Dr Michael Guy Smith v Information Commissioner

Section 166 of the Data Protection Act 2018 provides a procedural remedy. The Tribunal must decide objectively whether the Commissioner has taken appropriate steps to respond to a complaint, while giving appropriate weight to the Commissioner’s regulatory expertise concerning the nature and extent of any investigation.

The Tribunal should not use section 166 to determine the merits of a complaint or to obtain a different substantive outcome. A further step may nevertheless be ordered where part of a complaint was overlooked. The same approach generally applies where the Commissioner investigates the ICO’s own conduct. Actual bias or improper conduct may affect the weight given to the Commissioner’s views.

The appellant complained that the Information Commissioner, acting as the ICO’s data controller, had failed to comply with the UK GDPR when responding to requests to retain data under Article 18(1)(c). He then complained to the Commissioner in the regulatory capacity.

The Commissioner concluded that the ICO had complied with its obligations. The First-tier Tribunal dismissed an application under section 166 of the Data Protection Act 2018, finding that appropriate investigative steps had been taken. The appellant appealed to the Upper Tribunal on grounds including apparent bias, inadequate investigation, breach of the duty of candour, procedural unfairness and inadequate reasons.

The central issues were the scope of section 166, the weight to be given to the Commissioner’s regulatory judgment, and whether the First-tier Tribunal had made an error of law.

1. Appeal dismissed. The First-tier Tribunal’s decision involved no material error of law.
2. Section 166 is principally procedural. It permits the Tribunal to order appropriate steps to respond to a complaint, or to provide progress or outcome information. It does not permit the Tribunal to determine the merits of the complaint or substitute a different regulatory outcome. The approach in Killock and Veale v Information Commissioner [2021] UKUT 299 (AAC) was preferred insofar as it differed from the High Court’s approach in R (Delo) v Information Commissioner [2023] 1 WLR 1327. That conclusion was consistent with the Court of Appeal’s decision in Delo [2024] 1 WLR 263.
3. The Tribunal must decide for itself, applying an objective test, whether a step is appropriate. It must nevertheless take account of, and give weight to, the Commissioner’s views where they reflect regulatory judgment, including decisions about the extent of investigation and deployment of resources. The Tribunal must not simply substitute its own view.
4. That approach ordinarily applies where the Commissioner investigates the ICO’s own conduct. The fact that the Commissioner is investigating himself may be relevant to the weight given to his views, but it does not require a different legal test. The Tribunal must remain alert to actual bias or improper conduct. No such conduct was established here.
5. The First-tier Tribunal’s self-direction, referring to the need for a good reason to interfere with regulatory judgment, was insufficiently precise because it did not expressly state the objective test. Read as a whole, however, the Tribunal had applied that test in practice and had independently assessed the evidence. The error was therefore immaterial.
6. It was unnecessary to decide whether a duty of candour applied in section 166 proceedings. The First-tier Tribunal had properly decided that further disclosure or witness statements were unnecessary. In such cases, the documentary trail will ordinarily suffice, with a short witness statement where the documents do not tell the full story.
7. The First-tier Tribunal was entitled to conclude that an internal email referred to a lessons-learned process rather than an undisclosed finding of breach. Its reasons were adequate, and there was no material unfairness or failure to comply with the overriding objective.
8. The appeal revealed that the Commissioner had overlooked the appellant’s email of 14 December 2022 and that the ICO had mistakenly treated an appeal as concluded. Had the case been put as a straightforward failure to respond to that email, an order under section 166 might have been available. The appellant had instead challenged the merits and reasoning of the Commissioner’s outcome, which belonged in judicial review proceedings. The decision was directed to be placed before the Commissioner personally for consideration of the shortcomings identified at paragraphs 125–136.

• Upper Tribunal (Administrative Appeals Chamber): appeal dismissed; the First-tier Tribunal decision involved no material error of law.
• First-tier Tribunal (Information Rights): application under section 166 of the Data Protection Act 2018 dismissed on 2 April 2024: [2024] UKFTT 00266 (GRC).