidence of an infringement we have closed this case.”[5]Mr Evans was not content with the Response; on 28 January 2024, he complained to the Commissioner about the Response. In so doing, he invited the Commissioner to reconsider its position and “submit a substitution”. On 28 February 2024, Mr Evans made a further “formal complaint” in respect of the Response. At paragraph 6 of this formal complaint, Mr Evans stated “On 26 January 2014 [sic], the ICO dismissed my complaint against the FCA”. Initially, Mr Evans complained that the Commissioner had dealt with the Complaint under data protection legislation rather than under the Freedom of Information Act 2000 (“FOIA”).[6]The ICO responded to Mr Evans’ complaint about the Response on 8 March 2024. In this letter, amongst other things, the ICO informed Mr Evans that it:
“cannot involve ourselves in disputes between data controllers and data subjects when there is a disagreement regarding what personal information is held and/or provided by an organisation. Ultimately as a regulator, we have to take what a controller says in good faith, our investigations under s.165 of the [DPA 2018] are not to prove matters beyond reasonable doubt, instead to provide an outcome based on the balance of probabilities. As such a SAR may not be the most appropriate route for obtaining the information or documents you seek. In light of this, you may wish to consider independent legal advice with a view to obtaining a Court Order to access the documents you require… …A case review is the final stage of the ICO’s case handling process which means that we won’t consider this complaint further. However, I recognise that you may continue to disagree with our view. It may be helpful to explain that you are entitled to take your own cases to court under data protection legislation, irrespective of our decision.”
[7]The ICO’s letter advised Mr Evans that he could complain, if he so wished, to the Parliamentary and Health Service Ombudsman. It made no reference to any rights under s.166 of the DPA 2018.[8]Mr Evans remained dissatisfied with the ICO’s position. Following further correspondence and a complaint about the review Mr Evans had received, the ICO sent a further letter to Mr Evans dated 31 January 2025 (the “Clarification Letter”). The Commissioner describes this as a “Clarification Letter…the purpose of [which] was to assist the Applicant’s understanding of the [ICO’s] regulatory role in investigating complaints.” The Clarification Letter, stated, amongst other things:
“When you submit a complaint to The Information Commissioner’s Office (ICO) you are asked to provide supporting documents to evidence your data protection complaint. The ICO has very limited resources and we can only use those resources effectively if concerns are presented in a manner which is clear and concise, and where we are provided only with the appropriate evidence which is actually relevant to the appropriate elements of the legislation concerned. Unfortunately, you provided the ICO with a large volume of documents/correspondence which meant we were unable to determine the evidence we require to support your complaint. We did note that the FCA responded to your SAR and provided the following information in relation to any redactions applied: ‘You will notice that some redactions have been applied. There are two reasons for this. Firstly, we have removed the personal data of third parties which have no connection with your personal data. Secondly, we have removed information that is not ‘personal’ data at all and therefore falls outside the UK GDPR.’” … “At no point, through the assessment process, have you clarified the main data protection concerns beyond you being unhappy with the way in your SAR was handled by the FCA. Using the information available to us on this case, we were able to determine that the FCA responded to your SAR and provided information in regard to any redactions made. This is inline with our guidance and in accordance with UK GDPR legislation. We therefore cannot determine any infringement has occurred by the FCA on this occasion. This is what we implied when we advised you ‘At this stage we do not appear to hold clear evidence of an infringement of the legislation that we oversee in your case.’ If you believe the FCA has deliberately withheld your personal data, you will need to provide clear evidence to support this claim. This might include specific instances where you believe data was omitted or inconsistencies in the information provided. I hope this provides you with some clarification on how we have assessed your complaint and arrived at our decision outcome letter.”
