Richard J Thornton v The Information Commissioner [2025] UKFTT 689 (GRC)

[2025] UKFTT 00689 (GRC)Case Reference: FT/EA/2025/0144/GDPR
First-tier Tribunal
(General Regulatory Chamber)
Date 16 June 2025
Information Rights
Decided without a hearing
Before
JUDGE SAWARD
Between
RICHARD J THORNTONApplicantTHE INFORMATION COMMISSIONERRespondentDecision: I refuse to allow the Notice of Appeal to be admitted out of time.REASONS

Introduction

[1]On 2 April 2025, the Applicant made an application to the Tribunal pursuant to section 166(2) of the Data Protection Act 2018 (“2018 Act”) in relation to the Information Commissioner’s (“ICO”) decision reference number IC-313901-POJ9.[2]The application concerns the Applicant’s complaint to the ICO of 13 June 2024 regarding the response by Leicestershire County Council (“LCC”) to the Applicant’s data subject access and rectification request. The application seeks orders from the Tribunal that the ICO:
“Insist that LCC progress and complete my Right to Rectification request as submitted in my email to [redacted], and as I asked [redacted] to do in my email to him. (Attachments to the email to [redacted] contain a listing of the falsified data and the required corrections ascertained from the un-redacted portions of the Case Closure Summary of the Position of Trust meeting.) I also require that data records be completed with the missing investigation ‘outcomes’ as per the government’s Statutory Guidance, and a copy supplied to me as required by LCC’s own procedure. Your information request [email attachment] says that [redacted] is ignoring my Right to Rectification request because (in his 17/09/2024 email attachment) he deems it was actually a request to review the recorded minutes and outcome of the [Position of Trust] meeting (which it was not). He insists I must get the ICO to force him to progress my Right to Rectification of the data presented in the meeting.”
[3]On 2 May 2025, the ICO applied to the Tribunal to strike out the application on the ground that the ICO had provided an outcome to the complaint on 10 September 2024. The ICO also pointed out that the remedies sought by the Applicant are not outcomes that the Tribunal can grant in an application under section 166 of the 2018 Act. As such, the ICO maintains that the Tribunal has no jurisdiction to determine the application under Rule 8(2)(a), and/or there are no reasonable prospects of success under Rule 8(3)(c) of The Tribunal Procedure (First-tier Tribunal (General Regulatory Chamber) Rules 2009 (“2009 Rules”).[4]By Case Management Directions dated 12 May 2025, the Tribunal gave the Applicant opportunity to make representations in relation to the requested striking out.[5]In response to those Directions, the Applicant sent by email on 13 May 2025 a reply under Rule 24 of the 2009 Rules to the ICO’s response, along with four annexes. In reply to the ICO’s reasons for seeking strike out, the Applicant says:
“It is clear from communications following the initial ‘outcome’ of 10 September 2024 that [the ICO] conceded that neither he, nor LCC, had fully addressed all the requirements of the original 19 January 2024 Subject Access Request, and the Right to Rectification of the results thereof. It was also made clear that continued failure by LCC to fully address my requirements would warrant re-opening the case, and the issuing of further ‘outcomes’.”
[6]Annex 1 is headed ‘Concession’. It is a letter from the ICO dated 11 September 2024 in which the Lead Case Officer explains that “the complaint is closed, but can potentially be revisited. If LCC responds to your complaint, and you’re unhappy with the outcome, or if you don’t receive a response within a month, you’re welcome send me the relevant correspondence, and I will review the matter to see if there is scope for the ICO to progress an investigation.”[7]Annexe 2 is headed ‘Obfuscation’. It is a letter from the ICO dated 6 February 2025 explaining to the Applicant that the ICO had contacted LCC about the Applicant’s concerns over further information held by LCC which had not been disclosed, and that LCC had confirmed that the Applicant had been sent the information.[8]Annexe 3 is a copy of ‘Leicester and the Leicestershire and Rutland Safeguarding Children Partnerships Procedures Manual’. Annexe 4 is an extract from ‘Keeping Children Safe in Education – Statutory Guidance for Schools and Colleges’. Both documents have various passages highlighted by the Applicant.

