Heather Peto v The Information Commissioner

The claimant sought permission to apply for judicial review of (i) the Information Commissioner’s apparent warning that disclosure of personal data might amount to an offence under section 170 of the Data Protection Act 2018 and (ii) the Commissioner’s decision not to prosecute data controllers for alleged breaches of sections 170 and 173 of the Act and for failing to inform affected data subjects. The renewed oral application was refused.

The court held that the first challenge was academic and fact‑sensitive: whether an offence under section 170 would be committed depends on future facts, the claimant’s actual conduct and available defences, so there was no decision susceptible to review and no realistic prospect of success. The second challenge, to the decision not to prosecute, fell within the ICO’s prosecutorial discretion; absent highly exceptional circumstances or compelling evidence showing irrationality, the court would not interfere. The court also rejected the contention that a breach of any duty of candour was shown. Permission to apply for judicial review was refused and the claimant ordered to pay the defendant’s costs on a summary assessment of £1,620 to be paid within 56 days.

Background and parties: The claimant, a former co‑chair of a Labour Party affiliate (LGBT+ Labour), alleged that disclosures from a private Trans Forum of 120 members were improperly disseminated in December 2020. She complained to the Information Commissioner (ICO) asserting offences under section 170 (unlawful obtaining/disclosure) and section 173 (alteration to prevent disclosure) of the Data Protection Act 2018 and that affected members had not been informed. The ICO concluded there was insufficient evidence to substantiate offences and took no further action. The claimant, acting in person, sought judicial review; a single judge (Eyre J) refused permission and made a provisional costs order. The claimant renewed orally before Mrs Justice Stacey.

Relief sought: (i) a declaration or commitment that the claimant would not be prosecuted for informing the 120 members (or some subset) about the data breach; (ii) quashing or other relief challenging the ICO’s decision not to prosecute and alleging failure to inform the affected data subjects and breaches of Strasbourg/ECHR rights, the Human Rights Act 1998, the Equality Act 2010 and the Public Interest Disclosure Act 1998.

Issues framed by the court:

1. Whether the ICO’s prior communications amounted to a reviewable decision or threat of prosecution such that the court should grant anticipatory relief about hypothetical future conduct under section 170.
2. Whether the ICO’s decision not to prosecute was unlawful, irrational or in breach of any duty (including a duty of candour), such that judicial review should be permitted.

Court’s reasoning and conclusions: On issue (i) the court concluded the question was hypothetical and fact‑specific: section 170 is complex and the existence of defences and the lawfulness of disclosure depend on the precise future circumstances and actual conduct. There was no present decision to challenge, and any request for pre‑emptive reassurance was academic and without realistic prospects of success. On issue (ii) the court treated the decision not to prosecute as an exercise of prosecutorial discretion by a specialist body. Following established principle, only in highly exceptional circumstances would the court interfere; the claimant’s materials did not provide compelling evidence of irrationality or unlawfulness. The court also found no realistic prospect of establishing a breach of any duty of candour. The court refused permission to apply for judicial review, declined to certify the claim as totally without merit, and made an order for costs against the claimant in the sum of £1,620, to be paid within 56 days, noting the claimant’s health and limited means.

Permission to apply for judicial review is refused. The court held that the claimant’s challenge to the ICO’s note about possible prosecution under section 170 was academic and fact‑sensitive and therefore not susceptible to pre‑emptive judicial review. The challenge to the ICO’s decision not to prosecute was an exercise of prosecutorial discretion by a specialist body and, absent highly exceptional circumstances or compelling evidence of irrationality, the court would not intervene. Costs of £1,620 are awarded to the defendant, payable within 56 days.

A single judge (Eyre J) previously refused permission to apply for judicial review and made a provisional costs order on the papers; the claimant renewed orally before Mrs Justice Stacey on 13 December 2024 and the renewal was dismissed on 29 January 2025.