[9]By letter dated 2 February 2025, Mr Evans rejected the points made by the ICO in the Clarifying Letter stating, amongst other things “I cannot accept that your further clarification is any more than a restatement of previously made comments justifying your decision not to investigate the circumstances.”[10]Mr Evans issued the instant application under s.166 of the DPA 2018 on 17 August 2024. The grounds of the application were stated in the following terms by Mr Evans:
“I submitted a request on 26 October 2023 to the [ICO] to investigate a breach of the legislation by the [FCA]…. The ICO rejected my request by their e-mail dated 26 January 2024… Their decision not to investigate my complaint was based upon the following statement in the above referenced e-mail: At this stage we do not appear to hold clear evidence of an infringement of the legislation that we oversee in your case. The rejection was ostensibly confirmed by the ICO Team Manager in her e-mail of 10 April 2024… I say ostensibly because, rather surprisingly, her e-mail is totally devoted to pointing out that I was wrong to make my request under [FOIA] and that the ICO was correct in declaring it, and treating it as, a complaint under the [DPA 2018]. She did not confirm her caseworker's findings that there was no evidence of an infringement of the legislation but, since she declared the correspondence closed, we must assume that she was confirming the caseworker's findings. On the matter of which Act my complaint should have been considered under, I refer the Tribunal to the following extract from the ICO's website, drawn to my attention by the Parliamentary and Health Service Ombudsman (PHSO): A request does not have to include the phrases “subject access request,” “right of access,” or “section 45(1) of the DPA 2018”
. It just needs to be clear that the person is asking for their own personal information. Indeed, a request may be a valid SAR even if it refers to other legislation, such as [FOIA] or the Freedom of Information (Scotland) Act 2002. Consequently, I am relaxed about the fact that the complaint was considered and decided on the basis of Section 165, and other relevant Sections, of the DPA . This appeal is built upon the ICO Lead Case Officer’s statement that there was “no clear evidence of an infringement of the legislation”. I reject this statement, and I submit that there was ample such evidence. I shall now confirm what that evidence was. 1. In my initial Subject Access Request (SAR) of 12 September 2023 (Attachment D) I specified under paragraphs A and B the types of document I was seeking. 2. I repeated this request in my e-mail to the FCA dated 26 October 2023 (Attachment E), adding that a subsequent (late) response by the FCA included an e-mail to them from their Complaints Commissioner seeking clarity on some issues. I pointed out that the FCA had not sent me their response to the Complaint Commissioner’s request, and asked specifically for a copy. None was forthcoming. I submit that non-supply of the requested data, together with the absence of a reason for such non-supply is a breach of the legislation.”[11]The Commissioner opposes the making of any order under s.166(2) of the DPA 2018. He filed his response to the application dated 10 February 2025. In short summary, the Commissioner contended in his response to the application that he had complied with the procedural requirements of the UK GDPR and the DPA 2018. The Commissioner submitted that the FTT did not have jurisdiction to consider the application and/or that it has no real prospect of success and therefore should be struck out under either r.8(2)(a) and/or r.8(3)(c) of the Tribunal’s rules. The Commissioner filed an application seeking the strike out of the application.[12]Mr Evans filed a reply dated 20 February 2025 in which he opposed the strike out application. In summary, in his reply, Mr Evans contended that: 12.1. He “believes that the FCA is guilty of suppressing a serious legitimate complaint against a major British bank, and he seeks to remedy that situation by submitting a formal complaint against the FCA. To that end, he sought a copy of relevant documents that the FCA held relating to his original complaint to the FCA. His request was not satisfied, so he complained to the [ICO]. The [ICO] refused to investigate his complaint.” 12.2. The application was based upon “the refusal of the [ICO] to take appropriate steps to respond to the complaint…and also on [the ICO’s] refusal to “inform the complainant of the progress on the complaint…”. Mr Evans was not “seeking to argue the merits of the complaint, nor is he seeking to challenge the substantive outcome of the [ICO’s] investigation into the complaint…To the contrary, [Mr Evans] is complaining that the procedure which the [ICO] is obliged to follow has not been investigated, even to a minimal extent…the [ICO] declined to investigate the complaint. There is no substantive outcome of the [ICO’s] investigation because there was no investigation.” 12.3. When he made the Complaint, Mr Evans had set out the request for documents he had originally made of the FCA. 12.4. Mr Evans had never been asked by the Commissioner to clarify his concerns when he made the Complaint and he had demonstrated on many occasions that he had clearly identified the documents which he was seeking and had confirmed that they were not provided. 12.5. The Clarification Letter would have been expected to set out the actions the Commissioner had taken to inform its conclusion in relation to the lack of sufficient evidence of a breach of the legislation. There was no such clarification contained there or in the response to this application. 12.6. Mr Evans was not able to provide evidence that he had not been supplied with documents he requested, apart from providing copies of the requests made of the FCA together with a statement he had not received them. 12.7. Paragraph 46 of the Court of Appeal’s decision in R (on the application of Delo) v Information Commissioner and Wise Payments Ltd [2024] 1 WLR 263 (CA) (“Delo CA”) was particularly apposite. This paragraph concerned submissions by the Commissioner in that case concerning the need to take “appropriate steps” even where an outcome was provided. 