British
and Irish Legal Information Institute
Freely Available British and Irish Public Legal Information
[
Home]
[
Databases]
[
World Law]
[
Multidatabase Search]
[
Help]
[
Feedback]
First-tier Tribunal (General Regulatory Chamber)
You are here:
BAILII >>
Databases >>
First-tier Tribunal (General Regulatory Chamber) >>
Bonner v Information Commissioner [2025] UKFTT 765 (GRC) (25 June 2025)
URL: http://www.bailii.org/uk/cases/UKFTT/GRC/2025/765.html
Cite as:
[2025] UKFTT 765 (GRC)
[
New search]
[
Printable PDF version]
[
Help]
|
|
Neutral Citation Number: [2025] UKFTT 765 (GRC) |
|
|
Case Reference: FT/EA/2025/0145/GDPR |
First-tier Tribunal
(General Regulatory Chamber)
Information Rights
|
|
Decided without a hearing
|
|
|
Decision Given On: 25 June 2025 |
B e f o r e :
JUDGE HARRIS
____________________
Between:
|
GREGORY BONNER
|
Applicant
|
|
- and -
|
|
|
THE INFORMATION COMMISSIONER
|
Respondent
|
____________________
____________________
HTML VERSION OF DECISION
____________________
Crown Copyright ©
Decision: The proceedings are struck out under Rule 8(3)(c) because there is no reasonable prospect of the Applicant's case, or any part of it, succeeding.
REASONS
Background
- These proceedings concern an application under section 166(2) of the Data Protection Act 2018 ("DPA 2018") for an order to progress the Applicant's complaint against handling of a subject access request ("SAR") by Verso Wealth Management Limited ("VWML"), which was submitted to the Respondent on 11 October 2024 (Reference IC-338720-C7J4).
- On 12 February 2025, the Respondent acknowledged the Applicant's complaint and informed him that there was currently an 18-week delay in allocation to a case officer.
- On 12 March 2025 the Applicant requested an internal service review because he was unhappy with the delay in responding to the complaint.
- On 23 March 2025, the Appellant applied to the Tribunal by way of form GRC3. He explained that he had raised the complaint as part of an employment issue which will go to the Employment Tribunal. He stated that VWML "has not provided the requested information in any sort of compliant response to a DSAR and has deliberately sought to obstruct the DSAR in order to withhold evidence which may be used against them". He noted the delays which he had experienced in his complaint being dealt with by the Respondent. He also commented "Per above the information sought is required for employment tribunal. I need the ICO to review the request and compel [VWML] to comply with the DSAR. The delay has caused significant issues. I was not able to file and interim relief claim as I did not have the necessary evidence that would have been available had the DASAR been complied with. I had to delay filing due to not having the information required and I am now struggling to prepare for hearings without the required evidence. I believe the timescales provided by the ICO are plucked from thin air and have no confidence the case is actually being looked at, hence this claim."
- In his response, the Respondent provided a chronology of steps which he said were taken after the Applicant had filed his appeal. These were as follows:
a. "On 12 April 2024, the Applicant telephoned the Commissioner's Helpline and advised that he had submitted a service complaint and had not received a response. The Helpline case officer apologised for the delay and confirmed that his complaint had still not been allocated. On the same day, the Helpline case officer raised the issue internally that the Applicant's complaint remained unallocated.
b. On 16 April 2024, the Applicant's complaint was allocated to the Commissioner's case officer. On the same day, the case officer sent an email to the Applicant apologising for the delay and assured the Applicant that she would review all the information that had been provided in relation to the complaint and would be in touch.
c. On 24 April 2025, the case officer sent an email to the Applicant providing an update. She advised the Applicant that she had reviewed all of the information relating to the complaint and was in the process of contacting the appropriate contact point for VWML and that she would provide a timeline at some point next week. On the same day, the case officer sent an email to VWML to ascertain the correct contact point in relation to information rights and asked for this information within the next 7 days.
d. On 25 April 2025, the data protection officer contacted the case officer with confirmation of their correct contact point. On 28 April 2025, the case officer sent an email to VWML's contact point advising that the Commissioner had received a complaint from the Applicant about how they had handled the Applicant's SAR. The case officer advised that it was her view that there was more work for VWML to do and requested that they revisit the way they had handled the complaint and consider what further action they could now take to resolve matters.
e. On the same day, the case officer sent an outcome letter to the Applicant confirming that she had written to VMWL raising the Applicant's issues with their contact point and explaining that she expected VMWL to contact the Applicant following consideration of the issues raised and that they consider next steps within the next 14 days."
