Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
Section 166 of the Data Protection Act 2018 applies where, after a data subject makes a complaint under s165 or Article 77 of the UK GDPR, the Commissioner (in his regulatory role) fails to take appropriate steps to respond to the complaint or update the complainant in the time required. It allows a Tribunal, on an application under the section, to make an order requiring the Commissioner to take the relevant actions.
Dr Michael Guy Smith applied to the First Tier Tribunal (FTT) under s166(2) for an order that the Commissioner take further steps to respond to two complaints he had made about the Information Commissioner’s Office (the ICO). The complaints concerned the ICO’s alleged failure to retain files relating to cases brought by him. He claimed such failures amounted to infringements of the UK GDPR. The FTT refused the application.
The Upper Tribunal (UT) dismissed his appeal, holding that the decision of the FTT did not involve an error of law, but the Judge directed that a copy of the decision ‘be placed before the Commissioner personally, perhaps following a review by an appropriate member of his senior management team’ so that he could give consideration to shortcomings in the handling of the complaint which were identified in the Judgment.
The UT Judge surveyed the case law regarding s166 and the following key points may be extracted from her decision:
1. Insofar as they differ, the approach of the UT in Killock and Veale v Information Commissioner [2021] UKUT 299 (AAC), is to be preferred to that of the High Court in R (Delo) v Information Commissioner [2023] 1 WLR 1327 – consistent with the Court of Appeal decision in Delo [2024] 1 WLR 263.
2. Killock and Veale held that:
a. s166 was a mechanism for addressing procedural failings: the Tribunal had no power to deal with the merits of the complaint or its outcome.
b. The Commissioner was the expert regulator and best placed to consider the merits of a complaint and to reach a conclusion as to its outcome. The Commissioner is subject to the supervision of the High Court through judicial review.
c. The task of the Tribunal was to decide for itself, applying an objective test, whether appropriate steps had been taken, albeit giving weight to the views of the Commissioner as an expert regulator.
d. S166 is a forward-looking provision, concerned with remedying ongoing procedural defects that stand in the way of timely resolution of a complaint. This did not rule out circumstances in which, a complainant having received an outcome to a complaint, may ask the Tribunal to ‘wind back the clock’ and ask for an appropriate step to be taken in response to the complaint. If that should happen, the Tribunal will cast a critical eye to ensure the s166 process was not being used to achieve a different complaint outcome.
3. The FTT’s decision should have contained an explicit direction that the FTT must consider for itself, applying an objective test, whether it was appropriate for the Commissioner to take further steps to respond to the Appellant’s complaint. As it was, the Judge was content that the FTT had done in substance what was required of it.
4. In applying the objective test, the FTT should give weight to the Commissioner who, as the expert regulator, is entitled to respect as to the nature and extent of the investigation (if any) that is appropriate in a particular case.
5. In the absence of evidence of actual bias or other improper conduct by the Commissioner, the FTT should in principle afford the Commissioner the same respect in cases where he is investigating his own actions as ICO as the FTT does when the Commissioner is investigating the actions of third party data controllers. A fair-minded and informed observer would not conclude that there was a real possibility of bias merely because the Commissioner, in the exercise of his regulatory functions, sometimes has to investigate his own actions, given the context of his outward facing role regulating other data controllers and public authorities.
6. Where there were potential failures to comply with the overriding objective, the key question was whether any material unfairness had arisen as a result (R(Iran) v SSHD [2005] EWCA Civ 982 at [9]-[10]).
7. The FTT must of course provide adequate reasons for its decisions and it did so in this case.
8. Where the Appellant’s focus was on the merits of the Commissioner’s decision, as opposed to seeking to overcome a deficiency of process which could be remedied (here, the Appellant’s emails had been overlooked), the appropriate route of challenge is judicial review.
9. The UT held that it was unnecessary to decide whether the duty of candour applied to the Commissioner when responding to s166 application as (whether it did or not) the FTT had not erred in proceeding without ordering further disclosure or witness statements. The Judge did observe, however, that (1) in general, given the limited scope of s166 applications, which are not concerned with the merits of a complaint, the disclosure required will in most cases be neither extensive nor elaborate; but (2) the duty is not confined to judicial review and it is difficult to see what principled objection there could be to it applying in s166 applications.
This decision provides useful clarification regarding Tribunals’ approaches to s166, in particular, restricting these to procedural rather than merits based applications. Several of the key points above are also of broader application: some, such as failures to comply with the overriding objective requiring material unfairness in order for a failure to bite in an appeal, are well established. The argument for the application of the duty of candour beyond judicial review may, however, arise again elsewhere…
A monthly data protection bulletin from the barristers at 5 Essex Chambers
The Data Brief is edited by Francesca Whitelaw KC, Aaron Moss and John Goss, barristers at 5 Essex Chambers, with contributions from the whole information law, data protection and AI Team.