12.8. The dismissal of the Complaint was not an outcome for the purposes of the DPA 2018 and the UK GDPR. The Response was not an “outcome” but was rather a “dismissive flick inviting the Appellant to go away”. 12.9. Even if there had been an outcome, there had not been an investigation. The Complaint had not been handled by an investigation to the extent appropriate and no “appropriate steps” had been taken. 12.10. The DPA 2018 does not provide the Commissioner with “carte blanche” to do whatever he wishes with a complaint. He has a duty to “deal with” all complaints” referred to him “to the extent appropriate”. Mr Evans relied on paragraph 63 of Delo CA which he asserts stated: ‘….the Commissioner’s principal obligations are to address and deal with every complaint by arriving at and informing the complainant of some form of “outcome”, having first investigated the subject matter “to the extent appropriate” in the circumstances’” 12.11. Unlike in Delo CA, there was no evidence that the Commissioner had reviewed any correspondence, or undertaken any form of investigation. The Commissioner had not provided any witness evidence to support his position about an investigation. The Commissioner had not advised Mr Evans that the FCA had likely complied with its obligations. In Delo CA, Mr Evans contended that there had “obviously been a reasonable amount of investigation” by the Commissioner prior to issuing the outcome letter in that case. 12.12. A complete absence of investigation was only appropriate where a complaint was frivolous or vexatious. 12.13. The “error” committed by the Commissioner was of a procedural nature and was therefore within the scope of the Tribunal’s jurisdiction.[13]By order dated 3 June 2025, Judge Heald refused the Commissioner’s strike-out application. The Judge found that the Commissioner had not shown that Mr Evans’ case had no reasonable prospect of success. The issue of whether the Commissioner’s actions in considering the Complaint objectively amounted to “appropriate steps” was one which should be considered at a hearing.

The Relevant Legal Principles

[14]If a data subject has a complaint about the handling of their personal data by a data controller under the UK GDPR or DPA 2018 (as applicable depending on the appropriate data processing regime), they have two options, which are not mutually exclusive. One option for a data subject is to apply to court for an appropriate remedy (see Article 78 of the UK GDPR and ss.167 and 168 of the DPA 2018). Alternatively, a data subject has the right to make a complaint to the relevant supervisory authority, which in the United Kingdom is the Commissioner. This judgment and the issues which it addresses concern the latter of these two options.[15]The right to make a complaint to the Commissioner about an alleged infringement of the UK GDPR is set out in Article 77(1) of the UK GDPR. Article 77(2) of the UK GDPR provides that the Commissioner shall inform the complainant on the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 of the UK GDPR. The judicial remedies which must be available under Article 78 of the UK GDPR are(i) an effective judicial remedy against a legally binding decision of the Commissioner concerning them and(ii) the right of a data subject to an effective judicial remedy where “the Commissioner does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77.”[16]Article 77 of the UK GDPR must be read in conjunction with Article 57(1) of the UK GDPR. This latter provision sets out “tasks” of the Commissioner under the UK GDPR. Article 57(1)(f) provides that one of these tasks is to “handle complaints lodged by a data subject….and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with a foreign designated authority is necessary.”[17]These provisions of the UK GDPR must be read alongside the relevant provisions of the DPA 2018. Specifically, s.165(1) of the DPA 2018 identifies that Articles 57 and 77 of the UK GDPR “confer rights on data subject to complain to the Commissioner if the data subject considers that, in connection with the personal data relating to him or her, there is an infringement of the UK GDPR.”[18]S.165(2)-(5) of the DPA 2018 concern complaints about the processing of personal data under legislative frameworks other than the UK GDPR. Specifically these subsections concern complaints to the Commissioner about processing under Parts 3 and 4 of the DPA 2018 (law enforcement processing and intelligence services processing respectively). Accordingly, they are not relevant for the purposes of this application.[19]S.166 of the DPA 2018 is headed “Orders to progress complaints”. S.166(1) provides that the section “applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner –(a) fails to take appropriate steps to respond to the complaint,(b) fails to provide the complainant with information about progress on the complaint, or the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or(c) if the Commissioner’s consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.”[20]If one of these three gateway conditions is established, then s.166(2) of the DPA 2018 provides that the Tribunal, may, on an application by the data subject, make an order requiring the Commissioner(a) to take appropriate steps to respond to the complaint, or(b) to inform the complainant of progress, or of the outcome of the complaint, within a period specified in the order. S.166(3) provides that an order under s.166(2)(a) may require the Commissioner to (a) take steps specified in the order, and/or (b) to conclude an investigation, or take a specified step within a period specified in the order.[21]Recital 141 of the UK GDPR provides that an investigation “following a complaint should be carried out, subject to judicial review, to the extent that it is appropriate in the specific case. The supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period.”