- The letter to the Applicant dated 28 April 2025 stated "We have considered the issues that you have raised and based on this information, it is our view that there is more work for the organisation to do. We have therefore raised your concerns with Verso Wealth Management explaining that we want them to work with you to resolve any outstanding matters." The letter went on to state the Respondent's expectations of VWML in response to this. Finally, the letter noted that the Employment Tribunal has powers to order disclosure of evidence. It says "We note in your correspondence to us you mention needing this information as you have an employment tribunal going on. It may be useful to explain that you may obtain more information as part of the court process than under the SAR. A SAR only covers personal data and is then subject to exemptions. However, as we understand any information may be provided to you as part of the court proceedings if it is relevant to those proceedings. Unfortunately we do not oversee this process and would suggest you may want to obtain your own legal advice or approach the courts if you need information for the court proceedings.
- The Respondent, in his response to the application dated 1 May 2025, acknowledged that there may have been a delay in providing the Applicant with an outcome on their complaint, for which he apologises. However, he noted that an outcome had been provided in correspondence dated 28 April 2025 and in light of this, there is no rbasis for the Tribunal to make an order under section 166(2) of the DPA 2018. He submitted that the application had no prospect of success and the Tribunal was invited to strike out the application under rule 8(3)c) of the Tribunal Rules.
- The Tribunal sought submissions from the Applicant in relation to the Respondent's application to strike out the case by directions dated 9 June 2025.
- The Applicant responded with submissions dated 16 June 2025. In summary, the points raised were as follows:
a. The IC has not taken appropriate steps to respond to his complaint. He states "I do not ask the Tribunal to second-guess the Commissioner's view, but to recognise that no genuine view has been reached, because no meaningful investigation has been undertaken."
b. The letter which the IC sent on 28 April 2025 stated only that it had asked VWML to reconsider the matter. "No evaluation of the complaint's legal substance was offered. No further contact or follow-up has been received. No engagement was made with my evidence, which includes specific references to breaches of Articles 12(5),15(4) UK GDPR and the failure to cite valid exemptions under schedules 2-3 DPA 2018".
c. His application is limited to the IC's procedural failings to investigate the subject matter of his complaint, engage with the breaches and misused exemptions raised, provide a reasoned response or address the service complaints made by the Applicant on 14 March and 27 May 2025.
d. The "outcome" provided by the letter dated 28 April 2025 is procedurally deficient. He relies on Delo to say that an outcome must follow a proportionate and appropriate investigation, which he says has not occurred here. He also relies on paragraph 85 of Killock in saying that the Tribunal must give weight to the Commissioner's regulatory discretion only where it has actually been exercised. He says "there is no evidence of that here – no review of my legal arguments, no record of reasoning, no enforcement.".
Legal framework
- Section 165 DPA 2018 sets out the right of data subjects to complain to the Commissioner about infringement of their rights under the data protection legislation. Under section 166 DPA 2018 a data subject can make an application to this Tribunal for an order as follows:
"Orders to progress complaints
This section applies where, after a data subject makes a complaint under section 165 or Article 77 of the UK GDPR, the Commissioner -
a. fails to take appropriate steps to respond to the complaint,
b. fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint, or
c. if the Commissioner's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order requiring the Commissioner -
a. to take appropriate steps to respond to the complaint, or
b. to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order."
- The Tribunal can only make an order under section 166(2) if one of the conditions at section 166(1)(a), (b) or (c) is met. There have been a number of appeal decisions which have considered the scope of section 166. It is clearly established that the Tribunal's powers are limited to procedural issues, rather than the merits or substantive outcome of a complaint.
12. The case of Killock v Information Commissioner [2022] 1 WLR 2241, Upper Tribunal at paragraph 74 stated - "…It is plain from the statutory words that, on an application under section 166, the Tribunal will not be concerned and has no power to deal with the merits of the complaint or its outcome. We reach this conclusion on the plain and ordinary meaning of the statutory language but it is supported by the Explanatory Notes to the Act which regard the section 166 remedy as reflecting the provisions of article 78(2) which are procedural. Any attempt by a party to divert a tribunal from the procedural failings listed in section 166 towards a decision on the merits of the complaint must be firmly resisted by tribunals."
- Mostyn J in the High Court in R (Delo) v Information Commissioner [2023] 1 WLR 1327, paragraph 57 - "The treatment of such complaints by the commissioner, as before, remains within his exclusive discretion. He decides the scale of an investigation of a complaint to the extent that he thinks appropriate. He decides therefore whether an investigation is to be short, narrow and light or whether it is to be long, wide and heavy. He decides what weight, if any, to give to the ability of a data subject to apply to a court against a data controller or processor under article 79. And then he decides whether he shall, or shall not, reach a conclusive determination...".
- Mostyn J's decision in Delo was upheld by the Court of Appeal ([2023] EWCA Civ 1141) – "For the reasons I have given I would uphold the conclusion of the judge at [85] that the legislative scheme requires the Commissioner to receive and consider a complaint and then provides the Commissioner with a broad discretion as to whether to conduct a further investigation and, if so, to what extent. I would further hold, in agreement with the judge, that having done that much the Commissioner is entitled to conclude that it is unnecessary to determine whether there has been an infringement but sufficient to reach and express a view about the likelihood that this is so and to take no further action. By doing so the Commissioner discharges his duty to inform the complainant of the outcome of their complaint." (paragraph 80, Warby LJ).
