Heather Peto v The Information Commissioner

Judicial review does not provide a means of obtaining advance rulings on whether hypothetical future conduct will constitute a fact-sensitive offence. Where the relevant facts have not occurred, the issue may be both academic and incapable of definitive determination.

An independent specialist prosecutor’s decision whether evidence justifies prosecution, and whether prosecution is merited, falls within a broad discretionary judgment. The court will intervene only in highly exceptional circumstances supported by compelling evidence. In the absence of such circumstances, the prosecutor need not give detailed reasons explaining why the evidence was insufficient.

The claimant sought permission to challenge two matters concerning alleged data-protection offences. First, she challenged the Information Commissioner’s advice that informing members of a former confidential forum about possible data breaches might constitute an offence under sections 170 and 173 of the Data Protection Act 2018. Secondly, she challenged the Commissioner’s decision not to prosecute alleged breaches involving the Labour Party and LGBT+ Labour.

Permission had been refused on paper by Eyre J. The claimant renewed her application orally and raised additional arguments concerning data-protection rights, human rights, equality duties, whistleblowing and candour.

1. Permission refused. The additional arguments did not overcome the fundamental difficulties identified in the paper order: neither element of the proposed claim had a realistic prospect of success.
2. The request for an assurance that the claimant would not be prosecuted concerned hypothetical future conduct in circumstances that had not occurred. Section 170 of the Data Protection Act 2018 is fact- and context-sensitive, including as to the possible application of its defences. Without the relevant facts, neither the Commissioner nor the court could determine definitively whether an offence would be committed. Courts do not decide hypothetical or academic questions: R(Rusbridger) v AG [2003] UKHL 38 at [35] and [56]; R(Zoolife International Ltd) v SSEFRA [2007] EWHC 2995 (Admin) at [36].
3. The Commissioner’s email was not a threat of prosecution. It was a genuine statement that disclosure of personal data without the controller’s consent might constitute an offence. No challengeable decision was identified. In any event, the challenge was substantially out of time, and the later correspondence had been carefully framed so as not to constitute a fresh decision.
4. The decision not to prosecute was a matter for the Commissioner as an independent specialist investigator and prosecutor. Although such decisions are reviewable, the court should intervene only in highly exceptional circumstances. The claimant’s evidence did not realistically demonstrate that the Commissioner had acted outside the wide range of lawful discretion: R(Corner House and others) v Director of the Serious Fraud Office [2008] UKHL 60 at [30], per Lord Bingham.
5. In the absence of compelling evidence supporting the challenge, the Commissioner was not obliged to provide detailed reasons explaining why the evidence was insufficient. The alleged breach of the duty of candour therefore had no realistic prospect of success.
6. The claim was not certified as totally without merit. The first ground was bound to fail, but the second, although lacking a realistic prospect of success, was not so hopeless as to meet that threshold. The claimant was ordered to pay £1,620 in costs within 56 days.

High Court (Administrative Court): permission to apply for judicial review had previously been refused on paper by Eyre J. The claimant’s renewed oral application was refused by Mrs Justice Stacey under [2025] EWHC 146 (Admin).