[22]Both,(i) the scope of the Commissioner’s obligations under Articles 57 and 77 of the UK GDPR and(ii) the scope of the Tribunal’s jurisdiction under s.166 of the DPA 2018 have been subject to judicial scrutiny in a number of appellate cases in recent years. These decisions include (i) Delo CA, (ii) Killock & Veale & Others v Information Commissioner [2022] 1 WLR 2241 (“Killock”),(iii) Smith v Information Commissioner [2025] UKUT 74 (AAC) (“Smith”). Delo CA and Killock were also considered by a decision of the FTT in Mahmood v Information Commissioner [2023] UKFTT 1068 (GRC) (“Mahmood”) albeit that decision is not binding on this Tribunal and predates the Upper Tribunal’s decision in Smith. We have considered the decision in Mahmood although we do not think it adds anything to the other binding authorities, in particular as a result of the subsequent decision of the Upper Tribunal in Smith.[23]We consider that the following core principles can be derived from these authorities when the Tribunal is considering its jurisdiction and discretion as to whether to make an order under s.166(2) of the DPA 2018: 23.1. First, s.166 is a “forward-looking provision” concerned with remedying ongoing procedural defects that stand in the way of a timely resolution of a complaint by a data subject to the Commissioner. It is not the role of the Tribunal when considering an application under s.166 to assess or challenge the merits of an outcome which has already been given by the Commissioner. That is a matter for the supervisory function of the High Court on an application for judicial review. Accordingly, the focus of the Tribunal is on procedural omissions – Killock at [74], [75] and [87], Smith at [136]. 23.2. Second, the scheme of the legislation does not require the Commissioner to determine every complaint on its merits. Rather, the Commissioner’s principal obligations are to address and deal with every complaint by arriving and informing the complainant of some form of “outcome” - Delo CA at [62] – [64] and [80]. 23.3. Third, the “outcome” must be the end point of the Commissioner’s handling of a complaint. A conclusive determination or ruling on the merits will be an “outcome” but the term is intended to have broad scope. Therefore an “outcome” will also include(i) a decision not to investigate further and to cease handling a specific complaint while informing and assisting wider investigation,(ii) a conclusion by the Commissioner that a data controller had “likely” complied with its obligations under the relevant data protection legislation without reaching any final conclusion and taking no further action - Delo CA at [64] and [80], Smith at [47]. 23.4. Fourth, the outcome will have been reached after the Commissioner has investigated the complaint “to the extent appropriate” in the circumstances of the case. The legislation provides the Commissioner with a broad direction to decide the intensity of any investigation according to the circumstances of the case - Delo CA at [66] and [80]. 23.5. Fifth, the Commissioner also has secondary obligation to inform the complainant of the progress of the investigation and of the complaint – Delo CA at [63]. 23.6. Sixth, where a complainant has received an outcome, there may still be circumstances where it is appropriate for the complainant to ask the Tribunal to “wind back the clock” and order an appropriate step being taken in response to a complaint under s.166(2)(a). However, these circumstances will be limited. In particular, the Tribunal will “firmly resist” attempts either to use such a mechanism to achieve a different complaint outcome or attempts to “dress up” a substantive merits challenge as procedural failings for the purposes of s.166 – Killock at [87], Smith at [60] and [136]. 23.7. Seventh, the question of what amounts to “appropriate steps” is not determined by the Commissioner and the Commissioner’s view is not decisive in this regard. The question of appropriateness is for the Tribunal to decide itself. Accordingly, the Tribunal must decide for itself, applying an objective test what is “appropriate” by way of investigation and not merely review the Commissioner’s decision as the High Court would on an application for judicial review. The Tribunal should therefore expressly direct itself to consider whether, applying an objective test, it was appropriate for the Commissioner to take further steps to respond to a complaint – Killock at [74], [84] and [116], Smith at [84] – [85]. 23.8. Eighth, when considering the appropriateness of the steps taken by the Commissioner, the Tribunal will nevertheless take into account and give weight to the views of the Commissioner as the expert regulator. A decision of the Tribunal which fails to recognise the wider regulatory context of a complaint and to demonstrate respect for the special position of the Commissioner may be susceptible to appeal. However, in so doing, the Tribunal must not tamely accept the Commissioner’s position in such a way to derogate from the judicial duty to scrutinise a case - Killock at [85] – [86]. 23.9. Ninth, examples of where there may be a justified reason for the Tribunal to make an order to “wind back the clock” under s.166(2) include (i) where the Commissioner has failed to take appropriate steps to investigate a complaint at all because it has failed to apply its own Service Standards – Killock at [117] or (ii) where the Commissioner’s outcome only deals with part of a complaint and fails to deal with another part of the complaint as a result of oversight or other mistake – Smith at [61]. 23.10. Tenth, the Tribunal always retains a discretion whether to make an order under s.166(2). It is not obliged to do so even if there has been a procedural failing by the Commissioner – Killock at [117]. 23.11. Eleventh, any order made under s.166(2) should not be reduced to a formalistic remedy. The Tribunal has the power to make an order requiring the Commissioner to take appropriate steps to respond to a complaint, which can include investigating the subject matter of the complaint to the extent necessary – Killock at [83]. The steps which a Tribunal can prescribe, where appropriate, include directing the Commissioner to make contact with the data controller to understand its position and considering in light of any such responses whether the data controller’s actions were lawful – Killock at [118].