15. The decision of the Upper Tribunal in Cortes v Information Commissioner (UA-2023-001298-GDPA) which applied both Killock and Delo in confirming that the nature of section 166 is that of a limited procedural provision only. "The Tribunal is tasked with specifying appropriate "steps to respond" and not with assessing the appropriateness of a response that has already been given (which would raise substantial regulatory questions susceptible only to the supervision of the High Court)….As such, the fallacy in the Applicant's central argument is laid bare. If Professor Engelman is correct, then any data subject who is dissatisfied with the outcome of their complaint to the Commissioner could simply allege that it was reached after an inadequate investigation, and thereby launch a collateral attack on the outcome itself with the aim of the complaint decision being re-made with a different outcome. Such a scenario would be inconsistent with the purport of Article 78.2, the heading and text of section 166 and the thrust of the decisions and reasoning in both Killock and Veale and R (on the application of Delo). It would also make a nonsense of the jurisdictional demarcation line between the FTT under section 166 and the High Court on an application for judicial review." (paragraph 33).
- The case of Dr Michael Guy Smith v Information Commissioner [2025] UKUT 74 (AAC), noted at paragraph 60 that "it is for the Tribunal to decide, applying an objective test, if an "appropriate step" has been omitted, but observe that, in practice, that is unlikely to be the case where an 'outcome' has been produced. That is for two main reasons: first, because section 166 is a procedural provision and, as the principal mechanisms for enforcing rights or challenging the Commissioner are either claims against the data controller or judicial review of the Commissioner, section 166 should not be used to obtain 'by the back door' a remedy normally only available in those proceedings; secondly, because, if the Commissioner has already produced an outcome then, given the very wide discretion that the Commissioner has, both as to what and how to investigate and as to outcome, the scope for the Tribunal to say that an appropriate step has been omitted is limited." In considering this the Tribunal must, as set out in paragraph 85 of Killick "when deciding objectively whether any (further) appropriate step needs to be taken by the Commissioner, take into account and give weight to the views of the Commissioner as an expert regulator."
- The Applicant refers in his submissions to paragraph 85 of Killick as authority for the fact that the Tribunal must give weight to the Commissioner's regulatory discretion only where it has actually been exercised (his emphasis added). It does not appear that this paragraph supports the Applicant's contention, as it does not refer to this point. The paragraph reads as follows: "However, in considering appropriateness, the Tribunal will be bound to take into consideration and give weight to the views of the Commissioner as an expert regulator. The GRC is a specialist tribunal and may deploy (as in Platts) its non-legal members appointed to the Tribunal for their expertise. It is nevertheless our view that, in the sphere of complaints, the Commissioner has the institutional competence and is in the best position to decide what investigations she should undertake into any particular issue, and how she should conduct those investigations. As Mr Milford emphasised, her decisions about these matters will be informed not only by the nature of the complaint itself but also by a range of other factors such as her own regulatory priorities, other investigations in the same subject area and her judgment on how to deploy her limited resources most effectively. Any decision of a Tribunal which fails to recognise the wider regulatory context of a complaint and to demonstrate respect for the special position of the Commissioner may be susceptible to appeal in this Chamber."
Discussion and conclusions
- The IC provided the Applicant with a response to his complaint dated 28 April 2025. I am satisfied that this IC, both provided an outcome to the complaint and demonstrated that the IC had given consideration to whether there were other appropriate steps which could be taken to progress the Applicant's complaint. I consider this is supported by the fact that the letter makes reference to other steps which the Applicant could take which are beyond the control of the IC, such as making an application for disclosure to the Employment Tribunal. It appears to me therefore that there were no further appropriate steps which the IC ought reasonably to have taken to progress the complaint.
- In light of paragraph 57 of Delo, which I mention above, it appears to me that it is a matter for the IC to determine what investigation is appropriate, particularly noting "He decides the scale of an investigation of a complaint to the extent that he thinks appropriate.". The Tribunal's power to order progression of a complaint under section 166 is limited to ordering the IC to take appropriate steps to respond to a complaint, or to inform the complainant of progress or an outcome within a specified period.
- The Applicant's other points, particularly his assertion that the IC has failed to engage with the breaches and misused exemptions raised and provide a reasoned response to his complaint are, in effect, challenging the substantive outcome of the complaint to the Commissioner. The Tribunal does not have power under section 166 to consider the merits or substantive outcome of a complaint. Section 166 is limited to narrow procedural issues and there is no further procedural failing in respect of which the Tribunal can make a decision.
- I therefore find that there is no reasonable prospect of the case, or any part of it, succeeding. The proceedings are therefore struck out.
Signed: Judge Harris
Date: 25 June 2025