Legal framework

[9]Section 165 of the 2018 Act sets out the right of data subjects to complain to the ICO if they consider there is an infringement of the Act in connection with their personal data. A data subject can apply to this Tribunal under section 166 for an order as follows: 166 Orders to progress complaints(1) This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner— (a) fails to take appropriate steps to respond to the complaint, (b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or (c) if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner— (a) to take appropriate steps to respond to the complaint, or (b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.(3) An order under subsection (2)(a) may require the Commissioner— (a) to take steps specified in the order; (b) to conclude an investigation, or take a specified step, within a period specified in the order.(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).[10]There are some key decisions addressing the scope of section 166.[11]In Killock and Veale v Information Commissioner [2021] UKUT 299 (ACC) the ICO had considered a complaint and undertaken some investigation, but then decided to take the complaint itself no further. The Upper Tribunal treated the discontinuance as the outcome of the complaint and beyond further challenge under section 166. It ruled (at paragraph 87) that section 166 “is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of the timely resolution of a complaint. The Tribunal is tasked with specifying appropriate “steps to respond” and not with assessing the appropriateness of a response that has already been given…”.[12]The ICO’s discretion to deal with complaints under section 166 was also considered by the High Court in R (on the application of Delo) v Information Commissioner and Wise Payments Ltd [2022] EWHC 3046 (Admin), where the Court found at paragraph 128:- ".....Sections 166(2) and (3) allow the Tribunal to order the Commissioner to take steps specified in the order to respond to the complaint. In my judgment, this would not extend to telling the Commissioner that he had to reach a conclusive determination on a complaint where the Commissioner had rendered an outcome of no further action without reaching a conclusive determination. This is because s.166 by its terms applies only where the claim is pending and has not reached the outcome stage. It applies only to alleged deficiencies in procedural steps along the way and clearly does not apply to a merits-based outcome decision."[13]Both decisions in Delo and Killock were cited by the Upper Tribunal in Cortes v Information Commissioner UA-2023-001298-GDPA, where it was reinforced (at paragraph 33) that once a complaint has been progressed to an outcome, there is no longer any scope for a section 166 order to bite.[14]More recently in Dr Michael Guy Smith v Information Commissioner [2025] UKUT 74 (AAC) the Upper Tribunal found, at paragraph 60, that all the authorities “hold that, on an application under section 166, it is for the Tribunal to decide, applying an objective test, if an “appropriate step” has been omitted, but observe that, in practice, that is unlikely to be the case where an ‘outcome’ has been produced. That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain ‘by the back door’ a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an “appropriate” step has been omitted is limited.[15]The Upper Tribunal in Smith went on to say:
“61. However, the authorities do not preclude an order being made for an appropriate step to be taken even where an outcome has already been provided. One ready example where that is likely to be appropriate is (it seems to me) where the Commissioner’s outcome only deals with part of a complaint and fails to deal with another part of the complaint as a result of oversight or other mistake. In other words, a case where effectively a single complaint is dealt with in part as the Commissioner dealt with the complaint in the Killock and Veale case itself, while the other part is treated like the complaint in the EW v IC case that was considered by the Upper Tribunal at the same time.”

Consideration and Conclusions

[16]The application to the Tribunal was brought under section 166(2) of the 2018 Act. An application under section 166(2) must be made to the Tribunal within 28 days of the expiry of 6 months from the date the ICO received the complaint (Rule 22(6)(f) of the 2009 Rules). The ICO received the complaint on 13 June 2024 and the notice of appeal is dated 2 April 2025. Therefore, the notice of appeal was late by more than 2 months.[17]In the box for ‘late applications’ within the GRC3 application form, the Applicant explains that the ‘final’ response from the ICO directing him to apply to the First-tier Tribunal was dated 10 March 2025. He applied to the Tribunal within 28 days of that final response.[18]I have discretion to extend the time limit Rule 5 (3) (a) of the 2009 Rules. Unless the Tribunal extends time then the notice of appeal must not be admitted (Rule 22(4)(b)).[19]There appears to be good reason for the delay and the ICO has responded to the application. Nevertheless, the question remains whether the application falls within the jurisdiction of the Tribunal in any event.[20]The Tribunal can only make an order under section 166(2) of the 2018 Act if one of the conditions at section 166(1)(a),(b), or (c) is met. Thus, the Tribunal can only require the ICO to take appropriate steps for procedural failings. In considering whether to do so it must consider the actions of the ICO by reference to its section 165 obligations and the relevant legal authorities.[21]The scope of an application under section 166 is to achieve some progress in a complaint that has not been progressed. In this case, the ICO identified the complaint against LCC as being a(a) failure to respond appropriately to a request to access copies of the Applicant’s personal information, and(b) holding inaccurate information. The ICO investigated the complaint, and its conclusion is set out in a letter to LCC of 10 September 2024.[22]The conclusion reached, was that LCC had not complied with its data protection obligations because it did not provide the Applicant with a response within the legal deadline. The ICO informed LCC that it should now take measures to improve its information rights practice by ensuring that all staff attend mandatory training which is routinely tested and refreshed. Further, all policies and procedures should be updated and revised to reflect the new obligations placed on controllers and processors under the UK GDPR/ 2018 Act.[23]By letter of the same date i.e. 10 September 2024, the ICO informed the Applicant of the outcome and that in its view it is likely that LCC has disclosed all the personal information that the Applicant was entitled to receive. Against each request, the ICO explained why it considered that information was exempt from disclosure. When the Applicant remained dissatisfied, the ICO acted and provided responses, ultimately deciding that the complaint will not be progressed further in a final decision dated 10 March 2025.[24]Therefore, the ICO has clearly progressed the complaint to conclusion, which has been communicated to the Applicant. I am not satisfied that there were further appropriate steps that the ICO could, and should, have taken. Nothing before me demonstrates an oversight that has not been addressed, a mistake or other procedural failure by the ICO.[25]The Applicant is dissatisfied with the response. However, his application seeks to achieve a right to rectification of personal data, and for LCC to be required to complete data records with missing investigation ‘outcomes’. They are not outcomes that this Tribunal can deliver. The Tribunal can only deal with a procedural failure of the ICO in relation to complaints under section 165. Section 166 does not concern the merits of the underlying complaint. It is limited to procedural issues by the ICO.[26]Accordingly, the application does not fall within the Tribunal’s jurisdiction. If I were to extend time to allow the Notice of Appeal to proceed, then I would immediately proceed to consider a strike out of the appeal under Rule 8(2)(a) on the basis that the Tribunal has no jurisdiction to determine it. Such a strike out would be mandatory.[27]In all the circumstances, I have concluded that it would be neither fair nor just to exercise my discretion to extend time to admit this Notice of Appeal, and so I now refuse to do so. It follows that these proceedings are at an end.