The evidence and the parties’ submissions

[24]We have read and taken into account a joint hearing bundle of 237 pages. During the hearing, it became apparent that the parties had a slightly different bundle which included a very few additional pages. Neither party suggested that anything turned on this minor discrepancy or that anything of significance had been omitted from the Tribunal’s bundle. The Tribunal was able to locate all the documents which the parties drew to its attention in the skeleton arguments and during the course of the hearing.

Mr Evans’ Submissions

[25]In his skeleton argument for the hearing, Mr Evans described his case as an “appeal…against a refusal by the Commissioner to investigate and decide upon [his] complaint…”. In fact, this application under s.166 of the DPA 2018 is not an appeal. Mr Evans is not an appellant but an applicant for a discretionary order under the DPA 2018. We address this distinction further below, to the extent it is relevant to the decision we have to make.[26]At the hearing itself, Mr Evans’ submissions largely followed the shape and content of the points he had raised in his Reply, as outlined at paragraph 12 above.[27]In particular, Mr Evans sought to emphasise that he was not challenging any “outcome” of the Commissioner in respect of the Complaint. Rather, his case was that there was no evidence of any investigation and therefore there could not be, and was not, any “outcome” in respect of the Complaint.[28]In support of his argument about the absence of evidence, Mr Evans drew the Tribunal’s attention to paragraph 104 of Smith, in which Upper Tribunal

Judge Stout stated:

“…in general, in section 166 cases, given their limited scope, all that will be necessary for the fair disposal of the application is for the Commissioner to put before the Tribunal the documentary trail demonstrating the steps taken in dealing with any complaint (as the Commissioner did in this case by disclosing the 7 February 2023 email among others) or, if that does not tell the story, a short witness statement from the officer who dealt with the complaint may be appropriate. Since the Tribunal is not concerned with the merits of the complaint, what is required by way of disclosure or witness statement will in most cases be neither extensive or elaborate, and there is certainly no requirement for the Commissioner to put in evidence justifying or explaining the merits of the decision he took on the complaint.”
[29]Mr Evans also emphasised the authorities which show that it is for the Tribunal, not the Commissioner, to determine on an objective basis the appropriateness of the steps taken, and whether a particular investigative step is reasonable. He contends that objectively judged, the Commissioner did not take the appropriate steps required of him. There was no evidence of any thought being applied to the Complaint or explanation for why the Commissioner had told him that it had concluded that it did not “hold clear evidence of an infringement of the legislation that we oversee in your case”. The ICO had not sought to contact Mr Evans when considering the complaint to obtain clarity on anything which the Commissioner considered unclear.[30]In support of his case, Mr Evans also relies on the terms of the Clarification Letter, including in particular its assertions that (i) Mr Evans had not “clarified the main data protection concerns beyond you being unhappy with the way in which your SAR was handled by the FCA” and its assertion that he had provided the Commissioner with “a large volume of documents/correspondence which meant we were unable to determine the evidence we require to support your complaint”. Mr Evans submits both of these assertions are without foundation and demonstrate the lack of investigation undertaken by the Commissioner. Without that investigation, he repeated, there could be no outcome.[31]Mr Evans also contended that the Commissioner had failed in his handling of the Complaint to(i) inform him of his rights under s.166 of the DPA 2018 as he was required to do pursuant to s.165(4)(c) of the DPA 2018 and(ii) inform him about progress on the Complaint as required by s.165(4)(a) of the DPA 2018, read in conjunction with s.165(5)(b) of the DPA 2018.

The Commissioner’s Submissions

[32]The essence of the Commissioner’s case can be briefly summarised. His case is largely based on what he says must follow as a result of a proper understanding of the relevant authorities. Specifically, the Commissioner contends that: 32.1. The Complaint was considered, including the evidence accompanying it, and the Commissioner decided not to investigate further. The Response was the outcome of the Complaint; 32.2. Mr Evans’ arguments about the lack of an investigation and a failure to take “appropriate steps” are an impermissible attempt to “dress up” alleged procedural failings to achieve a different outcome to the Complaint; and 32.3. In substance, Mr Evans’ application is a substantive rationality or merits challenge to the outcome which the Tribunal does not have jurisdiction to address and which can only be considered by the High Court on an application for judicial review.

Discussion and Conclusions

[33]We have applied the legislative framework and legal principles set out above to the facts of this case. Having done so, we have decided to dismiss the application. In summary this is because we largely accept the Commissioner’s submissions as summarised at paragraph 32 above. In reaching our conclusion, we have expressly concluded that, objectively judged, the Commissioner did take “appropriate steps” to handle the Complaint, including investigating to the extent appropriate.[34]The starting point for our reasoning is to emphasise the essentially procedural and “forward-looking” nature of the jurisdiction under s.166 of the DPA 2018. This permits the Tribunal, where appropriate, to make an order to progress complaints in circumstances where there has been a procedural error on the part of the Commissioner. That requires consideration on the part of the Tribunal of the appropriateness of the steps taken by the Commissioner to progress a complaint, including in particular whether there has been an “outcome” to a complaint. In so doing, this is not an appeal against the Commissioner’s outcome. It is a procedural application to progress a complaint. Insofar as Mr Evans has framed the application as an appeal, this is a misunderstanding of the legislative framework.[35]In this regard, we reject Mr Evans’ attempts to suggest that there has not been an outcome in respect of the Complaint. That is not sustainable on the facts. The Response (as defined at paragraph 4 above) was plainly the outcome of the Complaint. It stated in terms, “at this stage we do not appear to hold clear evidence of an infringement of the legislation that we oversee in your case….As we do not appear to hold any clear evidence of an infringement we have closed this case.”. This conclusion falls well within the scope of a potential outcome as set out in the authorities summarised at paragraph 23.3 above. It is the Commissioner expressing a regulatory judgment in respect of the Complaint.[36]This conclusion is reinforced by the language which Mr Evans has used to describe the Response e.g. at paragraph 5 of his skeleton argument, Mr Evans himself described the Response as a “rejection of the [C]omplaint”. That would be a fair description of the Response and indeed is plainly an outcome which was available to the Commissioner. The authorities make clear that it is not this Tribunal’s role to interfere with his outcome as a matter of substance. Our view is further reinforced by a proper analysis of Mr Evans’ subsequent correspondence with the Commissioner following the Response, including multiple complaints he made about the Response.[37]In light of our conclusion that there was an outcome to the Complaint, the authorities make it clear that there is limited scope for “winding back the clock” to challenge the adequacy of the “appropriate steps” taken by the Commissioner. We do not accept that there was a wholesale failure on the part of the Commissioner to consider the Complaint or that he failed to deal with a part of the Complaint as advanced. While the circumstances set out in the authorities are not intended to be exhaustive, they do indicate that this will likely be because there has been a wholesale or material procedural failing. We do not consider that applies on the circumstances of this case.[38]In this regard, the real thrust of Mr Evans’ submissions focused on what he contended was the lack of an investigation, or adequate investigation, of the Complaint. He used this submission as the springboard for his assertion that there had been no outcome in respect of the Complaint. We have explained above why we reject the submission that there was no outcome in respect of the Complaint. We also reject the submission that there was no investigation or adequate investigation.[39]As a matter of law, we do not accept that every complaint must involve an investigation by the Commissioner, if by investigation what is meant is external engagement with a complainant and a data controller and the acquisition of relevant information from third parties such as the relevant data controller. That would be to overstate the meaning of “investigation” and to ignore the critical qualifying phrase in Article 57(1)(f) of the UK GDPR, that investigation is only required “to the extent appropriate”. In some, perhaps many cases, investigation may only require a desktop consideration of a complaint. Indeed, it may be immediately obvious on consideration of a complaint that any detailed or further investigation is not necessary from the terms of the complaint itself. For example, the complete absence of a response or any engagement from a data controller to the exercise of a data subject’s rights. In other cases, more detailed investigation and engagement with the complainant and the relevant data controller may be justified. However, Delo CA, as summarised at paragraph 23.4 above, is clear and binding authority to the effect that the Commissioner has a wide discretion as to the intensity of the investigation required for each complaint. There is no requirement, as Mr Evans contended should have happened in his case, that the Commissioner should seek clarification from a complainant or engage in further correspondence about the adequacy of the framing of the complaint.[40]We acknowledge that the Commissioner has not submitted any extraneous evidence in the form of a witness statement or correspondence with third parties, as to the nature of the investigation which the ICO undertook. In Smith at [104], the Upper Tribunal suggested that “in general”a brief documentary trail or short witness statement may be appropriate “in demonstrating the steps taken in dealing with any complaint”. However, we do not consider that the Upper Tribunal in Smith was setting out an immutable position that such evidence would always be necessary. Indeed, that would be to ignore the express caveats given at paragraph 104 of Smith. In any event, Mr Evans’ submission as to the lack of evidence relates to the nature of the investigation carried out by the ICO. Paragraph 104 of Smith concerns evidence “demonstrating the steps taken in dealing with any complaint”. That is not the same as requiring detailed evidence to demonstrate the extent of any investigation into the complaint.[41]Regardless of these distinctions, we do consider that there is an adequate documentary trail as to the steps which the Commissioner took in handling the Complaint. In this regard, we reject Mr Evans’ submission that there is no evidence of any investigation before the Tribunal. In this case, there is evidence before the Tribunal of an investigation by the ICO and the handling of the Complaint. This is found in the contents of the Response itself and the Clarification Letter. In this regard: 41.1. The Response itself expresses the conclusion that there was a lack of clear evidence of an infringement of the relevant legislation. It can properly be inferred that this conclusion was the result of consideration by the ICO of the Complaint. 41.2. The Clarification Letter itself provides further evidence of the investigation which was undertaken by the ICO. Indeed it states that it is an explanation of how the ICO “assessed [the] complaint and arrived at [its] decision outcome letter.” In this regard, it contains substantially similar information to what which could alternatively have been included in a witness statement as envisaged where appropriate in Smith. For example, the Clarification Letter addresses the ICO’s recognition when considering the Complaint that the FCA had applied redactions to the information provided in response to the subject access request because it contained third party personal data or because it did not comprise Mr Evans’ personal data. The ICO considered this position which was in line with its guidance and issued the outcome which it did. It explained, that if Mr Evans wished to contend that the FCA had deliberately withheld his personal data, he would need to provide clear evidence to support his claim. In response to this, Mr Evans submitted that he could not prove a negative, other than identifying the request and the response received. That submission however misses the point being made by the ICO. It presupposes that the information which Mr Evans says he should have been given by the FCA is his personal data in the first place. In this regard, the Tribunal notes that some of the documentation which Mr Evans contended had been withheld by the FCA was correspondence between the FCA and the Bank of Scotland, the Complaints Commissioner, the ICO itself and internal FCA communications. The fact that this correspondence may not have been disclosed to Mr Evans is not proof that the FCA failed to comply with its data protection obligations in response to a subject access request. Indeed, one of the most significant early cases on the meaning of personal data, Durant v Financial Services Authority [2003] EWCA Civ 1746 confirms that not all information held in relation to a complaint about a financial services institution will necessarily amount to the complainant’s personal data and therefore be provided in response to a subject access request. It may be that such documentation can be provided by the FCA under different legislation (for example FOIA) but that is a separate issue as to whether it amounts to or contains Mr Evans’ personal data which is responsive to a subject access request. 41.3. We accept that the Clarification Letter rather confusingly states “you provided the ICO with a large volume of documents/correspondence which meant we were unable to determine the evidence we require to support your complaint.” In isolation, this wording, which appears to have been copied and pasted into the Clarification Letter, lacks clarity and could doubtless have been better expressed. Judged in its fuller context and in particular having regard to the preceding paragraph, it suggests that the material which Mr Evans filed with the Complaint lacked sufficient clarity or evidential basis for the Commissioner to find the Complaint well founded – i.e. “to support the Complaint”. Again, this shows that consideration was given by the Commissioner to the material filed by Mr Evans in support of the Complaint. 41.4. The nub of Mr Evans’ submission in this application, properly judged, is about the adequacy of the investigation. In the hearing, he submitted that there was no evidence that the ICO had made contact with the FCA or that any clarification of the Complaint had been sought from him. The Tribunal accepts that neither of these steps were taken. However, we have set out about that not every investigation will require such steps. The legislation affords the Commissioner considerable latitude in deciding the intensity of the investigation and on the facts of this case, we consider that it was objectively appropriate for the ICO to take the steps which it did and did not take in responding to the Complaint.[42]Taking all these points together, we find that objectively judged, the Commissioner did take appropriate steps to handle the Complaint, having taken into account and considered the Commissioner’s particular role as a specialist regulator and the wide margin which he is afforded as to the intensity of any investigation applied to a particular complaint.[43]Moreover, in light of the conclusions we have set out above, we also accept the Commissioner’s contention that in reality this application is a merits complaint about the outcome dressed up as a complaint about the adequacy of procedural steps. The authorities make clear the Tribunal should be astute to avoid such an approach. This is demonstrated by(i) the content of Mr Evans’ complaints to the Commissioner following the Response and(ii) the grounds of his application to the Tribunal which state, in terms “this appeal is built upon the ICO Lead Case Officer’s statement that there was “no clear evidence of an infringement of the legislation.” I reject this statement, and I submit that there was ample such evidence…I submit that non-supply of the requested data, together with the absence of a reason for such non-supply is a breach of the legislation.” The recalibration of Mr Evans’ grounds for an order under s.166(2) DPA 2018 in the Reply to focus on the alleged lack of investigation does not alter the substance of the application. It is precisely the type of approach which the authorities make clear is impermissible.[44]Put another way, we do not consider that there is any meaningful procedural benefit which could be derived from an order requiring the Commissioner to investigate (or further investigate) Mr Evans’ the Complaint. The Commissioner has investigated the Complaint, and Mr Evans’ subsequent complaints about the Complaint, and it has rejected them. An order for further steps will not progress it further. It would be entirely circular. Accordingly, while we are satisfied that there is no basis for the exercise of our discretion to make an order under s.166(2) DPA 2018, we would have declined to exercise that discretion for the reasons we have given.[45]Finally, we address Mr Evans’ contentions that the Commissioner failed to inform him of the progress of the Complaint and failed to inform him of his rights under s.166 of the DPA 2018. While Mr Evans advanced these points under s.165(4) and (5) of the DPA 2018 which concern data processing under data protection legislation other than under the UK GDPR, we do not consider that anything turns on this as the same secondary rights exist Article 77(2) of the UK GDPR.[46]We reject Mr Evans’ submission that the Commissioner failed to inform him of the progress of the Complaint. We make two points in this regard: 46.1. First, on the evidence before the Tribunal, the ICO did inform Mr Evans of the progress of the Complaint, in an email from a Legal Executive at the ICO to Mr Evans dated 12 December 2023. In this email, the Legal Executive explained that the Complaint was awaiting allocation to a case officer and that going forward he should liaise directly with the ICO’s casework department. We consider this sufficient to meet the requirement of Article 77(2) of the UK GDPR. 46.2. Second, in any event, the jurisdictional gateway to make an order under s.166(2) of the DPA 2018 requires that the Commissioner must have failed to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months. In light of our conclusion about the Response as set out above, Mr Evans was provided with both information about the progress of the Complaint and indeed the outcome of the Complaint within the period of 3 months. There is accordingly no basis for making any order under s.166(2) of the DPA 2018.[47]In relation to Mr Evans’ contention that he was not informed of his rights to a judicial remedy to progress his complaint under s.166 of the DPA 2018, we accept that on the evidence before us, the ICO did not inform Mr Evans of his rights to a judicial remedy under Article 78, as required by Article 77. The hearing bundle does not appear to contain the “standard holding reply” which Mr Evans acknowledges he received from the ICO when he filed the Complaint (see his letters to the ICO of 14 November 2023 and 7 December 2023). The Tribunal does not know therefore whether the potential judicial remedy was indicated in this correspondence. Accordingly, on the evidence before us, we find that the Commissioner did fail to inform Mr Evans of his right to a judicial remedy under Article 78(2) of the UK GDPR[48]However, assuming that this did amount to a failure by the Commissioner to “take appropriate steps” to respond to the Complaint for the purpose of s.166(1) of the DPA 2018, which is itself debatable, we would decline to exercise our discretion to make any such order if the jurisdiction was engaged to allow us to do so. This is because any order would be entirely academic and redundant in these circumstances where(i) such a remedy only arose where the Commissioner had not handled a complaint or informed Mr Evans of the progress or outcome of his complaint within 3 months of the date of the Complaint, which it did for the reasons we have set out above and(ii) Mr Evans has in any event attempted to exercise those rights through the making of the present application. It is not the role of the Tribunal to make orders which serve no purpose. An order under s.166(2) DPA is supposed to be substantive, not formulaic.[49]For these reasons, we dismiss the application for an order against the Commissioner under s.166(2) of the DPA 2018. Our decision is unanimous.

Cited in 7 later judgments